AccessLevel

An AccessLevel is a label that can be applied to requests to GCP services, along with a list of requirements necessary for the label to be applied.

To get more information about AccessLevel, see:

API documentation
How-to Guides
- Access Policy Quickstart

Create a AccessLevel Resource

new AccessLevel(name: string, args: AccessLevelArgs, opts?: CustomResourceOptions);

def AccessLevel(resource_name, opts=None, basic=None, custom=None, description=None, name=None, parent=None, title=None, __props__=None);

func NewAccessLevel(ctx *Context, name string, args AccessLevelArgs, opts ...ResourceOption) (*AccessLevel, error)

public AccessLevel(string name, AccessLevelArgs args, CustomResourceOptions? opts = null)

name string: The unique name of the resource.
args AccessLevelArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
opts ResourceOptions: A bag of options that control this resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args AccessLevelArgs: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args AccessLevelArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

AccessLevel Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Programming Model docs.

Inputs

The AccessLevel resource accepts the following input properties:

Parent string: The AccessPolicy this AccessLevel lives in. Format: accessPolicies/{policy_id}
Title string: Title for the expression, i.e. a short string describing its purpose.
Basic AccessLevelBasicArgs: A set of predefined conditions for the access level and a combining function. Structure is documented below.
Custom AccessLevelCustomArgs: Custom access level conditions are set using the Cloud Common Expression Language to represent the necessary conditions for the level to apply to a request. See CEL spec at: https://github.com/google/cel-spec. Structure is documented below.
Description string: Description of the expression
Name string: Resource name for the Access Level. The shortname component must begin with a letter and only include alphanumeric and ‘’. Format: accessPolicies/{policy_id}/accessLevels/{short_name}

Parent string: The AccessPolicy this AccessLevel lives in. Format: accessPolicies/{policy_id}
Title string: Title for the expression, i.e. a short string describing its purpose.
Basic AccessLevelBasic: A set of predefined conditions for the access level and a combining function. Structure is documented below.
Custom AccessLevelCustom: Custom access level conditions are set using the Cloud Common Expression Language to represent the necessary conditions for the level to apply to a request. See CEL spec at: https://github.com/google/cel-spec. Structure is documented below.
Description string: Description of the expression
Name string: Resource name for the Access Level. The shortname component must begin with a letter and only include alphanumeric and ‘’. Format: accessPolicies/{policy_id}/accessLevels/{short_name}

parent string: The AccessPolicy this AccessLevel lives in. Format: accessPolicies/{policy_id}
title string: Title for the expression, i.e. a short string describing its purpose.
basic AccessLevelBasic: A set of predefined conditions for the access level and a combining function. Structure is documented below.
custom AccessLevelCustom: Custom access level conditions are set using the Cloud Common Expression Language to represent the necessary conditions for the level to apply to a request. See CEL spec at: https://github.com/google/cel-spec. Structure is documented below.
description string: Description of the expression
name string: Resource name for the Access Level. The shortname component must begin with a letter and only include alphanumeric and ‘’. Format: accessPolicies/{policy_id}/accessLevels/{short_name}

parent str: The AccessPolicy this AccessLevel lives in. Format: accessPolicies/{policy_id}
title str: Title for the expression, i.e. a short string describing its purpose.
basic Dict[AccessLevelBasic]: A set of predefined conditions for the access level and a combining function. Structure is documented below.
custom Dict[AccessLevelCustom]: Custom access level conditions are set using the Cloud Common Expression Language to represent the necessary conditions for the level to apply to a request. See CEL spec at: https://github.com/google/cel-spec. Structure is documented below.
description str: Description of the expression
name str: Resource name for the Access Level. The shortname component must begin with a letter and only include alphanumeric and ‘’. Format: accessPolicies/{policy_id}/accessLevels/{short_name}

Outputs

All input properties are implicitly available as output properties. Additionally, the AccessLevel resource produces the following output properties:

Id string: The provider-assigned unique ID for this managed resource.

Id string: The provider-assigned unique ID for this managed resource.

id string: The provider-assigned unique ID for this managed resource.

id str: The provider-assigned unique ID for this managed resource.

Look up an Existing AccessLevel Resource

Get an existing AccessLevel resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: AccessLevelState, opts?: CustomResourceOptions): AccessLevel

static get(resource_name, id, opts=None, basic=None, custom=None, description=None, name=None, parent=None, title=None, __props__=None);

func GetAccessLevel(ctx *Context, name string, id IDInput, state *AccessLevelState, opts ...ResourceOption) (*AccessLevel, error)

public static AccessLevel Get(string name, Input<string> id, AccessLevelState? state, CustomResourceOptions? opts = null)

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

resource_name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

The following state arguments are supported:

Basic AccessLevelBasicArgs: A set of predefined conditions for the access level and a combining function. Structure is documented below.
Custom AccessLevelCustomArgs: Custom access level conditions are set using the Cloud Common Expression Language to represent the necessary conditions for the level to apply to a request. See CEL spec at: https://github.com/google/cel-spec. Structure is documented below.
Description string: Description of the expression
Name string: Resource name for the Access Level. The shortname component must begin with a letter and only include alphanumeric and ‘’. Format: accessPolicies/{policy_id}/accessLevels/{short_name}
Parent string: The AccessPolicy this AccessLevel lives in. Format: accessPolicies/{policy_id}
Title string: Title for the expression, i.e. a short string describing its purpose.

Basic AccessLevelBasic: A set of predefined conditions for the access level and a combining function. Structure is documented below.
Custom AccessLevelCustom: Custom access level conditions are set using the Cloud Common Expression Language to represent the necessary conditions for the level to apply to a request. See CEL spec at: https://github.com/google/cel-spec. Structure is documented below.
Description string: Description of the expression
Name string: Resource name for the Access Level. The shortname component must begin with a letter and only include alphanumeric and ‘’. Format: accessPolicies/{policy_id}/accessLevels/{short_name}
Parent string: The AccessPolicy this AccessLevel lives in. Format: accessPolicies/{policy_id}
Title string: Title for the expression, i.e. a short string describing its purpose.

basic AccessLevelBasic: A set of predefined conditions for the access level and a combining function. Structure is documented below.
custom AccessLevelCustom: Custom access level conditions are set using the Cloud Common Expression Language to represent the necessary conditions for the level to apply to a request. See CEL spec at: https://github.com/google/cel-spec. Structure is documented below.
description string: Description of the expression
name string: Resource name for the Access Level. The shortname component must begin with a letter and only include alphanumeric and ‘’. Format: accessPolicies/{policy_id}/accessLevels/{short_name}
parent string: The AccessPolicy this AccessLevel lives in. Format: accessPolicies/{policy_id}
title string: Title for the expression, i.e. a short string describing its purpose.

basic Dict[AccessLevelBasic]: A set of predefined conditions for the access level and a combining function. Structure is documented below.
custom Dict[AccessLevelCustom]: Custom access level conditions are set using the Cloud Common Expression Language to represent the necessary conditions for the level to apply to a request. See CEL spec at: https://github.com/google/cel-spec. Structure is documented below.
description str: Description of the expression
name str: Resource name for the Access Level. The shortname component must begin with a letter and only include alphanumeric and ‘’. Format: accessPolicies/{policy_id}/accessLevels/{short_name}
parent str: The AccessPolicy this AccessLevel lives in. Format: accessPolicies/{policy_id}
title str: Title for the expression, i.e. a short string describing its purpose.

Supporting Types

AccessLevelBasic

See the input and output API doc for this type.

Conditions List<AccessLevelBasicConditionArgs>: A set of requirements for the AccessLevel to be granted. Structure is documented below.
CombiningFunction string: How the conditions list should be combined to determine if a request is granted this AccessLevel. If AND is used, each Condition in conditions must be satisfied for the AccessLevel to be applied. If OR is used, at least one Condition in conditions must be satisfied for the AccessLevel to be applied.

Conditions []AccessLevelBasicCondition: A set of requirements for the AccessLevel to be granted. Structure is documented below.
CombiningFunction string: How the conditions list should be combined to determine if a request is granted this AccessLevel. If AND is used, each Condition in conditions must be satisfied for the AccessLevel to be applied. If OR is used, at least one Condition in conditions must be satisfied for the AccessLevel to be applied.

conditions AccessLevelBasicCondition[]: A set of requirements for the AccessLevel to be granted. Structure is documented below.
combiningFunction string: How the conditions list should be combined to determine if a request is granted this AccessLevel. If AND is used, each Condition in conditions must be satisfied for the AccessLevel to be applied. If OR is used, at least one Condition in conditions must be satisfied for the AccessLevel to be applied.

conditions List[AccessLevelBasicCondition]: A set of requirements for the AccessLevel to be granted. Structure is documented below.
combiningFunction str: How the conditions list should be combined to determine if a request is granted this AccessLevel. If AND is used, each Condition in conditions must be satisfied for the AccessLevel to be applied. If OR is used, at least one Condition in conditions must be satisfied for the AccessLevel to be applied.

AccessLevelBasicCondition

See the input and output API doc for this type.

DevicePolicy AccessLevelBasicConditionDevicePolicyArgs: Device specific restrictions, all restrictions must hold for the Condition to be true. If not specified, all devices are allowed. Structure is documented below.
IpSubnetworks List<string>: A list of CIDR block IP subnetwork specification. May be IPv4 or IPv6. Note that for a CIDR IP address block, the specified IP address portion must be properly truncated (i.e. all the host bits must be zero) or the input is considered malformed. For example, “192.0.2.0/24” is accepted but “192.0.2.1/24” is not. Similarly, for IPv6, “2001:db8::/32” is accepted whereas “2001:db8::1/32” is not. The originating IP of a request must be in one of the listed subnets in order for this Condition to be true. If empty, all IP addresses are allowed.
Members List<string>: An allowed list of members (users, service accounts). Using groups is not supported yet. The signed-in user originating the request must be a part of one of the provided members. If not specified, a request may come from any user (logged in/not logged in, not present in any groups, etc.). Formats: user:{emailid}, serviceAccount:{emailid}
Negate bool: Whether to negate the Condition. If true, the Condition becomes a NAND over its non-empty fields, each field must be false for the Condition overall to be satisfied. Defaults to false.
Regions List<string>: The request must originate from one of the provided countries/regions. Format: A valid ISO 3166-1 alpha-2 code.
RequiredAccessLevels List<string>: A list of other access levels defined in the same Policy, referenced by resource name. Referencing an AccessLevel which does not exist is an error. All access levels listed must be granted for the Condition to be true. Format: accessPolicies/{policy_id}/accessLevels/{short_name}

DevicePolicy AccessLevelBasicConditionDevicePolicy: Device specific restrictions, all restrictions must hold for the Condition to be true. If not specified, all devices are allowed. Structure is documented below.
IpSubnetworks []string: A list of CIDR block IP subnetwork specification. May be IPv4 or IPv6. Note that for a CIDR IP address block, the specified IP address portion must be properly truncated (i.e. all the host bits must be zero) or the input is considered malformed. For example, “192.0.2.0/24” is accepted but “192.0.2.1/24” is not. Similarly, for IPv6, “2001:db8::/32” is accepted whereas “2001:db8::1/32” is not. The originating IP of a request must be in one of the listed subnets in order for this Condition to be true. If empty, all IP addresses are allowed.
Members []string: An allowed list of members (users, service accounts). Using groups is not supported yet. The signed-in user originating the request must be a part of one of the provided members. If not specified, a request may come from any user (logged in/not logged in, not present in any groups, etc.). Formats: user:{emailid}, serviceAccount:{emailid}
Negate bool: Whether to negate the Condition. If true, the Condition becomes a NAND over its non-empty fields, each field must be false for the Condition overall to be satisfied. Defaults to false.
Regions []string: The request must originate from one of the provided countries/regions. Format: A valid ISO 3166-1 alpha-2 code.
RequiredAccessLevels []string: A list of other access levels defined in the same Policy, referenced by resource name. Referencing an AccessLevel which does not exist is an error. All access levels listed must be granted for the Condition to be true. Format: accessPolicies/{policy_id}/accessLevels/{short_name}

devicePolicy AccessLevelBasicConditionDevicePolicy: Device specific restrictions, all restrictions must hold for the Condition to be true. If not specified, all devices are allowed. Structure is documented below.
ipSubnetworks string[]: A list of CIDR block IP subnetwork specification. May be IPv4 or IPv6. Note that for a CIDR IP address block, the specified IP address portion must be properly truncated (i.e. all the host bits must be zero) or the input is considered malformed. For example, “192.0.2.0/24” is accepted but “192.0.2.1/24” is not. Similarly, for IPv6, “2001:db8::/32” is accepted whereas “2001:db8::1/32” is not. The originating IP of a request must be in one of the listed subnets in order for this Condition to be true. If empty, all IP addresses are allowed.
members string[]: An allowed list of members (users, service accounts). Using groups is not supported yet. The signed-in user originating the request must be a part of one of the provided members. If not specified, a request may come from any user (logged in/not logged in, not present in any groups, etc.). Formats: user:{emailid}, serviceAccount:{emailid}
negate boolean: Whether to negate the Condition. If true, the Condition becomes a NAND over its non-empty fields, each field must be false for the Condition overall to be satisfied. Defaults to false.
regions string[]: The request must originate from one of the provided countries/regions. Format: A valid ISO 3166-1 alpha-2 code.
requiredAccessLevels string[]: A list of other access levels defined in the same Policy, referenced by resource name. Referencing an AccessLevel which does not exist is an error. All access levels listed must be granted for the Condition to be true. Format: accessPolicies/{policy_id}/accessLevels/{short_name}

devicePolicy Dict[AccessLevelBasicConditionDevicePolicy]: Device specific restrictions, all restrictions must hold for the Condition to be true. If not specified, all devices are allowed. Structure is documented below.
ipSubnetworks List[str]: A list of CIDR block IP subnetwork specification. May be IPv4 or IPv6. Note that for a CIDR IP address block, the specified IP address portion must be properly truncated (i.e. all the host bits must be zero) or the input is considered malformed. For example, “192.0.2.0/24” is accepted but “192.0.2.1/24” is not. Similarly, for IPv6, “2001:db8::/32” is accepted whereas “2001:db8::1/32” is not. The originating IP of a request must be in one of the listed subnets in order for this Condition to be true. If empty, all IP addresses are allowed.
members List[str]: An allowed list of members (users, service accounts). Using groups is not supported yet. The signed-in user originating the request must be a part of one of the provided members. If not specified, a request may come from any user (logged in/not logged in, not present in any groups, etc.). Formats: user:{emailid}, serviceAccount:{emailid}
negate bool: Whether to negate the Condition. If true, the Condition becomes a NAND over its non-empty fields, each field must be false for the Condition overall to be satisfied. Defaults to false.
regions List[str]: The request must originate from one of the provided countries/regions. Format: A valid ISO 3166-1 alpha-2 code.
requiredAccessLevels List[str]: A list of other access levels defined in the same Policy, referenced by resource name. Referencing an AccessLevel which does not exist is an error. All access levels listed must be granted for the Condition to be true. Format: accessPolicies/{policy_id}/accessLevels/{short_name}

AccessLevelBasicConditionDevicePolicy

See the input and output API doc for this type.

AllowedDeviceManagementLevels List<string>: A list of allowed device management levels. An empty list allows all management levels.
AllowedEncryptionStatuses List<string>: A list of allowed encryptions statuses. An empty list allows all statuses.
OsConstraints List<AccessLevelBasicConditionDevicePolicyOsConstraintArgs>: A list of allowed OS versions. An empty list allows all types and all versions. Structure is documented below.
RequireAdminApproval bool: Whether the device needs to be approved by the customer admin.
RequireCorpOwned bool: Whether the device needs to be corp owned.
RequireScreenLock bool: Whether or not screenlock is required for the DevicePolicy to be true. Defaults to false.

AllowedDeviceManagementLevels []string: A list of allowed device management levels. An empty list allows all management levels.
AllowedEncryptionStatuses []string: A list of allowed encryptions statuses. An empty list allows all statuses.
OsConstraints []AccessLevelBasicConditionDevicePolicyOsConstraint: A list of allowed OS versions. An empty list allows all types and all versions. Structure is documented below.
RequireAdminApproval bool: Whether the device needs to be approved by the customer admin.
RequireCorpOwned bool: Whether the device needs to be corp owned.
RequireScreenLock bool: Whether or not screenlock is required for the DevicePolicy to be true. Defaults to false.

allowedDeviceManagementLevels string[]: A list of allowed device management levels. An empty list allows all management levels.
allowedEncryptionStatuses string[]: A list of allowed encryptions statuses. An empty list allows all statuses.
osConstraints AccessLevelBasicConditionDevicePolicyOsConstraint[]: A list of allowed OS versions. An empty list allows all types and all versions. Structure is documented below.
requireAdminApproval boolean: Whether the device needs to be approved by the customer admin.
requireCorpOwned boolean: Whether the device needs to be corp owned.
requireScreenLock boolean: Whether or not screenlock is required for the DevicePolicy to be true. Defaults to false.

allowedDeviceManagementLevels List[str]: A list of allowed device management levels. An empty list allows all management levels.
allowedEncryptionStatuses List[str]: A list of allowed encryptions statuses. An empty list allows all statuses.
osConstraints List[AccessLevelBasicConditionDevicePolicyOsConstraint]: A list of allowed OS versions. An empty list allows all types and all versions. Structure is documented below.
requireAdminApproval bool: Whether the device needs to be approved by the customer admin.
requireCorpOwned bool: Whether the device needs to be corp owned.
requireScreenLock bool: Whether or not screenlock is required for the DevicePolicy to be true. Defaults to false.

AccessLevelBasicConditionDevicePolicyOsConstraint

See the input and output API doc for this type.

OsType string: The operating system type of the device.
MinimumVersion string: The minimum allowed OS version. If not set, any version of this OS satisfies the constraint. Format: “major.minor.patch” such as “10.5.301”, “9.2.1”.

OsType string: The operating system type of the device.
MinimumVersion string: The minimum allowed OS version. If not set, any version of this OS satisfies the constraint. Format: “major.minor.patch” such as “10.5.301”, “9.2.1”.

osType string: The operating system type of the device.
minimumVersion string: The minimum allowed OS version. If not set, any version of this OS satisfies the constraint. Format: “major.minor.patch” such as “10.5.301”, “9.2.1”.

osType str: The operating system type of the device.
minimumVersion str: The minimum allowed OS version. If not set, any version of this OS satisfies the constraint. Format: “major.minor.patch” such as “10.5.301”, “9.2.1”.

AccessLevelCustom

See the input and output API doc for this type.

Expr AccessLevelCustomExprArgs: Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. This page details the objects and attributes that are used to the build the CEL expressions for custom access levels - https://cloud.google.com/access-context-manager/docs/custom-access-level-spec. Structure is documented below.

Expr AccessLevelCustomExpr: Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. This page details the objects and attributes that are used to the build the CEL expressions for custom access levels - https://cloud.google.com/access-context-manager/docs/custom-access-level-spec. Structure is documented below.

expr AccessLevelCustomExpr: Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. This page details the objects and attributes that are used to the build the CEL expressions for custom access levels - https://cloud.google.com/access-context-manager/docs/custom-access-level-spec. Structure is documented below.

expr Dict[AccessLevelCustomExpr]: Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. This page details the objects and attributes that are used to the build the CEL expressions for custom access levels - https://cloud.google.com/access-context-manager/docs/custom-access-level-spec. Structure is documented below.

AccessLevelCustomExpr

See the input and output API doc for this type.

Expression string: Textual representation of an expression in Common Expression Language syntax.
Description string: Description of the expression
Location string: String indicating the location of the expression for error reporting, e.g. a file name and a position in the file
Title string: Title for the expression, i.e. a short string describing its purpose.

Expression string: Textual representation of an expression in Common Expression Language syntax.
Description string: Description of the expression
Location string: String indicating the location of the expression for error reporting, e.g. a file name and a position in the file
Title string: Title for the expression, i.e. a short string describing its purpose.

expression string: Textual representation of an expression in Common Expression Language syntax.
description string: Description of the expression
location string: String indicating the location of the expression for error reporting, e.g. a file name and a position in the file
title string: Title for the expression, i.e. a short string describing its purpose.

expression str: Textual representation of an expression in Common Expression Language syntax.
description str: Description of the expression
location str: String indicating the location of the expression for error reporting, e.g. a file name and a position in the file
title str: Title for the expression, i.e. a short string describing its purpose.

Package Details

Repository: https://github.com/pulumi/pulumi-gcp
License: Apache-2.0
Notes: This Pulumi package is based on the google-beta Terraform Provider.

The Pulumi Platform

Get Started

Migrate to Pulumi

Solutions for All Teams and Engineers

Any Code

Any Cloud

AccessLevel

Create a AccessLevel Resource

AccessLevel Resource Properties

Inputs

Outputs

Look up an Existing AccessLevel Resource

Supporting Types

AccessLevelBasic

AccessLevelBasicCondition

AccessLevelBasicConditionDevicePolicy

AccessLevelBasicConditionDevicePolicyOsConstraint

AccessLevelCustom

AccessLevelCustomExpr

Package Details

On This Page