Module accesscontextmanager

@pulumi/gcp > accesscontextmanager

class AccessLevel

extends CustomResource

An AccessLevel is a label that can be applied to requests to GCP services, along with a list of requirements necessary for the label to be applied.

To get more information about AccessLevel, see:

Example Usage - Access Context Manager Access Level Basic

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const access_level = new gcp.accesscontextmanager.AccessLevel("access-level", {
    basic: {
        conditions: [{
            devicePolicy: {
                osConstraints: [{
                    osType: "DESKTOP_CHROME_OS",
                }],
                requireScreenLock: false,
            },
        }],
    },
    parent: google_access_context_manager_access_policy_test_access.name.apply(name => `accessPolicies/${name}`),
    title: "chromeos_no_lock",
});
const access_policy = new gcp.accesscontextmanager.AccessPolicy("access-policy", {
    parent: "organizations/123456789",
    title: "my policy",
});

constructor

new AccessLevel(name: string, args: AccessLevelArgs, opts?: pulumi.CustomResourceOptions)

Create a AccessLevel resource with the given unique name, arguments, and options.

  • name The unique name of the resource.
  • args The arguments to use to populate this resource's properties.
  • opts A bag of options that control this resource's behavior.

method get

public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: AccessLevelState, opts?: pulumi.CustomResourceOptions): AccessLevel

Get an existing AccessLevel resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

method getProvider

getProvider(moduleMember: string): ProviderResource | undefined

method isInstance

static isInstance(obj: any): boolean

Returns true if the given object is an instance of CustomResource. This is designed to work even when multiple copies of the Pulumi SDK have been loaded into the same process.

property basic

public basic: pulumi.Output<{
    combiningFunction: string;
    conditions: {
        devicePolicy: {
            allowedDeviceManagementLevels: string[];
            allowedEncryptionStatuses: string[];
            osConstraints: {
                minimumVersion: string;
                osType: string;
            }[];
            requireScreenLock: boolean;
        };
        ipSubnetworks: string[];
        members: string[];
        negate: boolean;
        requiredAccessLevels: string[];
    }[];
} | undefined>;

property description

public description: pulumi.Output<string | undefined>;

property id

id: Output<ID>;

id is the provider-assigned unique ID for this managed resource. It is set during deployments and may be missing (undefined) during planning phases.

property name

public name: pulumi.Output<string>;

property parent

public parent: pulumi.Output<string>;

property title

public title: pulumi.Output<string>;

property urn

urn: Output<URN>;

urn is the stable logical URN used to distinctly address a resource, both before and after deployments.

class AccessPolicy

extends CustomResource

AccessPolicy is a container for AccessLevels (which define the necessary attributes to use GCP services) and ServicePerimeters (which define regions of services able to freely pass data within a perimeter). An access policy is globally visible within an organization, and the restrictions it specifies apply to all projects within an organization.

To get more information about AccessPolicy, see:

Example Usage - Access Context Manager Access Policy Basic

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const access_policy = new gcp.accesscontextmanager.AccessPolicy("access-policy", {
    parent: "organizations/123456789",
    title: "my policy",
});

constructor

new AccessPolicy(name: string, args: AccessPolicyArgs, opts?: pulumi.CustomResourceOptions)

Create a AccessPolicy resource with the given unique name, arguments, and options.

  • name The unique name of the resource.
  • args The arguments to use to populate this resource's properties.
  • opts A bag of options that control this resource's behavior.

method get

public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: AccessPolicyState, opts?: pulumi.CustomResourceOptions): AccessPolicy

Get an existing AccessPolicy resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

method getProvider

getProvider(moduleMember: string): ProviderResource | undefined

method isInstance

static isInstance(obj: any): boolean

Returns true if the given object is an instance of CustomResource. This is designed to work even when multiple copies of the Pulumi SDK have been loaded into the same process.

property createTime

public createTime: pulumi.Output<string>;

property id

id: Output<ID>;

id is the provider-assigned unique ID for this managed resource. It is set during deployments and may be missing (undefined) during planning phases.

property name

public name: pulumi.Output<string>;

property parent

public parent: pulumi.Output<string>;

property title

public title: pulumi.Output<string>;

property updateTime

public updateTime: pulumi.Output<string>;

property urn

urn: Output<URN>;

urn is the stable logical URN used to distinctly address a resource, both before and after deployments.

class ServicePerimeter

extends CustomResource

ServicePerimeter describes a set of GCP resources which can freely import and export data amongst themselves, but not export outside of the ServicePerimeter. If a request with a source within this ServicePerimeter has a target outside of the ServicePerimeter, the request will be blocked. Otherwise the request is allowed. There are two types of Service Perimeter

  • Regular and Bridge. Regular Service Perimeters cannot overlap, a single GCP project can only belong to a single regular Service Perimeter. Service Perimeter Bridges can contain only GCP projects as members, a single GCP project may belong to multiple Service Perimeter Bridges.

To get more information about ServicePerimeter, see:

Example Usage - Access Context Manager Service Perimeter Basic

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const access_level = new gcp.accesscontextmanager.AccessLevel("access-level", {
    basic: {
        conditions: [{
            devicePolicy: {
                osConstraints: [{
                    osType: "DESKTOP_CHROME_OS",
                }],
                requireScreenLock: false,
            },
        }],
    },
    parent: google_access_context_manager_access_policy_test_access.name.apply(name => `accessPolicies/${name}`),
    title: "chromeos_no_lock",
});
const access_policy = new gcp.accesscontextmanager.AccessPolicy("access-policy", {
    parent: "organizations/123456789",
    title: "my policy",
});
const service_perimeter = new gcp.accesscontextmanager.ServicePerimeter("service-perimeter", {
    parent: google_access_context_manager_access_policy_test_access.name.apply(name => `accessPolicies/${name}`),
    status: {
        restrictedServices: ["storage.googleapis.com"],
    },
    title: "restrict_all",
});

constructor

new ServicePerimeter(name: string, args: ServicePerimeterArgs, opts?: pulumi.CustomResourceOptions)

Create a ServicePerimeter resource with the given unique name, arguments, and options.

  • name The unique name of the resource.
  • args The arguments to use to populate this resource's properties.
  • opts A bag of options that control this resource's behavior.

method get

public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: ServicePerimeterState, opts?: pulumi.CustomResourceOptions): ServicePerimeter

Get an existing ServicePerimeter resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

method getProvider

getProvider(moduleMember: string): ProviderResource | undefined

method isInstance

static isInstance(obj: any): boolean

Returns true if the given object is an instance of CustomResource. This is designed to work even when multiple copies of the Pulumi SDK have been loaded into the same process.

property createTime

public createTime: pulumi.Output<string>;

property description

public description: pulumi.Output<string | undefined>;

property id

id: Output<ID>;

id is the provider-assigned unique ID for this managed resource. It is set during deployments and may be missing (undefined) during planning phases.

property name

public name: pulumi.Output<string>;

property parent

public parent: pulumi.Output<string>;

property perimeterType

public perimeterType: pulumi.Output<string | undefined>;

property status

public status: pulumi.Output<{
    accessLevels: string[];
    resources: string[];
    restrictedServices: string[];
} | undefined>;

property title

public title: pulumi.Output<string>;

property updateTime

public updateTime: pulumi.Output<string>;

property urn

urn: Output<URN>;

urn is the stable logical URN used to distinctly address a resource, both before and after deployments.

interface AccessLevelArgs

The set of arguments for constructing a AccessLevel resource.

property basic

basic?: pulumi.Input<{
    combiningFunction: pulumi.Input<string>;
    conditions: pulumi.Input<pulumi.Input<{
        devicePolicy: pulumi.Input<{
            allowedDeviceManagementLevels: pulumi.Input<pulumi.Input<string>[]>;
            allowedEncryptionStatuses: pulumi.Input<pulumi.Input<string>[]>;
            osConstraints: pulumi.Input<pulumi.Input<{
                minimumVersion: pulumi.Input<string>;
                osType: pulumi.Input<string>;
            }>[]>;
            requireScreenLock: pulumi.Input<boolean>;
        }>;
        ipSubnetworks: pulumi.Input<pulumi.Input<string>[]>;
        members: pulumi.Input<pulumi.Input<string>[]>;
        negate: pulumi.Input<boolean>;
        requiredAccessLevels: pulumi.Input<pulumi.Input<string>[]>;
    }>[]>;
}>;

property description

description?: pulumi.Input<string>;

property name

name?: pulumi.Input<string>;

property parent

parent: pulumi.Input<string>;

property title

title: pulumi.Input<string>;

interface AccessLevelState

Input properties used for looking up and filtering AccessLevel resources.

property basic

basic?: pulumi.Input<{
    combiningFunction: pulumi.Input<string>;
    conditions: pulumi.Input<pulumi.Input<{
        devicePolicy: pulumi.Input<{
            allowedDeviceManagementLevels: pulumi.Input<pulumi.Input<string>[]>;
            allowedEncryptionStatuses: pulumi.Input<pulumi.Input<string>[]>;
            osConstraints: pulumi.Input<pulumi.Input<{
                minimumVersion: pulumi.Input<string>;
                osType: pulumi.Input<string>;
            }>[]>;
            requireScreenLock: pulumi.Input<boolean>;
        }>;
        ipSubnetworks: pulumi.Input<pulumi.Input<string>[]>;
        members: pulumi.Input<pulumi.Input<string>[]>;
        negate: pulumi.Input<boolean>;
        requiredAccessLevels: pulumi.Input<pulumi.Input<string>[]>;
    }>[]>;
}>;

property description

description?: pulumi.Input<string>;

property name

name?: pulumi.Input<string>;

property parent

parent?: pulumi.Input<string>;

property title

title?: pulumi.Input<string>;

interface AccessPolicyArgs

The set of arguments for constructing a AccessPolicy resource.

property parent

parent: pulumi.Input<string>;

property title

title: pulumi.Input<string>;

interface AccessPolicyState

Input properties used for looking up and filtering AccessPolicy resources.

property createTime

createTime?: pulumi.Input<string>;

property name

name?: pulumi.Input<string>;

property parent

parent?: pulumi.Input<string>;

property title

title?: pulumi.Input<string>;

property updateTime

updateTime?: pulumi.Input<string>;

interface ServicePerimeterArgs

The set of arguments for constructing a ServicePerimeter resource.

property description

description?: pulumi.Input<string>;

property name

name?: pulumi.Input<string>;

property parent

parent: pulumi.Input<string>;

property perimeterType

perimeterType?: pulumi.Input<string>;

property status

status?: pulumi.Input<{
    accessLevels: pulumi.Input<pulumi.Input<string>[]>;
    resources: pulumi.Input<pulumi.Input<string>[]>;
    restrictedServices: pulumi.Input<pulumi.Input<string>[]>;
}>;

property title

title: pulumi.Input<string>;

interface ServicePerimeterState

Input properties used for looking up and filtering ServicePerimeter resources.

property createTime

createTime?: pulumi.Input<string>;

property description

description?: pulumi.Input<string>;

property name

name?: pulumi.Input<string>;

property parent

parent?: pulumi.Input<string>;

property perimeterType

perimeterType?: pulumi.Input<string>;

property status

status?: pulumi.Input<{
    accessLevels: pulumi.Input<pulumi.Input<string>[]>;
    resources: pulumi.Input<pulumi.Input<string>[]>;
    restrictedServices: pulumi.Input<pulumi.Input<string>[]>;
}>;

property title

title?: pulumi.Input<string>;

property updateTime

updateTime?: pulumi.Input<string>;