Nsxt Provider

import * as pulumi from "@pulumi/pulumi";

const config = new pulumi.Config();
const nsxManager = config.requireObject("nsxManager");
const nsxUsername = config.requireObject("nsxUsername");
const nsxPassword = config.requireObject("nsxPassword");

import pulumi

config = pulumi.Config()
nsx_manager = config.require_object("nsxManager")
nsx_username = config.require_object("nsxUsername")
nsx_password = config.require_object("nsxPassword")

using System.Collections.Generic;
using System.Linq;
using Pulumi;

return await Deployment.RunAsync(() =>
{
    var config = new Config();
    var nsxManager = config.RequireObject<dynamic>("nsxManager");
    var nsxUsername = config.RequireObject<dynamic>("nsxUsername");
    var nsxPassword = config.RequireObject<dynamic>("nsxPassword");
});

package main

import (
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi/config"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		cfg := config.New(ctx, "")
		nsxManager := cfg.RequireObject("nsxManager")
		nsxUsername := cfg.RequireObject("nsxUsername")
		nsxPassword := cfg.RequireObject("nsxPassword")
		return nil
	})
}

configuration:
  nsxManager:
    type: dynamic
  nsxUsername:
    type: dynamic
  nsxPassword:
    type: dynamic

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var config = ctx.config();
        final var nsxManager = config.get("nsxManager");
        final var nsxUsername = config.get("nsxUsername");
        final var nsxPassword = config.get("nsxPassword");
    }
}

# Pulumi.yaml provider configuration file
name: configuration-example
runtime: nodejs
config:
    nsxt:allowUnverifiedSsl:
        value: true
    nsxt:host:
        value: 'TODO: var.nsx_manager'
    nsxt:maxRetries:
        value: 10
    nsxt:password:
        value: 'TODO: var.nsx_password'
    nsxt:retryMaxDelay:
        value: 5000
    nsxt:retryMinDelay:
        value: 500
    nsxt:retryOnStatusCodes:
        value:
            - 429
    nsxt:username:
        value: 'TODO: var.nsx_username'

import * as pulumi from "@pulumi/pulumi";
import * as nsxt from "@pulumi/nsxt";

const config = new pulumi.Config();
const nsxTagScope = config.get("nsxTagScope") || "project";
const nsxTag = config.get("nsxTag") || "pulumi-demo";
//
// This part of the example shows some functions we will need to refer to
// later in the .tf file. They include the transport zone, tier 0 router and
// edge cluster.
// There Tier-0 (T0) Gateway is considered a "provider" router that is pre-created
// by the NSX Admin. A T0 Gateway is used for north/south connectivity between
// the logical networking space and the physical networking space. Many Tier1
// Gateways will be connected to the T0 Gateway
//
const demo = nsxt.getPolicyEdgeCluster({
    displayName: "Edge-Cluster",
});
const overlayTz = nsxt.getPolicyTransportZone({
    displayName: "Overlay-TZ",
});
const t0Gateway = nsxt.getPolicyTier0Gateway({
    displayName: "TF-T0-Gateway",
});
//
// Create a DHCP Profile that is used later
// Note, this resource is only in NSX 3.0.0+
const tierDhcp = new nsxt.PolicyDhcpServer("tier_dhcp", {
    displayName: "tier_dhcp",
    description: "DHCP server servicing all 3 Segments",
    serverAddresses: ["12.12.99.2/24"],
});
//
// In this part of the example, the settings required to create a Tier1 Gateway
// are defined. In NSX a Tier1 Gateway is often used on a per user, tenant,
// department or application basis. Each application may have it's own Tier1
// Gateway. The Tier1 Gateway provides the default gateway for virtual machines
// connected to the Segments on the Tier1 Gateway
//
const t1Gateway = new nsxt.PolicyTier1Gateway("t1_gateway", {
    displayName: "TF_T1",
    description: "Tier1 provisioned by Pulumi",
    edgeClusterPath: demo.then(demo => demo.path),
    dhcpConfigPath: tierDhcp.path,
    failoverMode: "PREEMPTIVE",
    defaultRuleLogging: false,
    enableFirewall: true,
    enableStandbyRelocation: false,
    forceWhitelisting: false,
    tier0Path: t0Gateway.then(t0Gateway => t0Gateway.path),
    routeAdvertisementTypes: [
        "TIER1_STATIC_ROUTES",
        "TIER1_CONNECTED",
    ],
    poolAllocation: "ROUTING",
    tags: [{
        scope: nsxTagScope,
        tag: nsxTag,
    }],
    routeAdvertisementRules: [{
        name: "rule1",
        action: "DENY",
        subnets: [
            "20.0.0.0/24",
            "21.0.0.0/24",
        ],
        prefixOperator: "GE",
        routeAdvertisementTypes: ["TIER1_CONNECTED"],
    }],
});
//
// This shows the settings required to create NSX Segment (Logical Switch) to
// which you can attach Virtual Machines (VMs)
//
const web = new nsxt.PolicySegment("web", {
    displayName: "web-tier",
    description: "Pulumi provisioned Web Segment",
    connectivityPath: t1Gateway.path,
    transportZonePath: overlayTz.then(overlayTz => overlayTz.path),
    subnets: [{
        cidr: "12.12.1.1/24",
        dhcpRanges: ["12.12.1.100-12.12.1.160"],
        dhcpV4Config: {
            serverAddress: "12.12.1.2/24",
            leaseTime: 36000,
            dhcpOption121s: [{
                network: "6.6.6.0/24",
                nextHop: "1.1.1.21",
            }],
        },
    }],
    tags: [
        {
            scope: nsxTagScope,
            tag: nsxTag,
        },
        {
            scope: "tier",
            tag: "web",
        },
    ],
});
const app = new nsxt.PolicySegment("app", {
    displayName: "app-tier",
    description: "Pulumi provisioned App Segment",
    connectivityPath: t1Gateway.path,
    transportZonePath: overlayTz.then(overlayTz => overlayTz.path),
    subnets: [{
        cidr: "12.12.2.1/24",
        dhcpRanges: ["12.12.2.100-12.12.2.160"],
        dhcpV4Config: {
            serverAddress: "12.12.2.2/24",
            leaseTime: 36000,
            dhcpOption121s: [{
                network: "6.6.6.0/24",
                nextHop: "1.1.1.21",
            }],
        },
    }],
    tags: [
        {
            scope: nsxTagScope,
            tag: nsxTag,
        },
        {
            scope: "tier",
            tag: "app",
        },
    ],
});
const db = new nsxt.PolicySegment("db", {
    displayName: "db-tier",
    description: "Pulumi provisioned DB Segment",
    connectivityPath: t1Gateway.path,
    transportZonePath: overlayTz.then(overlayTz => overlayTz.path),
    subnets: [{
        cidr: "12.12.3.1/24",
        dhcpRanges: ["12.12.3.100-12.12.3.160"],
        dhcpV4Config: {
            serverAddress: "12.12.3.2/24",
            leaseTime: 36000,
            dhcpOption121s: [{
                network: "6.6.6.0/24",
                nextHop: "1.1.1.21",
            }],
        },
    }],
    tags: [
        {
            scope: nsxTagScope,
            tag: nsxTag,
        },
        {
            scope: "tier",
            tag: "db",
        },
    ],
});
//
// This part of the example shows creating Groups with dynamic membership
// criteria
//
// All Virtual machines with specific tag and scope
const allVms = new nsxt.PolicyGroup("all_vms", {
    displayName: "All_VMs",
    description: "Group consisting of ALL VMs",
    criterias: [{
        conditions: [{
            memberType: "VirtualMachine",
            operator: "CONTAINS",
            key: "Tag",
            value: nsxTag,
        }],
    }],
});
// All WEB VMs
const webGroup = new nsxt.PolicyGroup("web_group", {
    displayName: "Web_VMs",
    description: "Group consisting of Web VMs",
    criterias: [{
        conditions: [{
            memberType: "VirtualMachine",
            operator: "CONTAINS",
            key: "Tag",
            value: "web",
        }],
    }],
    tags: [{
        scope: nsxTagScope,
        tag: nsxTag,
    }],
});
// All App VMs
const appGroup = new nsxt.PolicyGroup("app_group", {
    displayName: "App_VMs",
    description: "Group consisting of App VMs",
    criterias: [{
        conditions: [{
            memberType: "VirtualMachine",
            operator: "CONTAINS",
            key: "Tag",
            value: "app",
        }],
    }],
    tags: [{
        scope: nsxTagScope,
        tag: nsxTag,
    }],
});
// All DB VMs
const dbGroup = new nsxt.PolicyGroup("db_group", {
    displayName: "DB_VMs",
    description: "Group consisting of DB VMs",
    criterias: [{
        conditions: [{
            memberType: "VirtualMachine",
            operator: "CONTAINS",
            key: "Tag",
            value: "db",
        }],
    }],
    tags: [{
        scope: nsxTagScope,
        tag: nsxTag,
    }],
});
// Static Group of IP addresses
const ipSet = new nsxt.PolicyGroup("ip_set", {
    displayName: "external_IPs",
    description: "Group containing all external IPs",
    criterias: [{
        ipaddressExpression: {
            ipAddresses: [
                "211.1.1.1",
                "212.1.1.1",
                "192.168.1.1-192.168.1.100",
            ],
        },
    }],
    tags: [{
        scope: nsxTagScope,
        tag: nsxTag,
    }],
});
//
// An example for Service for App that listens on port 8443
//
const appService = new nsxt.PolicyService("app_service", {
    displayName: "app_service_8443",
    description: "Service for App that listens on port 8443",
    l4PortSetEntries: [{
        description: "TCP Port 8443",
        protocol: "TCP",
        destinationPorts: ["8443"],
    }],
    tags: [{
        scope: nsxTagScope,
        tag: nsxTag,
    }],
});
//
// Here we have examples of create functions for Services
//
const https = nsxt.getPolicyService({
    displayName: "HTTPS",
});
const mysql = nsxt.getPolicyService({
    displayName: "MySQL",
});
const ssh = nsxt.getPolicyService({
    displayName: "SSH",
});
//
// In this section, we have example to create Firewall sections and rules
// All rules in this section will be applied to VMs that are part of the
// Gropus we created earlier
//
const firewallSection = new nsxt.PolicySecurityPolicy("firewall_section", {
    displayName: "DFW Section",
    description: "Firewall section created by Pulumi",
    scopes: [allVms.path],
    category: "Application",
    locked: false,
    stateful: true,
    tags: [{
        scope: nsxTagScope,
        tag: nsxTag,
    }],
    rules: [
        {
            displayName: "Allow HTTPS",
            description: "In going rule",
            action: "ALLOW",
            logged: false,
            ipVersion: "IPV4",
            destinationGroups: [webGroup.path],
            services: [https.then(https => https.path)],
        },
        {
            displayName: "Allow SSH",
            description: "In going rule",
            action: "ALLOW",
            logged: false,
            ipVersion: "IPV4",
            destinationGroups: [webGroup.path],
            services: [ssh.then(ssh => ssh.path)],
        },
        {
            displayName: "Allow Web to App",
            description: "Web to App communication",
            action: "ALLOW",
            logged: false,
            ipVersion: "IPV4",
            sourceGroups: [webGroup.path],
            destinationGroups: [appGroup.path],
            services: [appService.path],
        },
        {
            displayName: "Allow App to DB",
            description: "App to DB communication",
            action: "ALLOW",
            logged: false,
            ipVersion: "IPV4",
            sourceGroups: [appGroup.path],
            destinationGroups: [dbGroup.path],
            services: [mysql.then(mysql => mysql.path)],
        },
        {
            displayName: "Allow Infrastructure",
            description: "Allow DNS and Management servers",
            action: "ALLOW",
            logged: true,
            ipVersion: "IPV4",
            sourceGroups: [ipSet.path],
            destinationGroups: [allVms.path],
        },
        {
            displayName: "Allow out",
            description: "Outgoing rule",
            action: "ALLOW",
            logged: true,
            ipVersion: "IPV4",
            sourceGroups: [allVms.path],
        },
        {
            displayName: "Deny ANY",
            description: "Default Deny the traffic",
            action: "REJECT",
            logged: true,
            ipVersion: "IPV4",
        },
    ],
});
//
// Here we have examples for creating NAT rules. The example here assumes
// the Web IP addresses are reachable from outside and no NAT is required.
//
const rule1 = new nsxt.PolicyNatRule("rule1", {
    displayName: "App 1-to-1 In",
    action: "SNAT",
    translatedNetworks: ["102.10.22.1"],
    sourceNetworks: ["12.12.2.0/24"],
    gatewayPath: t1Gateway.path,
    tags: [{
        scope: nsxTagScope,
        tag: nsxTag,
    }],
});
const rule2 = new nsxt.PolicyNatRule("rule2", {
    displayName: "App 1-to-1 Out",
    action: "DNAT",
    translatedNetworks: ["102.10.22.2"],
    destinationNetworks: ["102.10.22.1/32"],
    sourceNetworks: ["12.12.2.0/24"],
    gatewayPath: t1Gateway.path,
    tags: [{
        scope: nsxTagScope,
        tag: nsxTag,
    }],
});
const rule3 = new nsxt.PolicyNatRule("rule3", {
    displayName: "DB 1-to-1 In",
    action: "SNAT",
    translatedNetworks: ["102.10.23.1"],
    sourceNetworks: ["12.12.3.0/24"],
    gatewayPath: t1Gateway.path,
    tags: [{
        scope: nsxTagScope,
        tag: nsxTag,
    }],
});
const rule4 = new nsxt.PolicyNatRule("rule4", {
    displayName: "App 1-to-1 Out",
    action: "DNAT",
    translatedNetworks: ["102.10.23.3"],
    destinationNetworks: ["102.10.23.1/32"],
    sourceNetworks: ["12.12.3.0/24"],
    gatewayPath: t1Gateway.path,
    tags: [{
        scope: nsxTagScope,
        tag: nsxTag,
    }],
});
// The 3 VMs available in the NSX Inventory
const webVm = nsxt.getPolicyVm({
    displayName: "web-vm",
});
const appVm = nsxt.getPolicyVm({
    displayName: "app-vm",
});
const dbVm = nsxt.getPolicyVm({
    displayName: "db-vm",
});
// Assign the right tags to the VMs so that they get included in the
// dynamic groups created above
const webVmTag = new nsxt.PolicyVmTags("web_vm_tag", {
    instanceId: webVm.then(webVm => webVm.instanceId),
    tags: [
        {
            scope: "tier",
            tag: "web",
        },
        {
            scope: nsxTagScope,
            tag: nsxTag,
        },
    ],
});
const appVmTag = new nsxt.PolicyVmTags("app_vm_tag", {
    instanceId: appVm.then(appVm => appVm.instanceId),
    tags: [
        {
            scope: "tier",
            tag: "app",
        },
        {
            scope: nsxTagScope,
            tag: nsxTag,
        },
    ],
});
const dbVmTag = new nsxt.PolicyVmTags("db_vm_tag", {
    instanceId: dbVm.then(dbVm => dbVm.instanceId),
    tags: [
        {
            scope: "tier",
            tag: "db",
        },
        {
            scope: nsxTagScope,
            tag: nsxTag,
        },
    ],
});

# Pulumi.yaml provider configuration file
name: configuration-example
runtime: python
config:
    nsxt:allowUnverifiedSsl:
        value: true
    nsxt:host:
        value: 'TODO: var.nsx_manager'
    nsxt:maxRetries:
        value: 10
    nsxt:password:
        value: 'TODO: var.nsx_password'
    nsxt:retryMaxDelay:
        value: 5000
    nsxt:retryMinDelay:
        value: 500
    nsxt:retryOnStatusCodes:
        value:
            - 429
    nsxt:username:
        value: 'TODO: var.nsx_username'

import pulumi
import pulumi_nsxt as nsxt

config = pulumi.Config()
nsx_tag_scope = config.get("nsxTagScope")
if nsx_tag_scope is None:
    nsx_tag_scope = "project"
nsx_tag = config.get("nsxTag")
if nsx_tag is None:
    nsx_tag = "pulumi-demo"
#
# This part of the example shows some functions we will need to refer to
# later in the .tf file. They include the transport zone, tier 0 router and
# edge cluster.
# There Tier-0 (T0) Gateway is considered a "provider" router that is pre-created
# by the NSX Admin. A T0 Gateway is used for north/south connectivity between
# the logical networking space and the physical networking space. Many Tier1
# Gateways will be connected to the T0 Gateway
#
demo = nsxt.get_policy_edge_cluster(display_name="Edge-Cluster")
overlay_tz = nsxt.get_policy_transport_zone(display_name="Overlay-TZ")
t0_gateway = nsxt.get_policy_tier0_gateway(display_name="TF-T0-Gateway")
#
# Create a DHCP Profile that is used later
# Note, this resource is only in NSX 3.0.0+
tier_dhcp = nsxt.PolicyDhcpServer("tier_dhcp",
    display_name="tier_dhcp",
    description="DHCP server servicing all 3 Segments",
    server_addresses=["12.12.99.2/24"])
#
# In this part of the example, the settings required to create a Tier1 Gateway
# are defined. In NSX a Tier1 Gateway is often used on a per user, tenant,
# department or application basis. Each application may have it's own Tier1
# Gateway. The Tier1 Gateway provides the default gateway for virtual machines
# connected to the Segments on the Tier1 Gateway
#
t1_gateway = nsxt.PolicyTier1Gateway("t1_gateway",
    display_name="TF_T1",
    description="Tier1 provisioned by Pulumi",
    edge_cluster_path=demo.path,
    dhcp_config_path=tier_dhcp.path,
    failover_mode="PREEMPTIVE",
    default_rule_logging=False,
    enable_firewall=True,
    enable_standby_relocation=False,
    force_whitelisting=False,
    tier0_path=t0_gateway.path,
    route_advertisement_types=[
        "TIER1_STATIC_ROUTES",
        "TIER1_CONNECTED",
    ],
    pool_allocation="ROUTING",
    tags=[{
        "scope": nsx_tag_scope,
        "tag": nsx_tag,
    }],
    route_advertisement_rules=[{
        "name": "rule1",
        "action": "DENY",
        "subnets": [
            "20.0.0.0/24",
            "21.0.0.0/24",
        ],
        "prefix_operator": "GE",
        "route_advertisement_types": ["TIER1_CONNECTED"],
    }])
#
# This shows the settings required to create NSX Segment (Logical Switch) to
# which you can attach Virtual Machines (VMs)
#
web = nsxt.PolicySegment("web",
    display_name="web-tier",
    description="Pulumi provisioned Web Segment",
    connectivity_path=t1_gateway.path,
    transport_zone_path=overlay_tz.path,
    subnets=[{
        "cidr": "12.12.1.1/24",
        "dhcp_ranges": ["12.12.1.100-12.12.1.160"],
        "dhcp_v4_config": {
            "server_address": "12.12.1.2/24",
            "lease_time": 36000,
            "dhcp_option121s": [{
                "network": "6.6.6.0/24",
                "next_hop": "1.1.1.21",
            }],
        },
    }],
    tags=[
        {
            "scope": nsx_tag_scope,
            "tag": nsx_tag,
        },
        {
            "scope": "tier",
            "tag": "web",
        },
    ])
app = nsxt.PolicySegment("app",
    display_name="app-tier",
    description="Pulumi provisioned App Segment",
    connectivity_path=t1_gateway.path,
    transport_zone_path=overlay_tz.path,
    subnets=[{
        "cidr": "12.12.2.1/24",
        "dhcp_ranges": ["12.12.2.100-12.12.2.160"],
        "dhcp_v4_config": {
            "server_address": "12.12.2.2/24",
            "lease_time": 36000,
            "dhcp_option121s": [{
                "network": "6.6.6.0/24",
                "next_hop": "1.1.1.21",
            }],
        },
    }],
    tags=[
        {
            "scope": nsx_tag_scope,
            "tag": nsx_tag,
        },
        {
            "scope": "tier",
            "tag": "app",
        },
    ])
db = nsxt.PolicySegment("db",
    display_name="db-tier",
    description="Pulumi provisioned DB Segment",
    connectivity_path=t1_gateway.path,
    transport_zone_path=overlay_tz.path,
    subnets=[{
        "cidr": "12.12.3.1/24",
        "dhcp_ranges": ["12.12.3.100-12.12.3.160"],
        "dhcp_v4_config": {
            "server_address": "12.12.3.2/24",
            "lease_time": 36000,
            "dhcp_option121s": [{
                "network": "6.6.6.0/24",
                "next_hop": "1.1.1.21",
            }],
        },
    }],
    tags=[
        {
            "scope": nsx_tag_scope,
            "tag": nsx_tag,
        },
        {
            "scope": "tier",
            "tag": "db",
        },
    ])
#
# This part of the example shows creating Groups with dynamic membership
# criteria
#
# All Virtual machines with specific tag and scope
all_vms = nsxt.PolicyGroup("all_vms",
    display_name="All_VMs",
    description="Group consisting of ALL VMs",
    criterias=[{
        "conditions": [{
            "member_type": "VirtualMachine",
            "operator": "CONTAINS",
            "key": "Tag",
            "value": nsx_tag,
        }],
    }])
# All WEB VMs
web_group = nsxt.PolicyGroup("web_group",
    display_name="Web_VMs",
    description="Group consisting of Web VMs",
    criterias=[{
        "conditions": [{
            "member_type": "VirtualMachine",
            "operator": "CONTAINS",
            "key": "Tag",
            "value": "web",
        }],
    }],
    tags=[{
        "scope": nsx_tag_scope,
        "tag": nsx_tag,
    }])
# All App VMs
app_group = nsxt.PolicyGroup("app_group",
    display_name="App_VMs",
    description="Group consisting of App VMs",
    criterias=[{
        "conditions": [{
            "member_type": "VirtualMachine",
            "operator": "CONTAINS",
            "key": "Tag",
            "value": "app",
        }],
    }],
    tags=[{
        "scope": nsx_tag_scope,
        "tag": nsx_tag,
    }])
# All DB VMs
db_group = nsxt.PolicyGroup("db_group",
    display_name="DB_VMs",
    description="Group consisting of DB VMs",
    criterias=[{
        "conditions": [{
            "member_type": "VirtualMachine",
            "operator": "CONTAINS",
            "key": "Tag",
            "value": "db",
        }],
    }],
    tags=[{
        "scope": nsx_tag_scope,
        "tag": nsx_tag,
    }])
# Static Group of IP addresses
ip_set = nsxt.PolicyGroup("ip_set",
    display_name="external_IPs",
    description="Group containing all external IPs",
    criterias=[{
        "ipaddress_expression": {
            "ip_addresses": [
                "211.1.1.1",
                "212.1.1.1",
                "192.168.1.1-192.168.1.100",
            ],
        },
    }],
    tags=[{
        "scope": nsx_tag_scope,
        "tag": nsx_tag,
    }])
#
# An example for Service for App that listens on port 8443
#
app_service = nsxt.PolicyService("app_service",
    display_name="app_service_8443",
    description="Service for App that listens on port 8443",
    l4_port_set_entries=[{
        "description": "TCP Port 8443",
        "protocol": "TCP",
        "destination_ports": ["8443"],
    }],
    tags=[{
        "scope": nsx_tag_scope,
        "tag": nsx_tag,
    }])
#
# Here we have examples of create functions for Services
#
https = nsxt.get_policy_service(display_name="HTTPS")
mysql = nsxt.get_policy_service(display_name="MySQL")
ssh = nsxt.get_policy_service(display_name="SSH")
#
# In this section, we have example to create Firewall sections and rules
# All rules in this section will be applied to VMs that are part of the
# Gropus we created earlier
#
firewall_section = nsxt.PolicySecurityPolicy("firewall_section",
    display_name="DFW Section",
    description="Firewall section created by Pulumi",
    scopes=[all_vms.path],
    category="Application",
    locked=False,
    stateful=True,
    tags=[{
        "scope": nsx_tag_scope,
        "tag": nsx_tag,
    }],
    rules=[
        {
            "display_name": "Allow HTTPS",
            "description": "In going rule",
            "action": "ALLOW",
            "logged": False,
            "ip_version": "IPV4",
            "destination_groups": [web_group.path],
            "services": [https.path],
        },
        {
            "display_name": "Allow SSH",
            "description": "In going rule",
            "action": "ALLOW",
            "logged": False,
            "ip_version": "IPV4",
            "destination_groups": [web_group.path],
            "services": [ssh.path],
        },
        {
            "display_name": "Allow Web to App",
            "description": "Web to App communication",
            "action": "ALLOW",
            "logged": False,
            "ip_version": "IPV4",
            "source_groups": [web_group.path],
            "destination_groups": [app_group.path],
            "services": [app_service.path],
        },
        {
            "display_name": "Allow App to DB",
            "description": "App to DB communication",
            "action": "ALLOW",
            "logged": False,
            "ip_version": "IPV4",
            "source_groups": [app_group.path],
            "destination_groups": [db_group.path],
            "services": [mysql.path],
        },
        {
            "display_name": "Allow Infrastructure",
            "description": "Allow DNS and Management servers",
            "action": "ALLOW",
            "logged": True,
            "ip_version": "IPV4",
            "source_groups": [ip_set.path],
            "destination_groups": [all_vms.path],
        },
        {
            "display_name": "Allow out",
            "description": "Outgoing rule",
            "action": "ALLOW",
            "logged": True,
            "ip_version": "IPV4",
            "source_groups": [all_vms.path],
        },
        {
            "display_name": "Deny ANY",
            "description": "Default Deny the traffic",
            "action": "REJECT",
            "logged": True,
            "ip_version": "IPV4",
        },
    ])
#
# Here we have examples for creating NAT rules. The example here assumes
# the Web IP addresses are reachable from outside and no NAT is required.
#
rule1 = nsxt.PolicyNatRule("rule1",
    display_name="App 1-to-1 In",
    action="SNAT",
    translated_networks=["102.10.22.1"],
    source_networks=["12.12.2.0/24"],
    gateway_path=t1_gateway.path,
    tags=[{
        "scope": nsx_tag_scope,
        "tag": nsx_tag,
    }])
rule2 = nsxt.PolicyNatRule("rule2",
    display_name="App 1-to-1 Out",
    action="DNAT",
    translated_networks=["102.10.22.2"],
    destination_networks=["102.10.22.1/32"],
    source_networks=["12.12.2.0/24"],
    gateway_path=t1_gateway.path,
    tags=[{
        "scope": nsx_tag_scope,
        "tag": nsx_tag,
    }])
rule3 = nsxt.PolicyNatRule("rule3",
    display_name="DB 1-to-1 In",
    action="SNAT",
    translated_networks=["102.10.23.1"],
    source_networks=["12.12.3.0/24"],
    gateway_path=t1_gateway.path,
    tags=[{
        "scope": nsx_tag_scope,
        "tag": nsx_tag,
    }])
rule4 = nsxt.PolicyNatRule("rule4",
    display_name="App 1-to-1 Out",
    action="DNAT",
    translated_networks=["102.10.23.3"],
    destination_networks=["102.10.23.1/32"],
    source_networks=["12.12.3.0/24"],
    gateway_path=t1_gateway.path,
    tags=[{
        "scope": nsx_tag_scope,
        "tag": nsx_tag,
    }])
# The 3 VMs available in the NSX Inventory
web_vm = nsxt.get_policy_vm(display_name="web-vm")
app_vm = nsxt.get_policy_vm(display_name="app-vm")
db_vm = nsxt.get_policy_vm(display_name="db-vm")
# Assign the right tags to the VMs so that they get included in the
# dynamic groups created above
web_vm_tag = nsxt.PolicyVmTags("web_vm_tag",
    instance_id=web_vm.instance_id,
    tags=[
        {
            "scope": "tier",
            "tag": "web",
        },
        {
            "scope": nsx_tag_scope,
            "tag": nsx_tag,
        },
    ])
app_vm_tag = nsxt.PolicyVmTags("app_vm_tag",
    instance_id=app_vm.instance_id,
    tags=[
        {
            "scope": "tier",
            "tag": "app",
        },
        {
            "scope": nsx_tag_scope,
            "tag": nsx_tag,
        },
    ])
db_vm_tag = nsxt.PolicyVmTags("db_vm_tag",
    instance_id=db_vm.instance_id,
    tags=[
        {
            "scope": "tier",
            "tag": "db",
        },
        {
            "scope": nsx_tag_scope,
            "tag": nsx_tag,
        },
    ])

# Pulumi.yaml provider configuration file
name: configuration-example
runtime: dotnet
config:
    nsxt:allowUnverifiedSsl:
        value: true
    nsxt:host:
        value: 'TODO: var.nsx_manager'
    nsxt:maxRetries:
        value: 10
    nsxt:password:
        value: 'TODO: var.nsx_password'
    nsxt:retryMaxDelay:
        value: 5000
    nsxt:retryMinDelay:
        value: 500
    nsxt:retryOnStatusCodes:
        value:
            - 429
    nsxt:username:
        value: 'TODO: var.nsx_username'

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Nsxt = Pulumi.Nsxt;

return await Deployment.RunAsync(() =>
{
    var config = new Config();
    var nsxTagScope = config.Get("nsxTagScope") ?? "project";
    var nsxTag = config.Get("nsxTag") ?? "pulumi-demo";
    //
    // This part of the example shows some functions we will need to refer to
    // later in the .tf file. They include the transport zone, tier 0 router and
    // edge cluster.
    // There Tier-0 (T0) Gateway is considered a "provider" router that is pre-created
    // by the NSX Admin. A T0 Gateway is used for north/south connectivity between
    // the logical networking space and the physical networking space. Many Tier1
    // Gateways will be connected to the T0 Gateway
    //
    var demo = Nsxt.GetPolicyEdgeCluster.Invoke(new()
    {
        DisplayName = "Edge-Cluster",
    });

    var overlayTz = Nsxt.GetPolicyTransportZone.Invoke(new()
    {
        DisplayName = "Overlay-TZ",
    });

    var t0Gateway = Nsxt.GetPolicyTier0Gateway.Invoke(new()
    {
        DisplayName = "TF-T0-Gateway",
    });

    //
    // Create a DHCP Profile that is used later
    // Note, this resource is only in NSX 3.0.0+
    var tierDhcp = new Nsxt.PolicyDhcpServer("tier_dhcp", new()
    {
        DisplayName = "tier_dhcp",
        Description = "DHCP server servicing all 3 Segments",
        ServerAddresses = new[]
        {
            "12.12.99.2/24",
        },
    });

    //
    // In this part of the example, the settings required to create a Tier1 Gateway
    // are defined. In NSX a Tier1 Gateway is often used on a per user, tenant,
    // department or application basis. Each application may have it's own Tier1
    // Gateway. The Tier1 Gateway provides the default gateway for virtual machines
    // connected to the Segments on the Tier1 Gateway
    //
    var t1Gateway = new Nsxt.PolicyTier1Gateway("t1_gateway", new()
    {
        DisplayName = "TF_T1",
        Description = "Tier1 provisioned by Pulumi",
        EdgeClusterPath = demo.Apply(getPolicyEdgeClusterResult => getPolicyEdgeClusterResult.Path),
        DhcpConfigPath = tierDhcp.Path,
        FailoverMode = "PREEMPTIVE",
        DefaultRuleLogging = false,
        EnableFirewall = true,
        EnableStandbyRelocation = false,
        ForceWhitelisting = false,
        Tier0Path = t0Gateway.Apply(getPolicyTier0GatewayResult => getPolicyTier0GatewayResult.Path),
        RouteAdvertisementTypes = new[]
        {
            "TIER1_STATIC_ROUTES",
            "TIER1_CONNECTED",
        },
        PoolAllocation = "ROUTING",
        Tags = new[]
        {
            new Nsxt.Inputs.PolicyTier1GatewayTagArgs
            {
                Scope = nsxTagScope,
                Tag = nsxTag,
            },
        },
        RouteAdvertisementRules = new[]
        {
            new Nsxt.Inputs.PolicyTier1GatewayRouteAdvertisementRuleArgs
            {
                Name = "rule1",
                Action = "DENY",
                Subnets = new[]
                {
                    "20.0.0.0/24",
                    "21.0.0.0/24",
                },
                PrefixOperator = "GE",
                RouteAdvertisementTypes = new[]
                {
                    "TIER1_CONNECTED",
                },
            },
        },
    });

    //
    // This shows the settings required to create NSX Segment (Logical Switch) to
    // which you can attach Virtual Machines (VMs)
    //
    var web = new Nsxt.PolicySegment("web", new()
    {
        DisplayName = "web-tier",
        Description = "Pulumi provisioned Web Segment",
        ConnectivityPath = t1Gateway.Path,
        TransportZonePath = overlayTz.Apply(getPolicyTransportZoneResult => getPolicyTransportZoneResult.Path),
        Subnets = new[]
        {
            new Nsxt.Inputs.PolicySegmentSubnetArgs
            {
                Cidr = "12.12.1.1/24",
                DhcpRanges = new[]
                {
                    "12.12.1.100-12.12.1.160",
                },
                DhcpV4Config = new Nsxt.Inputs.PolicySegmentSubnetDhcpV4ConfigArgs
                {
                    ServerAddress = "12.12.1.2/24",
                    LeaseTime = 36000,
                    DhcpOption121s = new[]
                    {
                        new Nsxt.Inputs.PolicySegmentSubnetDhcpV4ConfigDhcpOption121Args
                        {
                            Network = "6.6.6.0/24",
                            NextHop = "1.1.1.21",
                        },
                    },
                },
            },
        },
        Tags = new[]
        {
            new Nsxt.Inputs.PolicySegmentTagArgs
            {
                Scope = nsxTagScope,
                Tag = nsxTag,
            },
            new Nsxt.Inputs.PolicySegmentTagArgs
            {
                Scope = "tier",
                Tag = "web",
            },
        },
    });

    var app = new Nsxt.PolicySegment("app", new()
    {
        DisplayName = "app-tier",
        Description = "Pulumi provisioned App Segment",
        ConnectivityPath = t1Gateway.Path,
        TransportZonePath = overlayTz.Apply(getPolicyTransportZoneResult => getPolicyTransportZoneResult.Path),
        Subnets = new[]
        {
            new Nsxt.Inputs.PolicySegmentSubnetArgs
            {
                Cidr = "12.12.2.1/24",
                DhcpRanges = new[]
                {
                    "12.12.2.100-12.12.2.160",
                },
                DhcpV4Config = new Nsxt.Inputs.PolicySegmentSubnetDhcpV4ConfigArgs
                {
                    ServerAddress = "12.12.2.2/24",
                    LeaseTime = 36000,
                    DhcpOption121s = new[]
                    {
                        new Nsxt.Inputs.PolicySegmentSubnetDhcpV4ConfigDhcpOption121Args
                        {
                            Network = "6.6.6.0/24",
                            NextHop = "1.1.1.21",
                        },
                    },
                },
            },
        },
        Tags = new[]
        {
            new Nsxt.Inputs.PolicySegmentTagArgs
            {
                Scope = nsxTagScope,
                Tag = nsxTag,
            },
            new Nsxt.Inputs.PolicySegmentTagArgs
            {
                Scope = "tier",
                Tag = "app",
            },
        },
    });

    var db = new Nsxt.PolicySegment("db", new()
    {
        DisplayName = "db-tier",
        Description = "Pulumi provisioned DB Segment",
        ConnectivityPath = t1Gateway.Path,
        TransportZonePath = overlayTz.Apply(getPolicyTransportZoneResult => getPolicyTransportZoneResult.Path),
        Subnets = new[]
        {
            new Nsxt.Inputs.PolicySegmentSubnetArgs
            {
                Cidr = "12.12.3.1/24",
                DhcpRanges = new[]
                {
                    "12.12.3.100-12.12.3.160",
                },
                DhcpV4Config = new Nsxt.Inputs.PolicySegmentSubnetDhcpV4ConfigArgs
                {
                    ServerAddress = "12.12.3.2/24",
                    LeaseTime = 36000,
                    DhcpOption121s = new[]
                    {
                        new Nsxt.Inputs.PolicySegmentSubnetDhcpV4ConfigDhcpOption121Args
                        {
                            Network = "6.6.6.0/24",
                            NextHop = "1.1.1.21",
                        },
                    },
                },
            },
        },
        Tags = new[]
        {
            new Nsxt.Inputs.PolicySegmentTagArgs
            {
                Scope = nsxTagScope,
                Tag = nsxTag,
            },
            new Nsxt.Inputs.PolicySegmentTagArgs
            {
                Scope = "tier",
                Tag = "db",
            },
        },
    });

    //
    // This part of the example shows creating Groups with dynamic membership
    // criteria
    //
    // All Virtual machines with specific tag and scope
    var allVms = new Nsxt.PolicyGroup("all_vms", new()
    {
        DisplayName = "All_VMs",
        Description = "Group consisting of ALL VMs",
        Criterias = new[]
        {
            new Nsxt.Inputs.PolicyGroupCriteriaArgs
            {
                Conditions = new[]
                {
                    new Nsxt.Inputs.PolicyGroupCriteriaConditionArgs
                    {
                        MemberType = "VirtualMachine",
                        Operator = "CONTAINS",
                        Key = "Tag",
                        Value = nsxTag,
                    },
                },
            },
        },
    });

    // All WEB VMs
    var webGroup = new Nsxt.PolicyGroup("web_group", new()
    {
        DisplayName = "Web_VMs",
        Description = "Group consisting of Web VMs",
        Criterias = new[]
        {
            new Nsxt.Inputs.PolicyGroupCriteriaArgs
            {
                Conditions = new[]
                {
                    new Nsxt.Inputs.PolicyGroupCriteriaConditionArgs
                    {
                        MemberType = "VirtualMachine",
                        Operator = "CONTAINS",
                        Key = "Tag",
                        Value = "web",
                    },
                },
            },
        },
        Tags = new[]
        {
            new Nsxt.Inputs.PolicyGroupTagArgs
            {
                Scope = nsxTagScope,
                Tag = nsxTag,
            },
        },
    });

    // All App VMs
    var appGroup = new Nsxt.PolicyGroup("app_group", new()
    {
        DisplayName = "App_VMs",
        Description = "Group consisting of App VMs",
        Criterias = new[]
        {
            new Nsxt.Inputs.PolicyGroupCriteriaArgs
            {
                Conditions = new[]
                {
                    new Nsxt.Inputs.PolicyGroupCriteriaConditionArgs
                    {
                        MemberType = "VirtualMachine",
                        Operator = "CONTAINS",
                        Key = "Tag",
                        Value = "app",
                    },
                },
            },
        },
        Tags = new[]
        {
            new Nsxt.Inputs.PolicyGroupTagArgs
            {
                Scope = nsxTagScope,
                Tag = nsxTag,
            },
        },
    });

    // All DB VMs
    var dbGroup = new Nsxt.PolicyGroup("db_group", new()
    {
        DisplayName = "DB_VMs",
        Description = "Group consisting of DB VMs",
        Criterias = new[]
        {
            new Nsxt.Inputs.PolicyGroupCriteriaArgs
            {
                Conditions = new[]
                {
                    new Nsxt.Inputs.PolicyGroupCriteriaConditionArgs
                    {
                        MemberType = "VirtualMachine",
                        Operator = "CONTAINS",
                        Key = "Tag",
                        Value = "db",
                    },
                },
            },
        },
        Tags = new[]
        {
            new Nsxt.Inputs.PolicyGroupTagArgs
            {
                Scope = nsxTagScope,
                Tag = nsxTag,
            },
        },
    });

    // Static Group of IP addresses
    var ipSet = new Nsxt.PolicyGroup("ip_set", new()
    {
        DisplayName = "external_IPs",
        Description = "Group containing all external IPs",
        Criterias = new[]
        {
            new Nsxt.Inputs.PolicyGroupCriteriaArgs
            {
                IpaddressExpression = new Nsxt.Inputs.PolicyGroupCriteriaIpaddressExpressionArgs
                {
                    IpAddresses = new[]
                    {
                        "211.1.1.1",
                        "212.1.1.1",
                        "192.168.1.1-192.168.1.100",
                    },
                },
            },
        },
        Tags = new[]
        {
            new Nsxt.Inputs.PolicyGroupTagArgs
            {
                Scope = nsxTagScope,
                Tag = nsxTag,
            },
        },
    });

    //
    // An example for Service for App that listens on port 8443
    //
    var appService = new Nsxt.PolicyService("app_service", new()
    {
        DisplayName = "app_service_8443",
        Description = "Service for App that listens on port 8443",
        L4PortSetEntries = new[]
        {
            new Nsxt.Inputs.PolicyServiceL4PortSetEntryArgs
            {
                Description = "TCP Port 8443",
                Protocol = "TCP",
                DestinationPorts = new[]
                {
                    "8443",
                },
            },
        },
        Tags = new[]
        {
            new Nsxt.Inputs.PolicyServiceTagArgs
            {
                Scope = nsxTagScope,
                Tag = nsxTag,
            },
        },
    });

    //
    // Here we have examples of create functions for Services
    //
    var https = Nsxt.GetPolicyService.Invoke(new()
    {
        DisplayName = "HTTPS",
    });

    var mysql = Nsxt.GetPolicyService.Invoke(new()
    {
        DisplayName = "MySQL",
    });

    var ssh = Nsxt.GetPolicyService.Invoke(new()
    {
        DisplayName = "SSH",
    });

    //
    // In this section, we have example to create Firewall sections and rules
    // All rules in this section will be applied to VMs that are part of the
    // Gropus we created earlier
    //
    var firewallSection = new Nsxt.PolicySecurityPolicy("firewall_section", new()
    {
        DisplayName = "DFW Section",
        Description = "Firewall section created by Pulumi",
        Scopes = new[]
        {
            allVms.Path,
        },
        Category = "Application",
        Locked = false,
        Stateful = true,
        Tags = new[]
        {
            new Nsxt.Inputs.PolicySecurityPolicyTagArgs
            {
                Scope = nsxTagScope,
                Tag = nsxTag,
            },
        },
        Rules = new[]
        {
            new Nsxt.Inputs.PolicySecurityPolicyRuleArgs
            {
                DisplayName = "Allow HTTPS",
                Description = "In going rule",
                Action = "ALLOW",
                Logged = false,
                IpVersion = "IPV4",
                DestinationGroups = new[]
                {
                    webGroup.Path,
                },
                Services = new[]
                {
                    https.Apply(getPolicyServiceResult => getPolicyServiceResult.Path),
                },
            },
            new Nsxt.Inputs.PolicySecurityPolicyRuleArgs
            {
                DisplayName = "Allow SSH",
                Description = "In going rule",
                Action = "ALLOW",
                Logged = false,
                IpVersion = "IPV4",
                DestinationGroups = new[]
                {
                    webGroup.Path,
                },
                Services = new[]
                {
                    ssh.Apply(getPolicyServiceResult => getPolicyServiceResult.Path),
                },
            },
            new Nsxt.Inputs.PolicySecurityPolicyRuleArgs
            {
                DisplayName = "Allow Web to App",
                Description = "Web to App communication",
                Action = "ALLOW",
                Logged = false,
                IpVersion = "IPV4",
                SourceGroups = new[]
                {
                    webGroup.Path,
                },
                DestinationGroups = new[]
                {
                    appGroup.Path,
                },
                Services = new[]
                {
                    appService.Path,
                },
            },
            new Nsxt.Inputs.PolicySecurityPolicyRuleArgs
            {
                DisplayName = "Allow App to DB",
                Description = "App to DB communication",
                Action = "ALLOW",
                Logged = false,
                IpVersion = "IPV4",
                SourceGroups = new[]
                {
                    appGroup.Path,
                },
                DestinationGroups = new[]
                {
                    dbGroup.Path,
                },
                Services = new[]
                {
                    mysql.Apply(getPolicyServiceResult => getPolicyServiceResult.Path),
                },
            },
            new Nsxt.Inputs.PolicySecurityPolicyRuleArgs
            {
                DisplayName = "Allow Infrastructure",
                Description = "Allow DNS and Management servers",
                Action = "ALLOW",
                Logged = true,
                IpVersion = "IPV4",
                SourceGroups = new[]
                {
                    ipSet.Path,
                },
                DestinationGroups = new[]
                {
                    allVms.Path,
                },
            },
            new Nsxt.Inputs.PolicySecurityPolicyRuleArgs
            {
                DisplayName = "Allow out",
                Description = "Outgoing rule",
                Action = "ALLOW",
                Logged = true,
                IpVersion = "IPV4",
                SourceGroups = new[]
                {
                    allVms.Path,
                },
            },
            new Nsxt.Inputs.PolicySecurityPolicyRuleArgs
            {
                DisplayName = "Deny ANY",
                Description = "Default Deny the traffic",
                Action = "REJECT",
                Logged = true,
                IpVersion = "IPV4",
            },
        },
    });

    //
    // Here we have examples for creating NAT rules. The example here assumes
    // the Web IP addresses are reachable from outside and no NAT is required.
    //
    var rule1 = new Nsxt.PolicyNatRule("rule1", new()
    {
        DisplayName = "App 1-to-1 In",
        Action = "SNAT",
        TranslatedNetworks = new[]
        {
            "102.10.22.1",
        },
        SourceNetworks = new[]
        {
            "12.12.2.0/24",
        },
        GatewayPath = t1Gateway.Path,
        Tags = new[]
        {
            new Nsxt.Inputs.PolicyNatRuleTagArgs
            {
                Scope = nsxTagScope,
                Tag = nsxTag,
            },
        },
    });

    var rule2 = new Nsxt.PolicyNatRule("rule2", new()
    {
        DisplayName = "App 1-to-1 Out",
        Action = "DNAT",
        TranslatedNetworks = new[]
        {
            "102.10.22.2",
        },
        DestinationNetworks = new[]
        {
            "102.10.22.1/32",
        },
        SourceNetworks = new[]
        {
            "12.12.2.0/24",
        },
        GatewayPath = t1Gateway.Path,
        Tags = new[]
        {
            new Nsxt.Inputs.PolicyNatRuleTagArgs
            {
                Scope = nsxTagScope,
                Tag = nsxTag,
            },
        },
    });

    var rule3 = new Nsxt.PolicyNatRule("rule3", new()
    {
        DisplayName = "DB 1-to-1 In",
        Action = "SNAT",
        TranslatedNetworks = new[]
        {
            "102.10.23.1",
        },
        SourceNetworks = new[]
        {
            "12.12.3.0/24",
        },
        GatewayPath = t1Gateway.Path,
        Tags = new[]
        {
            new Nsxt.Inputs.PolicyNatRuleTagArgs
            {
                Scope = nsxTagScope,
                Tag = nsxTag,
            },
        },
    });

    var rule4 = new Nsxt.PolicyNatRule("rule4", new()
    {
        DisplayName = "App 1-to-1 Out",
        Action = "DNAT",
        TranslatedNetworks = new[]
        {
            "102.10.23.3",
        },
        DestinationNetworks = new[]
        {
            "102.10.23.1/32",
        },
        SourceNetworks = new[]
        {
            "12.12.3.0/24",
        },
        GatewayPath = t1Gateway.Path,
        Tags = new[]
        {
            new Nsxt.Inputs.PolicyNatRuleTagArgs
            {
                Scope = nsxTagScope,
                Tag = nsxTag,
            },
        },
    });

    // The 3 VMs available in the NSX Inventory
    var webVm = Nsxt.GetPolicyVm.Invoke(new()
    {
        DisplayName = "web-vm",
    });

    var appVm = Nsxt.GetPolicyVm.Invoke(new()
    {
        DisplayName = "app-vm",
    });

    var dbVm = Nsxt.GetPolicyVm.Invoke(new()
    {
        DisplayName = "db-vm",
    });

    // Assign the right tags to the VMs so that they get included in the
    // dynamic groups created above
    var webVmTag = new Nsxt.PolicyVmTags("web_vm_tag", new()
    {
        InstanceId = webVm.Apply(getPolicyVmResult => getPolicyVmResult.InstanceId),
        Tags = new[]
        {
            new Nsxt.Inputs.PolicyVmTagsTagArgs
            {
                Scope = "tier",
                Tag = "web",
            },
            new Nsxt.Inputs.PolicyVmTagsTagArgs
            {
                Scope = nsxTagScope,
                Tag = nsxTag,
            },
        },
    });

    var appVmTag = new Nsxt.PolicyVmTags("app_vm_tag", new()
    {
        InstanceId = appVm.Apply(getPolicyVmResult => getPolicyVmResult.InstanceId),
        Tags = new[]
        {
            new Nsxt.Inputs.PolicyVmTagsTagArgs
            {
                Scope = "tier",
                Tag = "app",
            },
            new Nsxt.Inputs.PolicyVmTagsTagArgs
            {
                Scope = nsxTagScope,
                Tag = nsxTag,
            },
        },
    });

    var dbVmTag = new Nsxt.PolicyVmTags("db_vm_tag", new()
    {
        InstanceId = dbVm.Apply(getPolicyVmResult => getPolicyVmResult.InstanceId),
        Tags = new[]
        {
            new Nsxt.Inputs.PolicyVmTagsTagArgs
            {
                Scope = "tier",
                Tag = "db",
            },
            new Nsxt.Inputs.PolicyVmTagsTagArgs
            {
                Scope = nsxTagScope,
                Tag = nsxTag,
            },
        },
    });

});