Module accesscontextmanager

This page documents the language specification for the gcp package. If you're looking for help working with the inputs, outputs, or functions of gcp resources in a Pulumi program, please see the resource documentation for examples and API reference.

Resources

AccessLevel
AccessPolicy
ServicePerimeter
ServicePerimeterResource

Resources

Resource AccessLevel

class AccessLevel extends CustomResource

An AccessLevel is a label that can be applied to requests to GCP services, along with a list of requirements necessary for the label to be applied.

To get more information about AccessLevel, see:

API documentation
How-to Guides
- Access Policy Quickstart

Example Usage - Access Context Manager Access Level Basic

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const accessPolicy = new gcp.accesscontextmanager.AccessPolicy("access-policy", {
    parent: "organizations/123456789",
    title: "my policy",
});
const accessLevel = new gcp.accesscontextmanager.AccessLevel("access-level", {
    basic: {
        conditions: [{
            devicePolicy: {
                osConstraints: [{
                    osType: "DESKTOP_CHROME_OS",
                }],
                requireScreenLock: true,
            },
            regions: [
                "CH",
                "IT",
                "US",
            ],
        }],
    },
    parent: pulumi.interpolate`accessPolicies/${access_policy.name}`,
    title: "chromeosNoLock",
});

constructor

new AccessLevel(name: string, args: AccessLevelArgs, opts?: pulumi.CustomResourceOptions)

Create a AccessLevel resource with the given unique name, arguments, and options.

name The unique name of the resource.
args The arguments to use to populate this resource's properties.
opts A bag of options that control this resource's behavior.

method get

public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: AccessLevelState, opts?: pulumi.CustomResourceOptions): AccessLevel

Get an existing AccessLevel resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

method getProvider

getProvider(moduleMember: string): ProviderResource | undefined

method isInstance

public static isInstance(obj: any): obj is AccessLevel

Returns true if the given object is an instance of AccessLevel. This is designed to work even when multiple copies of the Pulumi SDK have been loaded into the same process.

property basic

public basic: pulumi.Output<AccessLevelBasic | undefined>;

A set of predefined conditions for the access level and a combining function. Structure is documented below.

property description

public description: pulumi.Output<string | undefined>;

Description of the AccessLevel and its use. Does not affect behavior.

property id

id: Output<ID>;

id is the provider-assigned unique ID for this managed resource. It is set during deployments and may be missing (undefined) during planning phases.

property name

public name: pulumi.Output<string>;

Resource name for the Access Level. The shortName component must begin with a letter and only include alphanumeric and ‘_‘. Format: accessPolicies/{policy_id}/accessLevels/{short_name}

property parent

public parent: pulumi.Output<string>;

The AccessPolicy this AccessLevel lives in. Format: accessPolicies/{policy_id}

property title

public title: pulumi.Output<string>;

Human readable title. Must be unique within the Policy.

property urn

urn: Output<URN>;

urn is the stable logical URN used to distinctly address a resource, both before and after deployments.

Resource AccessPolicy

class AccessPolicy extends CustomResource

AccessPolicy is a container for AccessLevels (which define the necessary attributes to use GCP services) and ServicePerimeters (which define regions of services able to freely pass data within a perimeter). An access policy is globally visible within an organization, and the restrictions it specifies apply to all projects within an organization.

To get more information about AccessPolicy, see:

API documentation
How-to Guides
- Access Policy Quickstart

Example Usage - Access Context Manager Access Policy Basic

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const accessPolicy = new gcp.accesscontextmanager.AccessPolicy("access-policy", {
    parent: "organizations/123456789",
    title: "my policy",
});

constructor

new AccessPolicy(name: string, args: AccessPolicyArgs, opts?: pulumi.CustomResourceOptions)

Create a AccessPolicy resource with the given unique name, arguments, and options.

name The unique name of the resource.
args The arguments to use to populate this resource's properties.
opts A bag of options that control this resource's behavior.

method get

public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: AccessPolicyState, opts?: pulumi.CustomResourceOptions): AccessPolicy

Get an existing AccessPolicy resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

method getProvider

getProvider(moduleMember: string): ProviderResource | undefined

method isInstance

public static isInstance(obj: any): obj is AccessPolicy

Returns true if the given object is an instance of AccessPolicy. This is designed to work even when multiple copies of the Pulumi SDK have been loaded into the same process.

property createTime

public createTime: pulumi.Output<string>;

Time the AccessPolicy was created in UTC.

property id

id: Output<ID>;

id is the provider-assigned unique ID for this managed resource. It is set during deployments and may be missing (undefined) during planning phases.

property name

public name: pulumi.Output<string>;

Resource name of the AccessPolicy. Format: {policy_id}

property parent

public parent: pulumi.Output<string>;

The parent of this AccessPolicy in the Cloud Resource Hierarchy. Format: organizations/{organization_id}

property title

public title: pulumi.Output<string>;

Human readable title. Does not affect behavior.

property updateTime

public updateTime: pulumi.Output<string>;

Time the AccessPolicy was updated in UTC.

property urn

urn: Output<URN>;

urn is the stable logical URN used to distinctly address a resource, both before and after deployments.

Resource ServicePerimeter

class ServicePerimeter extends CustomResource

ServicePerimeter describes a set of GCP resources which can freely import and export data amongst themselves, but not export outside of the ServicePerimeter. If a request with a source within this ServicePerimeter has a target outside of the ServicePerimeter, the request will be blocked. Otherwise the request is allowed. There are two types of Service Perimeter - Regular and Bridge. Regular Service Perimeters cannot overlap, a single GCP project can only belong to a single regular Service Perimeter. Service Perimeter Bridges can contain only GCP projects as members, a single GCP project may belong to multiple Service Perimeter Bridges.

To get more information about ServicePerimeter, see:

API documentation
How-to Guides
- Service Perimeter Quickstart

Example Usage - Access Context Manager Service Perimeter Basic

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const accessPolicy = new gcp.accesscontextmanager.AccessPolicy("access-policy", {
    parent: "organizations/123456789",
    title: "my policy",
});
const servicePerimeter = new gcp.accesscontextmanager.ServicePerimeter("service-perimeter", {
    parent: pulumi.interpolate`accessPolicies/${access_policy.name}`,
    status: {
        restrictedServices: ["storage.googleapis.com"],
    },
    title: "restrictStorage",
});
const accessLevel = new gcp.accesscontextmanager.AccessLevel("access-level", {
    basic: {
        conditions: [{
            devicePolicy: {
                osConstraints: [{
                    osType: "DESKTOP_CHROME_OS",
                }],
                requireScreenLock: false,
            },
            regions: [
                "CH",
                "IT",
                "US",
            ],
        }],
    },
    parent: pulumi.interpolate`accessPolicies/${access_policy.name}`,
    title: "chromeosNoLock",
});

Example Usage - Access Context Manager Service Perimeter Dry Run

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const accessPolicy = new gcp.accesscontextmanager.AccessPolicy("access-policy", {
    parent: "organizations/123456789",
    title: "my policy",
});
const servicePerimeter = new gcp.accesscontextmanager.ServicePerimeter("service-perimeter", {
    parent: pulumi.interpolate`accessPolicies/${access_policy.name}`,
    // Service 'storage.googleapis.com' will be in dry-run mode.
    spec: {
        restrictedServices: ["storage.googleapis.com"],
    },
    // Service 'bigquery.googleapis.com' will be restricted.
    status: {
        restrictedServices: ["bigquery.googleapis.com"],
    },
    title: "restrictBigqueryDryrunStorage",
    useExplicitDryRunSpec: true,
});

constructor

new ServicePerimeter(name: string, args: ServicePerimeterArgs, opts?: pulumi.CustomResourceOptions)

Create a ServicePerimeter resource with the given unique name, arguments, and options.

name The unique name of the resource.
args The arguments to use to populate this resource's properties.
opts A bag of options that control this resource's behavior.

method get

public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: ServicePerimeterState, opts?: pulumi.CustomResourceOptions): ServicePerimeter

Get an existing ServicePerimeter resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

method getProvider

getProvider(moduleMember: string): ProviderResource | undefined

method isInstance

public static isInstance(obj: any): obj is ServicePerimeter

Returns true if the given object is an instance of ServicePerimeter. This is designed to work even when multiple copies of the Pulumi SDK have been loaded into the same process.

property createTime

public createTime: pulumi.Output<string>;

Time the AccessPolicy was created in UTC.

property description

public description: pulumi.Output<string | undefined>;

Description of the ServicePerimeter and its use. Does not affect behavior.

property id

id: Output<ID>;

id is the provider-assigned unique ID for this managed resource. It is set during deployments and may be missing (undefined) during planning phases.

property name

public name: pulumi.Output<string>;

Resource name for the ServicePerimeter. The shortName component must begin with a letter and only include alphanumeric and ‘_‘. Format: accessPolicies/{policy_id}/servicePerimeters/{short_name}

property parent

public parent: pulumi.Output<string>;

The AccessPolicy this ServicePerimeter lives in. Format: accessPolicies/{policy_id}

property perimeterType

public perimeterType: pulumi.Output<string | undefined>;

Specifies the type of the Perimeter. There are two types: regular and bridge. Regular Service Perimeter contains resources, access levels, and restricted services. Every resource can be in at most ONE regular Service Perimeter. In addition to being in a regular service perimeter, a resource can also be in zero or more perimeter bridges. A perimeter bridge only contains resources. Cross project operations are permitted if all effected resources share some perimeter (whether bridge or regular). Perimeter Bridge does not contain access levels or services: those are governed entirely by the regular perimeter that resource is in. Perimeter Bridges are typically useful when building more complex topologies with many independent perimeters that need to share some data with a common perimeter, but should not be able to share data among themselves.

property spec

public spec: pulumi.Output<ServicePerimeterSpec | undefined>;

Proposed (or dry run) ServicePerimeter configuration. This configuration allows to specify and test ServicePerimeter configuration without enforcing actual access restrictions. Only allowed to be set when the useExplicitDryRunSpec flag is set. Structure is documented below.

property status

public status: pulumi.Output<ServicePerimeterStatus | undefined>;

ServicePerimeter configuration. Specifies sets of resources, restricted services and access levels that determine perimeter content and boundaries. Structure is documented below.

property title

public title: pulumi.Output<string>;

Human readable title. Must be unique within the Policy.

property updateTime

public updateTime: pulumi.Output<string>;

Time the AccessPolicy was updated in UTC.

property urn

urn: Output<URN>;

urn is the stable logical URN used to distinctly address a resource, both before and after deployments.

property useExplicitDryRunSpec

public useExplicitDryRunSpec: pulumi.Output<boolean | undefined>;

Use explicit dry run spec flag. Ordinarily, a dry-run spec implicitly exists for all Service Perimeters, and that spec is identical to the status for those Service Perimeters. When this flag is set, it inhibits the generation of the implicit spec, thereby allowing the user to explicitly provide a configuration (“spec”) to use in a dry-run version of the Service Perimeter. This allows the user to test changes to the enforced config (“status”) without actually enforcing them. This testing is done through analyzing the differences between currently enforced and suggested restrictions. useExplicitDryRunSpec must bet set to True if any of the fields in the spec are set to non-default values.

Resource ServicePerimeterResource

class ServicePerimeterResource extends CustomResource

Allows configuring a single GCP resource that should be inside of a service perimeter. This resource is intended to be used in cases where it is not possible to compile a full list of projects to include in a gcp.accesscontextmanager.ServicePerimeter resource, to enable them to be added separately.

Note: If this resource is used alongside a gcp.accesscontextmanager.ServicePerimeter resource, the service perimeter resource must have a lifecycle block with ignoreChanges = [status[0].resources] so they don’t fight over which resources should be in the policy.

To get more information about ServicePerimeterResource, see:

API documentation
How-to Guides
- Service Perimeter Quickstart

Example Usage - Access Context Manager Service Perimeter Resource Basic

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const accessPolicy = new gcp.accesscontextmanager.AccessPolicy("access-policy", {
    parent: "organizations/123456789",
    title: "my policy",
});
const service_perimeter_resourceServicePerimeter = new gcp.accesscontextmanager.ServicePerimeter("service-perimeter-resourceServicePerimeter", {
    parent: pulumi.interpolate`accessPolicies/${access_policy.name}`,
    title: "restrictAll",
    status: {
        restrictedServices: ["storage.googleapis.com"],
    },
});
const service_perimeter_resourceServicePerimeterResource = new gcp.accesscontextmanager.ServicePerimeterResource("service-perimeter-resourceServicePerimeterResource", {
    perimeterName: service_perimeter_resourceServicePerimeter.name,
    resource: "projects/987654321",
});

constructor

new ServicePerimeterResource(name: string, args: ServicePerimeterResourceArgs, opts?: pulumi.CustomResourceOptions)

Create a ServicePerimeterResource resource with the given unique name, arguments, and options.

name The unique name of the resource.
args The arguments to use to populate this resource's properties.
opts A bag of options that control this resource's behavior.

method get

public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: ServicePerimeterResourceState, opts?: pulumi.CustomResourceOptions): ServicePerimeterResource

Get an existing ServicePerimeterResource resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

method getProvider

getProvider(moduleMember: string): ProviderResource | undefined

method isInstance

public static isInstance(obj: any): obj is ServicePerimeterResource

Returns true if the given object is an instance of ServicePerimeterResource. This is designed to work even when multiple copies of the Pulumi SDK have been loaded into the same process.

property id

id: Output<ID>;

id is the provider-assigned unique ID for this managed resource. It is set during deployments and may be missing (undefined) during planning phases.

property perimeterName

public perimeterName: pulumi.Output<string>;

The name of the Service Perimeter to add this resource to.

property resource

public resource: pulumi.Output<string>;

A GCP resource that is inside of the service perimeter. Currently only projects are allowed. Format: projects/{project_number}

property urn

urn: Output<URN>;

urn is the stable logical URN used to distinctly address a resource, both before and after deployments.

Others

interface AccessLevelArgs

interface AccessLevelArgs

The set of arguments for constructing a AccessLevel resource.

property basic

basic?: pulumi.Input<AccessLevelBasic>;

A set of predefined conditions for the access level and a combining function. Structure is documented below.

property description

description?: pulumi.Input<string>;

Description of the AccessLevel and its use. Does not affect behavior.

property name

name?: pulumi.Input<string>;

Resource name for the Access Level. The shortName component must begin with a letter and only include alphanumeric and ‘_‘. Format: accessPolicies/{policy_id}/accessLevels/{short_name}

property parent

parent: pulumi.Input<string>;

The AccessPolicy this AccessLevel lives in. Format: accessPolicies/{policy_id}

property title

title: pulumi.Input<string>;

Human readable title. Must be unique within the Policy.

interface AccessLevelState

interface AccessLevelState

Input properties used for looking up and filtering AccessLevel resources.

property basic

basic?: pulumi.Input<AccessLevelBasic>;

A set of predefined conditions for the access level and a combining function. Structure is documented below.

property description

description?: pulumi.Input<string>;

Description of the AccessLevel and its use. Does not affect behavior.

property name

name?: pulumi.Input<string>;

Resource name for the Access Level. The shortName component must begin with a letter and only include alphanumeric and ‘_‘. Format: accessPolicies/{policy_id}/accessLevels/{short_name}

property parent

parent?: pulumi.Input<string>;

The AccessPolicy this AccessLevel lives in. Format: accessPolicies/{policy_id}

property title

title?: pulumi.Input<string>;

Human readable title. Must be unique within the Policy.

interface AccessPolicyArgs

interface AccessPolicyArgs

The set of arguments for constructing a AccessPolicy resource.

property parent

parent: pulumi.Input<string>;

The parent of this AccessPolicy in the Cloud Resource Hierarchy. Format: organizations/{organization_id}

property title

title: pulumi.Input<string>;

Human readable title. Does not affect behavior.

interface AccessPolicyState

interface AccessPolicyState

Input properties used for looking up and filtering AccessPolicy resources.

property createTime

createTime?: pulumi.Input<string>;

Time the AccessPolicy was created in UTC.

property name

name?: pulumi.Input<string>;

Resource name of the AccessPolicy. Format: {policy_id}

property parent

parent?: pulumi.Input<string>;

The parent of this AccessPolicy in the Cloud Resource Hierarchy. Format: organizations/{organization_id}

property title

title?: pulumi.Input<string>;

Human readable title. Does not affect behavior.

property updateTime

updateTime?: pulumi.Input<string>;

Time the AccessPolicy was updated in UTC.

interface ServicePerimeterArgs

interface ServicePerimeterArgs

The set of arguments for constructing a ServicePerimeter resource.

property description

description?: pulumi.Input<string>;

Description of the ServicePerimeter and its use. Does not affect behavior.

property name

name?: pulumi.Input<string>;

Resource name for the ServicePerimeter. The shortName component must begin with a letter and only include alphanumeric and ‘_‘. Format: accessPolicies/{policy_id}/servicePerimeters/{short_name}

property parent

parent: pulumi.Input<string>;

The AccessPolicy this ServicePerimeter lives in. Format: accessPolicies/{policy_id}

property perimeterType

perimeterType?: pulumi.Input<string>;

property spec

spec?: pulumi.Input<ServicePerimeterSpec>;

property status

status?: pulumi.Input<ServicePerimeterStatus>;

ServicePerimeter configuration. Specifies sets of resources, restricted services and access levels that determine perimeter content and boundaries. Structure is documented below.

property title

title: pulumi.Input<string>;

Human readable title. Must be unique within the Policy.

property useExplicitDryRunSpec

useExplicitDryRunSpec?: pulumi.Input<boolean>;

interface ServicePerimeterResourceArgs

interface ServicePerimeterResourceArgs

The set of arguments for constructing a ServicePerimeterResource resource.

property perimeterName

perimeterName: pulumi.Input<string>;

The name of the Service Perimeter to add this resource to.

property resource

resource: pulumi.Input<string>;

A GCP resource that is inside of the service perimeter. Currently only projects are allowed. Format: projects/{project_number}

interface ServicePerimeterResourceState

interface ServicePerimeterResourceState

Input properties used for looking up and filtering ServicePerimeterResource resources.

property perimeterName

perimeterName?: pulumi.Input<string>;

The name of the Service Perimeter to add this resource to.

property resource

resource?: pulumi.Input<string>;

A GCP resource that is inside of the service perimeter. Currently only projects are allowed. Format: projects/{project_number}

interface ServicePerimeterState

interface ServicePerimeterState

Input properties used for looking up and filtering ServicePerimeter resources.

property createTime

createTime?: pulumi.Input<string>;

Time the AccessPolicy was created in UTC.

property description

description?: pulumi.Input<string>;

Description of the ServicePerimeter and its use. Does not affect behavior.

property name

name?: pulumi.Input<string>;

Resource name for the ServicePerimeter. The shortName component must begin with a letter and only include alphanumeric and ‘_‘. Format: accessPolicies/{policy_id}/servicePerimeters/{short_name}

property parent

parent?: pulumi.Input<string>;

The AccessPolicy this ServicePerimeter lives in. Format: accessPolicies/{policy_id}

property perimeterType

perimeterType?: pulumi.Input<string>;

property spec

spec?: pulumi.Input<ServicePerimeterSpec>;

property status

status?: pulumi.Input<ServicePerimeterStatus>;

ServicePerimeter configuration. Specifies sets of resources, restricted services and access levels that determine perimeter content and boundaries. Structure is documented below.

property title

title?: pulumi.Input<string>;

Human readable title. Must be unique within the Policy.

property updateTime

updateTime?: pulumi.Input<string>;

Time the AccessPolicy was updated in UTC.

property useExplicitDryRunSpec

useExplicitDryRunSpec?: pulumi.Input<boolean>;

The Pulumi Platform

Get Started

Migrate to Pulumi

Solutions for All Teams and Engineers

Any Code

Any Cloud

Module accesscontextmanager

Resources

Others

Resources

Example Usage - Access Context Manager Access Level Basic

Example Usage - Access Context Manager Access Policy Basic

Example Usage - Access Context Manager Service Perimeter Basic

Example Usage - Access Context Manager Service Perimeter Dry Run

Example Usage - Access Context Manager Service Perimeter Resource Basic

Others