Docs Home
Google Cloud v8.27.0 published on Thursday, Apr 17, 2025 by Pulumi
gcp.compute.FirewallPolicyWithRules
Explore with Pulumi AI
Example Usage
Compute Firewall Policy With Rules Full
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const project = gcp.organizations.getProject({});
const addressGroup1 = new gcp.networksecurity.AddressGroup("address_group_1", {
name: "address-group",
parent: "organizations/123456789",
description: "Global address group",
location: "global",
items: ["208.80.154.224/32"],
type: "IPV4",
capacity: 100,
});
const securityProfile1 = new gcp.networksecurity.SecurityProfile("security_profile_1", {
name: "sp",
type: "THREAT_PREVENTION",
parent: "organizations/123456789",
location: "global",
});
const securityProfileGroup1 = new gcp.networksecurity.SecurityProfileGroup("security_profile_group_1", {
name: "spg",
parent: "organizations/123456789",
description: "my description",
threatPreventionProfile: securityProfile1.id,
});
const network = new gcp.compute.Network("network", {
name: "network",
autoCreateSubnetworks: false,
});
const primary = new gcp.compute.FirewallPolicyWithRules("primary", {
shortName: "fw-policy",
description: "Terraform test",
parent: "organizations/123456789",
rules: [
{
description: "tcp rule",
priority: 1000,
enableLogging: true,
action: "allow",
direction: "EGRESS",
targetResources: [project.then(project => `https://www.googleapis.com/compute/beta/projects/${project.name}/global/networks/default`)],
match: {
destIpRanges: ["11.100.0.1/32"],
destFqdns: [
"www.yyy.com",
"www.zzz.com",
],
destRegionCodes: [
"HK",
"IN",
],
destThreatIntelligences: [
"iplist-search-engines-crawlers",
"iplist-tor-exit-nodes",
],
destAddressGroups: [addressGroup1.id],
layer4Configs: [{
ipProtocol: "tcp",
ports: [
"8080",
"7070",
],
}],
},
},
{
description: "udp rule",
priority: 2000,
enableLogging: false,
action: "deny",
direction: "INGRESS",
disabled: true,
match: {
srcIpRanges: ["0.0.0.0/0"],
srcFqdns: [
"www.abc.com",
"www.def.com",
],
srcRegionCodes: [
"US",
"CA",
],
srcThreatIntelligences: [
"iplist-known-malicious-ips",
"iplist-public-clouds",
],
srcAddressGroups: [addressGroup1.id],
layer4Configs: [{
ipProtocol: "udp",
}],
},
},
{
description: "security profile group rule",
ruleName: "tcp rule",
priority: 3000,
enableLogging: false,
action: "apply_security_profile_group",
direction: "INGRESS",
targetServiceAccounts: ["test@google.com"],
securityProfileGroup: pulumi.interpolate`//networksecurity.googleapis.com/${securityProfileGroup1.id}`,
tlsInspect: true,
match: {
srcIpRanges: ["0.0.0.0/0"],
layer4Configs: [{
ipProtocol: "tcp",
}],
},
},
{
description: "network scope rule 1",
ruleName: "network scope 1",
priority: 4000,
enableLogging: false,
action: "allow",
direction: "INGRESS",
match: {
srcIpRanges: ["11.100.0.1/32"],
srcNetworkScope: "VPC_NETWORKS",
srcNetworks: [network.id],
layer4Configs: [{
ipProtocol: "tcp",
ports: ["8080"],
}],
},
},
{
description: "network scope rule 2",
ruleName: "network scope 2",
priority: 5000,
enableLogging: false,
action: "allow",
direction: "EGRESS",
match: {
destIpRanges: ["0.0.0.0/0"],
destNetworkScope: "INTERNET",
layer4Configs: [{
ipProtocol: "tcp",
ports: ["8080"],
}],
},
},
],
});
import pulumi
import pulumi_gcp as gcp
project = gcp.organizations.get_project()
address_group1 = gcp.networksecurity.AddressGroup("address_group_1",
name="address-group",
parent="organizations/123456789",
description="Global address group",
location="global",
items=["208.80.154.224/32"],
type="IPV4",
capacity=100)
security_profile1 = gcp.networksecurity.SecurityProfile("security_profile_1",
name="sp",
type="THREAT_PREVENTION",
parent="organizations/123456789",
location="global")
security_profile_group1 = gcp.networksecurity.SecurityProfileGroup("security_profile_group_1",
name="spg",
parent="organizations/123456789",
description="my description",
threat_prevention_profile=security_profile1.id)
network = gcp.compute.Network("network",
name="network",
auto_create_subnetworks=False)
primary = gcp.compute.FirewallPolicyWithRules("primary",
short_name="fw-policy",
description="Terraform test",
parent="organizations/123456789",
rules=[
{
"description": "tcp rule",
"priority": 1000,
"enable_logging": True,
"action": "allow",
"direction": "EGRESS",
"target_resources": [f"https://www.googleapis.com/compute/beta/projects/{project.name}/global/networks/default"],
"match": {
"dest_ip_ranges": ["11.100.0.1/32"],
"dest_fqdns": [
"www.yyy.com",
"www.zzz.com",
],
"dest_region_codes": [
"HK",
"IN",
],
"dest_threat_intelligences": [
"iplist-search-engines-crawlers",
"iplist-tor-exit-nodes",
],
"dest_address_groups": [address_group1.id],
"layer4_configs": [{
"ip_protocol": "tcp",
"ports": [
"8080",
"7070",
],
}],
},
},
{
"description": "udp rule",
"priority": 2000,
"enable_logging": False,
"action": "deny",
"direction": "INGRESS",
"disabled": True,
"match": {
"src_ip_ranges": ["0.0.0.0/0"],
"src_fqdns": [
"www.abc.com",
"www.def.com",
],
"src_region_codes": [
"US",
"CA",
],
"src_threat_intelligences": [
"iplist-known-malicious-ips",
"iplist-public-clouds",
],
"src_address_groups": [address_group1.id],
"layer4_configs": [{
"ip_protocol": "udp",
}],
},
},
{
"description": "security profile group rule",
"rule_name": "tcp rule",
"priority": 3000,
"enable_logging": False,
"action": "apply_security_profile_group",
"direction": "INGRESS",
"target_service_accounts": ["test@google.com"],
"security_profile_group": security_profile_group1.id.apply(lambda id: f"//networksecurity.googleapis.com/{id}"),
"tls_inspect": True,
"match": {
"src_ip_ranges": ["0.0.0.0/0"],
"layer4_configs": [{
"ip_protocol": "tcp",
}],
},
},
{
"description": "network scope rule 1",
"rule_name": "network scope 1",
"priority": 4000,
"enable_logging": False,
"action": "allow",
"direction": "INGRESS",
"match": {
"src_ip_ranges": ["11.100.0.1/32"],
"src_network_scope": "VPC_NETWORKS",
"src_networks": [network.id],
"layer4_configs": [{
"ip_protocol": "tcp",
"ports": ["8080"],
}],
},
},
{
"description": "network scope rule 2",
"rule_name": "network scope 2",
"priority": 5000,
"enable_logging": False,
"action": "allow",
"direction": "EGRESS",
"match": {
"dest_ip_ranges": ["0.0.0.0/0"],
"dest_network_scope": "INTERNET",
"layer4_configs": [{
"ip_protocol": "tcp",
"ports": ["8080"],
}],
},
},
])
package main
import (
"fmt"
"github.com/pulumi/pulumi-gcp/sdk/v8/go/gcp/compute"
"github.com/pulumi/pulumi-gcp/sdk/v8/go/gcp/networksecurity"
"github.com/pulumi/pulumi-gcp/sdk/v8/go/gcp/organizations"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
project, err := organizations.LookupProject(ctx, &organizations.LookupProjectArgs{}, nil)
if err != nil {
return err
}
addressGroup1, err := networksecurity.NewAddressGroup(ctx, "address_group_1", &networksecurity.AddressGroupArgs{
Name: pulumi.String("address-group"),
Parent: pulumi.String("organizations/123456789"),
Description: pulumi.String("Global address group"),
Location: pulumi.String("global"),
Items: pulumi.StringArray{
pulumi.String("208.80.154.224/32"),
},
Type: pulumi.String("IPV4"),
Capacity: pulumi.Int(100),
})
if err != nil {
return err
}
securityProfile1, err := networksecurity.NewSecurityProfile(ctx, "security_profile_1", &networksecurity.SecurityProfileArgs{
Name: pulumi.String("sp"),
Type: pulumi.String("THREAT_PREVENTION"),
Parent: pulumi.String("organizations/123456789"),
Location: pulumi.String("global"),
})
if err != nil {
return err
}
securityProfileGroup1, err := networksecurity.NewSecurityProfileGroup(ctx, "security_profile_group_1", &networksecurity.SecurityProfileGroupArgs{
Name: pulumi.String("spg"),
Parent: pulumi.String("organizations/123456789"),
Description: pulumi.String("my description"),
ThreatPreventionProfile: securityProfile1.ID(),
})
if err != nil {
return err
}
network, err := compute.NewNetwork(ctx, "network", &compute.NetworkArgs{
Name: pulumi.String("network"),
AutoCreateSubnetworks: pulumi.Bool(false),
})
if err != nil {
return err
}
_, err = compute.NewFirewallPolicyWithRules(ctx, "primary", &compute.FirewallPolicyWithRulesArgs{
ShortName: pulumi.String("fw-policy"),
Description: pulumi.String("Terraform test"),
Parent: pulumi.String("organizations/123456789"),
Rules: compute.FirewallPolicyWithRulesRuleArray{
&compute.FirewallPolicyWithRulesRuleArgs{
Description: pulumi.String("tcp rule"),
Priority: pulumi.Int(1000),
EnableLogging: pulumi.Bool(true),
Action: pulumi.String("allow"),
Direction: pulumi.String("EGRESS"),
TargetResources: pulumi.StringArray{
pulumi.Sprintf("https://www.googleapis.com/compute/beta/projects/%v/global/networks/default", project.Name),
},
Match: &compute.FirewallPolicyWithRulesRuleMatchArgs{
DestIpRanges: pulumi.StringArray{
pulumi.String("11.100.0.1/32"),
},
DestFqdns: pulumi.StringArray{
pulumi.String("www.yyy.com"),
pulumi.String("www.zzz.com"),
},
DestRegionCodes: pulumi.StringArray{
pulumi.String("HK"),
pulumi.String("IN"),
},
DestThreatIntelligences: pulumi.StringArray{
pulumi.String("iplist-search-engines-crawlers"),
pulumi.String("iplist-tor-exit-nodes"),
},
DestAddressGroups: pulumi.StringArray{
addressGroup1.ID(),
},
Layer4Configs: compute.FirewallPolicyWithRulesRuleMatchLayer4ConfigArray{
&compute.FirewallPolicyWithRulesRuleMatchLayer4ConfigArgs{
IpProtocol: pulumi.String("tcp"),
Ports: pulumi.StringArray{
pulumi.String("8080"),
pulumi.String("7070"),
},
},
},
},
},
&compute.FirewallPolicyWithRulesRuleArgs{
Description: pulumi.String("udp rule"),
Priority: pulumi.Int(2000),
EnableLogging: pulumi.Bool(false),
Action: pulumi.String("deny"),
Direction: pulumi.String("INGRESS"),
Disabled: pulumi.Bool(true),
Match: &compute.FirewallPolicyWithRulesRuleMatchArgs{
SrcIpRanges: pulumi.StringArray{
pulumi.String("0.0.0.0/0"),
},
SrcFqdns: pulumi.StringArray{
pulumi.String("www.abc.com"),
pulumi.String("www.def.com"),
},
SrcRegionCodes: pulumi.StringArray{
pulumi.String("US"),
pulumi.String("CA"),
},
SrcThreatIntelligences: pulumi.StringArray{
pulumi.String("iplist-known-malicious-ips"),
pulumi.String("iplist-public-clouds"),
},
SrcAddressGroups: pulumi.StringArray{
addressGroup1.ID(),
},
Layer4Configs: compute.FirewallPolicyWithRulesRuleMatchLayer4ConfigArray{
&compute.FirewallPolicyWithRulesRuleMatchLayer4ConfigArgs{
IpProtocol: pulumi.String("udp"),
},
},
},
},
&compute.FirewallPolicyWithRulesRuleArgs{
Description: pulumi.String("security profile group rule"),
RuleName: pulumi.String("tcp rule"),
Priority: pulumi.Int(3000),
EnableLogging: pulumi.Bool(false),
Action: pulumi.String("apply_security_profile_group"),
Direction: pulumi.String("INGRESS"),
TargetServiceAccounts: pulumi.StringArray{
pulumi.String("test@google.com"),
},
SecurityProfileGroup: securityProfileGroup1.ID().ApplyT(func(id string) (string, error) {
return fmt.Sprintf("//networksecurity.googleapis.com/%v", id), nil
}).(pulumi.StringOutput),
TlsInspect: pulumi.Bool(true),
Match: &compute.FirewallPolicyWithRulesRuleMatchArgs{
SrcIpRanges: pulumi.StringArray{
pulumi.String("0.0.0.0/0"),
},
Layer4Configs: compute.FirewallPolicyWithRulesRuleMatchLayer4ConfigArray{
&compute.FirewallPolicyWithRulesRuleMatchLayer4ConfigArgs{
IpProtocol: pulumi.String("tcp"),
},
},
},
},
&compute.FirewallPolicyWithRulesRuleArgs{
Description: pulumi.String("network scope rule 1"),
RuleName: pulumi.String("network scope 1"),
Priority: pulumi.Int(4000),
EnableLogging: pulumi.Bool(false),
Action: pulumi.String("allow"),
Direction: pulumi.String("INGRESS"),
Match: &compute.FirewallPolicyWithRulesRuleMatchArgs{
SrcIpRanges: pulumi.StringArray{
pulumi.String("11.100.0.1/32"),
},
SrcNetworkScope: pulumi.String("VPC_NETWORKS"),
SrcNetworks: pulumi.StringArray{
network.ID(),
},
Layer4Configs: compute.FirewallPolicyWithRulesRuleMatchLayer4ConfigArray{
&compute.FirewallPolicyWithRulesRuleMatchLayer4ConfigArgs{
IpProtocol: pulumi.String("tcp"),
Ports: pulumi.StringArray{
pulumi.String("8080"),
},
},
},
},
},
&compute.FirewallPolicyWithRulesRuleArgs{
Description: pulumi.String("network scope rule 2"),
RuleName: pulumi.String("network scope 2"),
Priority: pulumi.Int(5000),
EnableLogging: pulumi.Bool(false),
Action: pulumi.String("allow"),
Direction: pulumi.String("EGRESS"),
Match: &compute.FirewallPolicyWithRulesRuleMatchArgs{
DestIpRanges: pulumi.StringArray{
pulumi.String("0.0.0.0/0"),
},
DestNetworkScope: pulumi.String("INTERNET"),
Layer4Configs: compute.FirewallPolicyWithRulesRuleMatchLayer4ConfigArray{
&compute.FirewallPolicyWithRulesRuleMatchLayer4ConfigArgs{
IpProtocol: pulumi.String("tcp"),
Ports: pulumi.StringArray{
pulumi.String("8080"),
},
},
},
},
},
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var project = Gcp.Organizations.GetProject.Invoke();
var addressGroup1 = new Gcp.NetworkSecurity.AddressGroup("address_group_1", new()
{
Name = "address-group",
Parent = "organizations/123456789",
Description = "Global address group",
Location = "global",
Items = new[]
{
"208.80.154.224/32",
},
Type = "IPV4",
Capacity = 100,
});
var securityProfile1 = new Gcp.NetworkSecurity.SecurityProfile("security_profile_1", new()
{
Name = "sp",
Type = "THREAT_PREVENTION",
Parent = "organizations/123456789",
Location = "global",
});
var securityProfileGroup1 = new Gcp.NetworkSecurity.SecurityProfileGroup("security_profile_group_1", new()
{
Name = "spg",
Parent = "organizations/123456789",
Description = "my description",
ThreatPreventionProfile = securityProfile1.Id,
});
var network = new Gcp.Compute.Network("network", new()
{
Name = "network",
AutoCreateSubnetworks = false,
});
var primary = new Gcp.Compute.FirewallPolicyWithRules("primary", new()
{
ShortName = "fw-policy",
Description = "Terraform test",
Parent = "organizations/123456789",
Rules = new[]
{
new Gcp.Compute.Inputs.FirewallPolicyWithRulesRuleArgs
{
Description = "tcp rule",
Priority = 1000,
EnableLogging = true,
Action = "allow",
Direction = "EGRESS",
TargetResources = new[]
{
$"https://www.googleapis.com/compute/beta/projects/{project.Apply(getProjectResult => getProjectResult.Name)}/global/networks/default",
},
Match = new Gcp.Compute.Inputs.FirewallPolicyWithRulesRuleMatchArgs
{
DestIpRanges = new[]
{
"11.100.0.1/32",
},
DestFqdns = new[]
{
"www.yyy.com",
"www.zzz.com",
},
DestRegionCodes = new[]
{
"HK",
"IN",
},
DestThreatIntelligences = new[]
{
"iplist-search-engines-crawlers",
"iplist-tor-exit-nodes",
},
DestAddressGroups = new[]
{
addressGroup1.Id,
},
Layer4Configs = new[]
{
new Gcp.Compute.Inputs.FirewallPolicyWithRulesRuleMatchLayer4ConfigArgs
{
IpProtocol = "tcp",
Ports = new[]
{
"8080",
"7070",
},
},
},
},
},
new Gcp.Compute.Inputs.FirewallPolicyWithRulesRuleArgs
{
Description = "udp rule",
Priority = 2000,
EnableLogging = false,
Action = "deny",
Direction = "INGRESS",
Disabled = true,
Match = new Gcp.Compute.Inputs.FirewallPolicyWithRulesRuleMatchArgs
{
SrcIpRanges = new[]
{
"0.0.0.0/0",
},
SrcFqdns = new[]
{
"www.abc.com",
"www.def.com",
},
SrcRegionCodes = new[]
{
"US",
"CA",
},
SrcThreatIntelligences = new[]
{
"iplist-known-malicious-ips",
"iplist-public-clouds",
},
SrcAddressGroups = new[]
{
addressGroup1.Id,
},
Layer4Configs = new[]
{
new Gcp.Compute.Inputs.FirewallPolicyWithRulesRuleMatchLayer4ConfigArgs
{
IpProtocol = "udp",
},
},
},
},
new Gcp.Compute.Inputs.FirewallPolicyWithRulesRuleArgs
{
Description = "security profile group rule",
RuleName = "tcp rule",
Priority = 3000,
EnableLogging = false,
Action = "apply_security_profile_group",
Direction = "INGRESS",
TargetServiceAccounts = new[]
{
"test@google.com",
},
SecurityProfileGroup = securityProfileGroup1.Id.Apply(id => $"//networksecurity.googleapis.com/{id}"),
TlsInspect = true,
Match = new Gcp.Compute.Inputs.FirewallPolicyWithRulesRuleMatchArgs
{
SrcIpRanges = new[]
{
"0.0.0.0/0",
},
Layer4Configs = new[]
{
new Gcp.Compute.Inputs.FirewallPolicyWithRulesRuleMatchLayer4ConfigArgs
{
IpProtocol = "tcp",
},
},
},
},
new Gcp.Compute.Inputs.FirewallPolicyWithRulesRuleArgs
{
Description = "network scope rule 1",
RuleName = "network scope 1",
Priority = 4000,
EnableLogging = false,
Action = "allow",
Direction = "INGRESS",
Match = new Gcp.Compute.Inputs.FirewallPolicyWithRulesRuleMatchArgs
{
SrcIpRanges = new[]
{
"11.100.0.1/32",
},
SrcNetworkScope = "VPC_NETWORKS",
SrcNetworks = new[]
{
network.Id,
},
Layer4Configs = new[]
{
new Gcp.Compute.Inputs.FirewallPolicyWithRulesRuleMatchLayer4ConfigArgs
{
IpProtocol = "tcp",
Ports = new[]
{
"8080",
},
},
},
},
},
new Gcp.Compute.Inputs.FirewallPolicyWithRulesRuleArgs
{
Description = "network scope rule 2",
RuleName = "network scope 2",
Priority = 5000,
EnableLogging = false,
Action = "allow",
Direction = "EGRESS",
Match = new Gcp.Compute.Inputs.FirewallPolicyWithRulesRuleMatchArgs
{
DestIpRanges = new[]
{
"0.0.0.0/0",
},
DestNetworkScope = "INTERNET",
Layer4Configs = new[]
{
new Gcp.Compute.Inputs.FirewallPolicyWithRulesRuleMatchLayer4ConfigArgs
{
IpProtocol = "tcp",
Ports = new[]
{
"8080",
},
},
},
},
},
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetProjectArgs;
import com.pulumi.gcp.networksecurity.AddressGroup;
import com.pulumi.gcp.networksecurity.AddressGroupArgs;
import com.pulumi.gcp.networksecurity.SecurityProfile;
import com.pulumi.gcp.networksecurity.SecurityProfileArgs;
import com.pulumi.gcp.networksecurity.SecurityProfileGroup;
import com.pulumi.gcp.networksecurity.SecurityProfileGroupArgs;
import com.pulumi.gcp.compute.Network;
import com.pulumi.gcp.compute.NetworkArgs;
import com.pulumi.gcp.compute.FirewallPolicyWithRules;
import com.pulumi.gcp.compute.FirewallPolicyWithRulesArgs;
import com.pulumi.gcp.compute.inputs.FirewallPolicyWithRulesRuleArgs;
import com.pulumi.gcp.compute.inputs.FirewallPolicyWithRulesRuleMatchArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
final var project = OrganizationsFunctions.getProject(GetProjectArgs.builder()
.build());
var addressGroup1 = new AddressGroup("addressGroup1", AddressGroupArgs.builder()
.name("address-group")
.parent("organizations/123456789")
.description("Global address group")
.location("global")
.items("208.80.154.224/32")
.type("IPV4")
.capacity(100)
.build());
var securityProfile1 = new SecurityProfile("securityProfile1", SecurityProfileArgs.builder()
.name("sp")
.type("THREAT_PREVENTION")
.parent("organizations/123456789")
.location("global")
.build());
var securityProfileGroup1 = new SecurityProfileGroup("securityProfileGroup1", SecurityProfileGroupArgs.builder()
.name("spg")
.parent("organizations/123456789")
.description("my description")
.threatPreventionProfile(securityProfile1.id())
.build());
var network = new Network("network", NetworkArgs.builder()
.name("network")
.autoCreateSubnetworks(false)
.build());
var primary = new FirewallPolicyWithRules("primary", FirewallPolicyWithRulesArgs.builder()
.shortName("fw-policy")
.description("Terraform test")
.parent("organizations/123456789")
.rules(
FirewallPolicyWithRulesRuleArgs.builder()
.description("tcp rule")
.priority(1000)
.enableLogging(true)
.action("allow")
.direction("EGRESS")
.targetResources(String.format("https://www.googleapis.com/compute/beta/projects/%s/global/networks/default", project.name()))
.match(FirewallPolicyWithRulesRuleMatchArgs.builder()
.destIpRanges("11.100.0.1/32")
.destFqdns(
"www.yyy.com",
"www.zzz.com")
.destRegionCodes(
"HK",
"IN")
.destThreatIntelligences(
"iplist-search-engines-crawlers",
"iplist-tor-exit-nodes")
.destAddressGroups(addressGroup1.id())
.layer4Configs(FirewallPolicyWithRulesRuleMatchLayer4ConfigArgs.builder()
.ipProtocol("tcp")
.ports(
"8080",
"7070")
.build())
.build())
.build(),
FirewallPolicyWithRulesRuleArgs.builder()
.description("udp rule")
.priority(2000)
.enableLogging(false)
.action("deny")
.direction("INGRESS")
.disabled(true)
.match(FirewallPolicyWithRulesRuleMatchArgs.builder()
.srcIpRanges("0.0.0.0/0")
.srcFqdns(
"www.abc.com",
"www.def.com")
.srcRegionCodes(
"US",
"CA")
.srcThreatIntelligences(
"iplist-known-malicious-ips",
"iplist-public-clouds")
.srcAddressGroups(addressGroup1.id())
.layer4Configs(FirewallPolicyWithRulesRuleMatchLayer4ConfigArgs.builder()
.ipProtocol("udp")
.build())
.build())
.build(),
FirewallPolicyWithRulesRuleArgs.builder()
.description("security profile group rule")
.ruleName("tcp rule")
.priority(3000)
.enableLogging(false)
.action("apply_security_profile_group")
.direction("INGRESS")
.targetServiceAccounts("test@google.com")
.securityProfileGroup(securityProfileGroup1.id().applyValue(_id -> String.format("//networksecurity.googleapis.com/%s", _id)))
.tlsInspect(true)
.match(FirewallPolicyWithRulesRuleMatchArgs.builder()
.srcIpRanges("0.0.0.0/0")
.layer4Configs(FirewallPolicyWithRulesRuleMatchLayer4ConfigArgs.builder()
.ipProtocol("tcp")
.build())
.build())
.build(),
FirewallPolicyWithRulesRuleArgs.builder()
.description("network scope rule 1")
.ruleName("network scope 1")
.priority(4000)
.enableLogging(false)
.action("allow")
.direction("INGRESS")
.match(FirewallPolicyWithRulesRuleMatchArgs.builder()
.srcIpRanges("11.100.0.1/32")
.srcNetworkScope("VPC_NETWORKS")
.srcNetworks(network.id())
.layer4Configs(FirewallPolicyWithRulesRuleMatchLayer4ConfigArgs.builder()
.ipProtocol("tcp")
.ports("8080")
.build())
.build())
.build(),
FirewallPolicyWithRulesRuleArgs.builder()
.description("network scope rule 2")
.ruleName("network scope 2")
.priority(5000)
.enableLogging(false)
.action("allow")
.direction("EGRESS")
.match(FirewallPolicyWithRulesRuleMatchArgs.builder()
.destIpRanges("0.0.0.0/0")
.destNetworkScope("INTERNET")
.layer4Configs(FirewallPolicyWithRulesRuleMatchLayer4ConfigArgs.builder()
.ipProtocol("tcp")
.ports("8080")
.build())
.build())
.build())
.build());
}
}
resources:
primary:
type: gcp:compute:FirewallPolicyWithRules
properties:
shortName: fw-policy
description: Terraform test
parent: organizations/123456789
rules:
- description: tcp rule
priority: 1000
enableLogging: true
action: allow
direction: EGRESS
targetResources:
- https://www.googleapis.com/compute/beta/projects/${project.name}/global/networks/default
match:
destIpRanges:
- 11.100.0.1/32
destFqdns:
- www.yyy.com
- www.zzz.com
destRegionCodes:
- HK
- IN
destThreatIntelligences:
- iplist-search-engines-crawlers
- iplist-tor-exit-nodes
destAddressGroups:
- ${addressGroup1.id}
layer4Configs:
- ipProtocol: tcp
ports:
- 8080
- 7070
- description: udp rule
priority: 2000
enableLogging: false
action: deny
direction: INGRESS
disabled: true
match:
srcIpRanges:
- 0.0.0.0/0
srcFqdns:
- www.abc.com
- www.def.com
srcRegionCodes:
- US
- CA
srcThreatIntelligences:
- iplist-known-malicious-ips
- iplist-public-clouds
srcAddressGroups:
- ${addressGroup1.id}
layer4Configs:
- ipProtocol: udp
- description: security profile group rule
ruleName: tcp rule
priority: 3000
enableLogging: false
action: apply_security_profile_group
direction: INGRESS
targetServiceAccounts:
- test@google.com
securityProfileGroup: //networksecurity.googleapis.com/${securityProfileGroup1.id}
tlsInspect: true
match:
srcIpRanges:
- 0.0.0.0/0
layer4Configs:
- ipProtocol: tcp
- description: network scope rule 1
ruleName: network scope 1
priority: 4000
enableLogging: false
action: allow
direction: INGRESS
match:
srcIpRanges:
- 11.100.0.1/32
srcNetworkScope: VPC_NETWORKS
srcNetworks:
- ${network.id}
layer4Configs:
- ipProtocol: tcp
ports:
- 8080
- description: network scope rule 2
ruleName: network scope 2
priority: 5000
enableLogging: false
action: allow
direction: EGRESS
match:
destIpRanges:
- 0.0.0.0/0
destNetworkScope: INTERNET
layer4Configs:
- ipProtocol: tcp
ports:
- 8080
addressGroup1:
type: gcp:networksecurity:AddressGroup
name: address_group_1
properties:
name: address-group
parent: organizations/123456789
description: Global address group
location: global
items:
- 208.80.154.224/32
type: IPV4
capacity: 100
securityProfileGroup1:
type: gcp:networksecurity:SecurityProfileGroup
name: security_profile_group_1
properties:
name: spg
parent: organizations/123456789
description: my description
threatPreventionProfile: ${securityProfile1.id}
securityProfile1:
type: gcp:networksecurity:SecurityProfile
name: security_profile_1
properties:
name: sp
type: THREAT_PREVENTION
parent: organizations/123456789
location: global
network:
type: gcp:compute:Network
properties:
name: network
autoCreateSubnetworks: false
variables:
project:
fn::invoke:
function: gcp:organizations:getProject
arguments: {}
Create FirewallPolicyWithRules Resource
Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.
Constructor syntax
new FirewallPolicyWithRules(name: string, args: FirewallPolicyWithRulesArgs, opts?: CustomResourceOptions);@overload
def FirewallPolicyWithRules(resource_name: str,
args: FirewallPolicyWithRulesArgs,
opts: Optional[ResourceOptions] = None)
@overload
def FirewallPolicyWithRules(resource_name: str,
opts: Optional[ResourceOptions] = None,
parent: Optional[str] = None,
rules: Optional[Sequence[FirewallPolicyWithRulesRuleArgs]] = None,
short_name: Optional[str] = None,
description: Optional[str] = None)func NewFirewallPolicyWithRules(ctx *Context, name string, args FirewallPolicyWithRulesArgs, opts ...ResourceOption) (*FirewallPolicyWithRules, error)public FirewallPolicyWithRules(string name, FirewallPolicyWithRulesArgs args, CustomResourceOptions? opts = null)
public FirewallPolicyWithRules(String name, FirewallPolicyWithRulesArgs args)
public FirewallPolicyWithRules(String name, FirewallPolicyWithRulesArgs args, CustomResourceOptions options)
type: gcp:compute:FirewallPolicyWithRules
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
Parameters
- name string
- The unique name of the resource.
- args FirewallPolicyWithRulesArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name str
- The unique name of the resource.
- args FirewallPolicyWithRulesArgs
- The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name string
- The unique name of the resource.
- args FirewallPolicyWithRulesArgs
- The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args FirewallPolicyWithRulesArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name String
- The unique name of the resource.
- args FirewallPolicyWithRulesArgs
- The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
Constructor example
The following reference example uses placeholder values for all input properties.
var firewallPolicyWithRulesResource = new Gcp.Compute.FirewallPolicyWithRules("firewallPolicyWithRulesResource", new()
{
Parent = "string",
Rules = new[]
{
new Gcp.Compute.Inputs.FirewallPolicyWithRulesRuleArgs
{
Action = "string",
Match = new Gcp.Compute.Inputs.FirewallPolicyWithRulesRuleMatchArgs
{
Layer4Configs = new[]
{
new Gcp.Compute.Inputs.FirewallPolicyWithRulesRuleMatchLayer4ConfigArgs
{
IpProtocol = "string",
Ports = new[]
{
"string",
},
},
},
DestNetworkScope = "string",
DestIpRanges = new[]
{
"string",
},
DestAddressGroups = new[]
{
"string",
},
DestRegionCodes = new[]
{
"string",
},
DestThreatIntelligences = new[]
{
"string",
},
DestFqdns = new[]
{
"string",
},
SrcAddressGroups = new[]
{
"string",
},
SrcFqdns = new[]
{
"string",
},
SrcIpRanges = new[]
{
"string",
},
SrcNetworkScope = "string",
SrcNetworks = new[]
{
"string",
},
SrcRegionCodes = new[]
{
"string",
},
SrcThreatIntelligences = new[]
{
"string",
},
},
Priority = 0,
Description = "string",
Direction = "string",
Disabled = false,
EnableLogging = false,
RuleName = "string",
SecurityProfileGroup = "string",
TargetResources = new[]
{
"string",
},
TargetServiceAccounts = new[]
{
"string",
},
TlsInspect = false,
},
},
ShortName = "string",
Description = "string",
});
example, err := compute.NewFirewallPolicyWithRules(ctx, "firewallPolicyWithRulesResource", &compute.FirewallPolicyWithRulesArgs{
Parent: pulumi.String("string"),
Rules: compute.FirewallPolicyWithRulesRuleArray{
&compute.FirewallPolicyWithRulesRuleArgs{
Action: pulumi.String("string"),
Match: &compute.FirewallPolicyWithRulesRuleMatchArgs{
Layer4Configs: compute.FirewallPolicyWithRulesRuleMatchLayer4ConfigArray{
&compute.FirewallPolicyWithRulesRuleMatchLayer4ConfigArgs{
IpProtocol: pulumi.String("string"),
Ports: pulumi.StringArray{
pulumi.String("string"),
},
},
},
DestNetworkScope: pulumi.String("string"),
DestIpRanges: pulumi.StringArray{
pulumi.String("string"),
},
DestAddressGroups: pulumi.StringArray{
pulumi.String("string"),
},
DestRegionCodes: pulumi.StringArray{
pulumi.String("string"),
},
DestThreatIntelligences: pulumi.StringArray{
pulumi.String("string"),
},
DestFqdns: pulumi.StringArray{
pulumi.String("string"),
},
SrcAddressGroups: pulumi.StringArray{
pulumi.String("string"),
},
SrcFqdns: pulumi.StringArray{
pulumi.String("string"),
},
SrcIpRanges: pulumi.StringArray{
pulumi.String("string"),
},
SrcNetworkScope: pulumi.String("string"),
SrcNetworks: pulumi.StringArray{
pulumi.String("string"),
},
SrcRegionCodes: pulumi.StringArray{
pulumi.String("string"),
},
SrcThreatIntelligences: pulumi.StringArray{
pulumi.String("string"),
},
},
Priority: pulumi.Int(0),
Description: pulumi.String("string"),
Direction: pulumi.String("string"),
Disabled: pulumi.Bool(false),
EnableLogging: pulumi.Bool(false),
RuleName: pulumi.String("string"),
SecurityProfileGroup: pulumi.String("string"),
TargetResources: pulumi.StringArray{
pulumi.String("string"),
},
TargetServiceAccounts: pulumi.StringArray{
pulumi.String("string"),
},
TlsInspect: pulumi.Bool(false),
},
},
ShortName: pulumi.String("string"),
Description: pulumi.String("string"),
})
var firewallPolicyWithRulesResource = new FirewallPolicyWithRules("firewallPolicyWithRulesResource", FirewallPolicyWithRulesArgs.builder()
.parent("string")
.rules(FirewallPolicyWithRulesRuleArgs.builder()
.action("string")
.match(FirewallPolicyWithRulesRuleMatchArgs.builder()
.layer4Configs(FirewallPolicyWithRulesRuleMatchLayer4ConfigArgs.builder()
.ipProtocol("string")
.ports("string")
.build())
.destNetworkScope("string")
.destIpRanges("string")
.destAddressGroups("string")
.destRegionCodes("string")
.destThreatIntelligences("string")
.destFqdns("string")
.srcAddressGroups("string")
.srcFqdns("string")
.srcIpRanges("string")
.srcNetworkScope("string")
.srcNetworks("string")
.srcRegionCodes("string")
.srcThreatIntelligences("string")
.build())
.priority(0)
.description("string")
.direction("string")
.disabled(false)
.enableLogging(false)
.ruleName("string")
.securityProfileGroup("string")
.targetResources("string")
.targetServiceAccounts("string")
.tlsInspect(false)
.build())
.shortName("string")
.description("string")
.build());
firewall_policy_with_rules_resource = gcp.compute.FirewallPolicyWithRules("firewallPolicyWithRulesResource",
parent="string",
rules=[{
"action": "string",
"match": {
"layer4_configs": [{
"ip_protocol": "string",
"ports": ["string"],
}],
"dest_network_scope": "string",
"dest_ip_ranges": ["string"],
"dest_address_groups": ["string"],
"dest_region_codes": ["string"],
"dest_threat_intelligences": ["string"],
"dest_fqdns": ["string"],
"src_address_groups": ["string"],
"src_fqdns": ["string"],
"src_ip_ranges": ["string"],
"src_network_scope": "string",
"src_networks": ["string"],
"src_region_codes": ["string"],
"src_threat_intelligences": ["string"],
},
"priority": 0,
"description": "string",
"direction": "string",
"disabled": False,
"enable_logging": False,
"rule_name": "string",
"security_profile_group": "string",
"target_resources": ["string"],
"target_service_accounts": ["string"],
"tls_inspect": False,
}],
short_name="string",
description="string")
const firewallPolicyWithRulesResource = new gcp.compute.FirewallPolicyWithRules("firewallPolicyWithRulesResource", {
parent: "string",
rules: [{
action: "string",
match: {
layer4Configs: [{
ipProtocol: "string",
ports: ["string"],
}],
destNetworkScope: "string",
destIpRanges: ["string"],
destAddressGroups: ["string"],
destRegionCodes: ["string"],
destThreatIntelligences: ["string"],
destFqdns: ["string"],
srcAddressGroups: ["string"],
srcFqdns: ["string"],
srcIpRanges: ["string"],
srcNetworkScope: "string",
srcNetworks: ["string"],
srcRegionCodes: ["string"],
srcThreatIntelligences: ["string"],
},
priority: 0,
description: "string",
direction: "string",
disabled: false,
enableLogging: false,
ruleName: "string",
securityProfileGroup: "string",
targetResources: ["string"],
targetServiceAccounts: ["string"],
tlsInspect: false,
}],
shortName: "string",
description: "string",
});
type: gcp:compute:FirewallPolicyWithRules
properties:
description: string
parent: string
rules:
- action: string
description: string
direction: string
disabled: false
enableLogging: false
match:
destAddressGroups:
- string
destFqdns:
- string
destIpRanges:
- string
destNetworkScope: string
destRegionCodes:
- string
destThreatIntelligences:
- string
layer4Configs:
- ipProtocol: string
ports:
- string
srcAddressGroups:
- string
srcFqdns:
- string
srcIpRanges:
- string
srcNetworkScope: string
srcNetworks:
- string
srcRegionCodes:
- string
srcThreatIntelligences:
- string
priority: 0
ruleName: string
securityProfileGroup: string
targetResources:
- string
targetServiceAccounts:
- string
tlsInspect: false
shortName: string
FirewallPolicyWithRules Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.
The FirewallPolicyWithRules resource accepts the following input properties:
- Parent string
- The parent of this FirewallPolicy in the Cloud Resource Hierarchy. Format: organizations/{organization_id} or folders/{folder_id}
- Rules
List<Firewall
Policy With Rules Rule> - A list of firewall policy rules. Structure is documented below.
- Short
Name string - A textual name of the security policy.
- Description string
- (Output) A description of the rule.
- Parent string
- The parent of this FirewallPolicy in the Cloud Resource Hierarchy. Format: organizations/{organization_id} or folders/{folder_id}
- Rules
[]Firewall
Policy With Rules Rule Args - A list of firewall policy rules. Structure is documented below.
- Short
Name string - A textual name of the security policy.
- Description string
- (Output) A description of the rule.
- parent String
- The parent of this FirewallPolicy in the Cloud Resource Hierarchy. Format: organizations/{organization_id} or folders/{folder_id}
- rules
List<Firewall
Policy With Rules Rule> - A list of firewall policy rules. Structure is documented below.
- short
Name String - A textual name of the security policy.
- description String
- (Output) A description of the rule.
- parent string
- The parent of this FirewallPolicy in the Cloud Resource Hierarchy. Format: organizations/{organization_id} or folders/{folder_id}
- rules
Firewall
Policy With Rules Rule[] - A list of firewall policy rules. Structure is documented below.
- short
Name string - A textual name of the security policy.
- description string
- (Output) A description of the rule.
- parent str
- The parent of this FirewallPolicy in the Cloud Resource Hierarchy. Format: organizations/{organization_id} or folders/{folder_id}
- rules
Sequence[Firewall
Policy With Rules Rule Args] - A list of firewall policy rules. Structure is documented below.
- short_
name str - A textual name of the security policy.
- description str
- (Output) A description of the rule.
- parent String
- The parent of this FirewallPolicy in the Cloud Resource Hierarchy. Format: organizations/{organization_id} or folders/{folder_id}
- rules List<Property Map>
- A list of firewall policy rules. Structure is documented below.
- short
Name String - A textual name of the security policy.
- description String
- (Output) A description of the rule.
Outputs
All input properties are implicitly available as output properties. Additionally, the FirewallPolicyWithRules resource produces the following output properties:
- Creation
Timestamp string - Creation timestamp in RFC3339 text format.
- Fingerprint string
- Fingerprint of the resource. This field is used internally during updates of this resource.
- Id string
- The provider-assigned unique ID for this managed resource.
- Policy
Id string - The unique identifier for the resource. This identifier is defined by the server.
- Predefined
Rules List<FirewallPolicy With Rules Predefined Rule> - A list of pre-define firewall policy rules. Structure is documented below.
- Rule
Tuple intCount - Total count of all firewall policy rule tuples. A firewall policy can not exceed a set number of tuples.
- Self
Link string - Server-defined URL for the resource.
- Self
Link stringWith Id - Server-defined URL for this resource with the resource id.
- Creation
Timestamp string - Creation timestamp in RFC3339 text format.
- Fingerprint string
- Fingerprint of the resource. This field is used internally during updates of this resource.
- Id string
- The provider-assigned unique ID for this managed resource.
- Policy
Id string - The unique identifier for the resource. This identifier is defined by the server.
- Predefined
Rules []FirewallPolicy With Rules Predefined Rule - A list of pre-define firewall policy rules. Structure is documented below.
- Rule
Tuple intCount - Total count of all firewall policy rule tuples. A firewall policy can not exceed a set number of tuples.
- Self
Link string - Server-defined URL for the resource.
- Self
Link stringWith Id - Server-defined URL for this resource with the resource id.
- creation
Timestamp String - Creation timestamp in RFC3339 text format.
- fingerprint String
- Fingerprint of the resource. This field is used internally during updates of this resource.
- id String
- The provider-assigned unique ID for this managed resource.
- policy
Id String - The unique identifier for the resource. This identifier is defined by the server.
- predefined
Rules List<FirewallPolicy With Rules Predefined Rule> - A list of pre-define firewall policy rules. Structure is documented below.
- rule
Tuple IntegerCount - Total count of all firewall policy rule tuples. A firewall policy can not exceed a set number of tuples.
- self
Link String - Server-defined URL for the resource.
- self
Link StringWith Id - Server-defined URL for this resource with the resource id.
- creation
Timestamp string - Creation timestamp in RFC3339 text format.
- fingerprint string
- Fingerprint of the resource. This field is used internally during updates of this resource.
- id string
- The provider-assigned unique ID for this managed resource.
- policy
Id string - The unique identifier for the resource. This identifier is defined by the server.
- predefined
Rules FirewallPolicy With Rules Predefined Rule[] - A list of pre-define firewall policy rules. Structure is documented below.
- rule
Tuple numberCount - Total count of all firewall policy rule tuples. A firewall policy can not exceed a set number of tuples.
- self
Link string - Server-defined URL for the resource.
- self
Link stringWith Id - Server-defined URL for this resource with the resource id.
- creation_
timestamp str - Creation timestamp in RFC3339 text format.
- fingerprint str
- Fingerprint of the resource. This field is used internally during updates of this resource.
- id str
- The provider-assigned unique ID for this managed resource.
- policy_
id str - The unique identifier for the resource. This identifier is defined by the server.
- predefined_
rules Sequence[FirewallPolicy With Rules Predefined Rule] - A list of pre-define firewall policy rules. Structure is documented below.
- rule_
tuple_ intcount - Total count of all firewall policy rule tuples. A firewall policy can not exceed a set number of tuples.
- self_
link str - Server-defined URL for the resource.
- self_
link_ strwith_ id - Server-defined URL for this resource with the resource id.
- creation
Timestamp String - Creation timestamp in RFC3339 text format.
- fingerprint String
- Fingerprint of the resource. This field is used internally during updates of this resource.
- id String
- The provider-assigned unique ID for this managed resource.
- policy
Id String - The unique identifier for the resource. This identifier is defined by the server.
- predefined
Rules List<Property Map> - A list of pre-define firewall policy rules. Structure is documented below.
- rule
Tuple NumberCount - Total count of all firewall policy rule tuples. A firewall policy can not exceed a set number of tuples.
- self
Link String - Server-defined URL for the resource.
- self
Link StringWith Id - Server-defined URL for this resource with the resource id.
Look up Existing FirewallPolicyWithRules Resource
Get an existing FirewallPolicyWithRules resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.
public static get(name: string, id: Input<ID>, state?: FirewallPolicyWithRulesState, opts?: CustomResourceOptions): FirewallPolicyWithRules@staticmethod
def get(resource_name: str,
id: str,
opts: Optional[ResourceOptions] = None,
creation_timestamp: Optional[str] = None,
description: Optional[str] = None,
fingerprint: Optional[str] = None,
parent: Optional[str] = None,
policy_id: Optional[str] = None,
predefined_rules: Optional[Sequence[FirewallPolicyWithRulesPredefinedRuleArgs]] = None,
rule_tuple_count: Optional[int] = None,
rules: Optional[Sequence[FirewallPolicyWithRulesRuleArgs]] = None,
self_link: Optional[str] = None,
self_link_with_id: Optional[str] = None,
short_name: Optional[str] = None) -> FirewallPolicyWithRulesfunc GetFirewallPolicyWithRules(ctx *Context, name string, id IDInput, state *FirewallPolicyWithRulesState, opts ...ResourceOption) (*FirewallPolicyWithRules, error)public static FirewallPolicyWithRules Get(string name, Input<string> id, FirewallPolicyWithRulesState? state, CustomResourceOptions? opts = null)public static FirewallPolicyWithRules get(String name, Output<String> id, FirewallPolicyWithRulesState state, CustomResourceOptions options)resources: _: type: gcp:compute:FirewallPolicyWithRules get: id: ${id}- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- resource_name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- Creation
Timestamp string - Creation timestamp in RFC3339 text format.
- Description string
- (Output) A description of the rule.
- Fingerprint string
- Fingerprint of the resource. This field is used internally during updates of this resource.
- Parent string
- The parent of this FirewallPolicy in the Cloud Resource Hierarchy. Format: organizations/{organization_id} or folders/{folder_id}
- Policy
Id string - The unique identifier for the resource. This identifier is defined by the server.
- Predefined
Rules List<FirewallPolicy With Rules Predefined Rule> - A list of pre-define firewall policy rules. Structure is documented below.
- Rule
Tuple intCount - Total count of all firewall policy rule tuples. A firewall policy can not exceed a set number of tuples.
- Rules
List<Firewall
Policy With Rules Rule> - A list of firewall policy rules. Structure is documented below.
- Self
Link string - Server-defined URL for the resource.
- Self
Link stringWith Id - Server-defined URL for this resource with the resource id.
- Short
Name string - A textual name of the security policy.
- Creation
Timestamp string - Creation timestamp in RFC3339 text format.
- Description string
- (Output) A description of the rule.
- Fingerprint string
- Fingerprint of the resource. This field is used internally during updates of this resource.
- Parent string
- The parent of this FirewallPolicy in the Cloud Resource Hierarchy. Format: organizations/{organization_id} or folders/{folder_id}
- Policy
Id string - The unique identifier for the resource. This identifier is defined by the server.
- Predefined
Rules []FirewallPolicy With Rules Predefined Rule Args - A list of pre-define firewall policy rules. Structure is documented below.
- Rule
Tuple intCount - Total count of all firewall policy rule tuples. A firewall policy can not exceed a set number of tuples.
- Rules
[]Firewall
Policy With Rules Rule Args - A list of firewall policy rules. Structure is documented below.
- Self
Link string - Server-defined URL for the resource.
- Self
Link stringWith Id - Server-defined URL for this resource with the resource id.
- Short
Name string - A textual name of the security policy.
- creation
Timestamp String - Creation timestamp in RFC3339 text format.
- description String
- (Output) A description of the rule.
- fingerprint String
- Fingerprint of the resource. This field is used internally during updates of this resource.
- parent String
- The parent of this FirewallPolicy in the Cloud Resource Hierarchy. Format: organizations/{organization_id} or folders/{folder_id}
- policy
Id String - The unique identifier for the resource. This identifier is defined by the server.
- predefined
Rules List<FirewallPolicy With Rules Predefined Rule> - A list of pre-define firewall policy rules. Structure is documented below.
- rule
Tuple IntegerCount - Total count of all firewall policy rule tuples. A firewall policy can not exceed a set number of tuples.
- rules
List<Firewall
Policy With Rules Rule> - A list of firewall policy rules. Structure is documented below.
- self
Link String - Server-defined URL for the resource.
- self
Link StringWith Id - Server-defined URL for this resource with the resource id.
- short
Name String - A textual name of the security policy.
- creation
Timestamp string - Creation timestamp in RFC3339 text format.
- description string
- (Output) A description of the rule.
- fingerprint string
- Fingerprint of the resource. This field is used internally during updates of this resource.
- parent string
- The parent of this FirewallPolicy in the Cloud Resource Hierarchy. Format: organizations/{organization_id} or folders/{folder_id}
- policy
Id string - The unique identifier for the resource. This identifier is defined by the server.
- predefined
Rules FirewallPolicy With Rules Predefined Rule[] - A list of pre-define firewall policy rules. Structure is documented below.
- rule
Tuple numberCount - Total count of all firewall policy rule tuples. A firewall policy can not exceed a set number of tuples.
- rules
Firewall
Policy With Rules Rule[] - A list of firewall policy rules. Structure is documented below.
- self
Link string - Server-defined URL for the resource.
- self
Link stringWith Id - Server-defined URL for this resource with the resource id.
- short
Name string - A textual name of the security policy.
- creation_
timestamp str - Creation timestamp in RFC3339 text format.
- description str
- (Output) A description of the rule.
- fingerprint str
- Fingerprint of the resource. This field is used internally during updates of this resource.
- parent str
- The parent of this FirewallPolicy in the Cloud Resource Hierarchy. Format: organizations/{organization_id} or folders/{folder_id}
- policy_
id str - The unique identifier for the resource. This identifier is defined by the server.
- predefined_
rules Sequence[FirewallPolicy With Rules Predefined Rule Args] - A list of pre-define firewall policy rules. Structure is documented below.
- rule_
tuple_ intcount - Total count of all firewall policy rule tuples. A firewall policy can not exceed a set number of tuples.
- rules
Sequence[Firewall
Policy With Rules Rule Args] - A list of firewall policy rules. Structure is documented below.
- self_
link str - Server-defined URL for the resource.
- self_
link_ strwith_ id - Server-defined URL for this resource with the resource id.
- short_
name str - A textual name of the security policy.
- creation
Timestamp String - Creation timestamp in RFC3339 text format.
- description String
- (Output) A description of the rule.
- fingerprint String
- Fingerprint of the resource. This field is used internally during updates of this resource.
- parent String
- The parent of this FirewallPolicy in the Cloud Resource Hierarchy. Format: organizations/{organization_id} or folders/{folder_id}
- policy
Id String - The unique identifier for the resource. This identifier is defined by the server.
- predefined
Rules List<Property Map> - A list of pre-define firewall policy rules. Structure is documented below.
- rule
Tuple NumberCount - Total count of all firewall policy rule tuples. A firewall policy can not exceed a set number of tuples.
- rules List<Property Map>
- A list of firewall policy rules. Structure is documented below.
- self
Link String - Server-defined URL for the resource.
- self
Link StringWith Id - Server-defined URL for this resource with the resource id.
- short
Name String - A textual name of the security policy.
Supporting Types
FirewallPolicyWithRulesPredefinedRule, FirewallPolicyWithRulesPredefinedRuleArgs
- Action string
- (Output) The Action to perform when the client connection triggers the rule. Can currently be either "allow", "deny", "apply_security_profile_group" or "goto_next".
- Description string
- (Output) A description of the rule.
- Direction string
- (Output) The direction in which this rule applies. If unspecified an INGRESS rule is created.
- Disabled bool
- (Output) Denotes whether the firewall policy rule is disabled. When set to true, the firewall policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the firewall policy rule will be enabled.
- Enable
Logging bool - (Output) Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver.
- Matches
List<Firewall
Policy With Rules Predefined Rule Match> - (Output) A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
- Priority int
- (Output) An integer indicating the priority of a rule in the list. The priority must be a value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
- Rule
Name string - (Output) An optional name for the rule. This field is not a unique identifier and can be updated.
- Security
Profile stringGroup - (Output) A fully-qualified URL of a SecurityProfile resource instance. Example: https://networksecurity.googleapis.com/v1/projects/{project}/locations/{location}/securityProfileGroups/my-security-profile-group Must be specified if action is 'apply_security_profile_group'.
- Target
Resources List<string> - (Output) A list of network resource URLs to which this rule applies. This field allows you to control which network's VMs get this rule. If this field is left blank, all VMs within the organization will receive the rule.
- Target
Service List<string>Accounts - (Output) A list of service accounts indicating the sets of instances that are applied with this rule.
- Tls
Inspect bool - (Output) Boolean flag indicating if the traffic should be TLS decrypted. It can be set only if action = 'apply_security_profile_group' and cannot be set for other actions.
- Action string
- (Output) The Action to perform when the client connection triggers the rule. Can currently be either "allow", "deny", "apply_security_profile_group" or "goto_next".
- Description string
- (Output) A description of the rule.
- Direction string
- (Output) The direction in which this rule applies. If unspecified an INGRESS rule is created.
- Disabled bool
- (Output) Denotes whether the firewall policy rule is disabled. When set to true, the firewall policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the firewall policy rule will be enabled.
- Enable
Logging bool - (Output) Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver.
- Matches
[]Firewall
Policy With Rules Predefined Rule Match - (Output) A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
- Priority int
- (Output) An integer indicating the priority of a rule in the list. The priority must be a value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
- Rule
Name string - (Output) An optional name for the rule. This field is not a unique identifier and can be updated.
- Security
Profile stringGroup - (Output) A fully-qualified URL of a SecurityProfile resource instance. Example: https://networksecurity.googleapis.com/v1/projects/{project}/locations/{location}/securityProfileGroups/my-security-profile-group Must be specified if action is 'apply_security_profile_group'.
- Target
Resources []string - (Output) A list of network resource URLs to which this rule applies. This field allows you to control which network's VMs get this rule. If this field is left blank, all VMs within the organization will receive the rule.
- Target
Service []stringAccounts - (Output) A list of service accounts indicating the sets of instances that are applied with this rule.
- Tls
Inspect bool - (Output) Boolean flag indicating if the traffic should be TLS decrypted. It can be set only if action = 'apply_security_profile_group' and cannot be set for other actions.
- action String
- (Output) The Action to perform when the client connection triggers the rule. Can currently be either "allow", "deny", "apply_security_profile_group" or "goto_next".
- description String
- (Output) A description of the rule.
- direction String
- (Output) The direction in which this rule applies. If unspecified an INGRESS rule is created.
- disabled Boolean
- (Output) Denotes whether the firewall policy rule is disabled. When set to true, the firewall policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the firewall policy rule will be enabled.
- enable
Logging Boolean - (Output) Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver.
- matches
List<Firewall
Policy With Rules Predefined Rule Match> - (Output) A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
- priority Integer
- (Output) An integer indicating the priority of a rule in the list. The priority must be a value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
- rule
Name String - (Output) An optional name for the rule. This field is not a unique identifier and can be updated.
- security
Profile StringGroup - (Output) A fully-qualified URL of a SecurityProfile resource instance. Example: https://networksecurity.googleapis.com/v1/projects/{project}/locations/{location}/securityProfileGroups/my-security-profile-group Must be specified if action is 'apply_security_profile_group'.
- target
Resources List<String> - (Output) A list of network resource URLs to which this rule applies. This field allows you to control which network's VMs get this rule. If this field is left blank, all VMs within the organization will receive the rule.
- target
Service List<String>Accounts - (Output) A list of service accounts indicating the sets of instances that are applied with this rule.
- tls
Inspect Boolean - (Output) Boolean flag indicating if the traffic should be TLS decrypted. It can be set only if action = 'apply_security_profile_group' and cannot be set for other actions.
- action string
- (Output) The Action to perform when the client connection triggers the rule. Can currently be either "allow", "deny", "apply_security_profile_group" or "goto_next".
- description string
- (Output) A description of the rule.
- direction string
- (Output) The direction in which this rule applies. If unspecified an INGRESS rule is created.
- disabled boolean
- (Output) Denotes whether the firewall policy rule is disabled. When set to true, the firewall policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the firewall policy rule will be enabled.
- enable
Logging boolean - (Output) Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver.
- matches
Firewall
Policy With Rules Predefined Rule Match[] - (Output) A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
- priority number
- (Output) An integer indicating the priority of a rule in the list. The priority must be a value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
- rule
Name string - (Output) An optional name for the rule. This field is not a unique identifier and can be updated.
- security
Profile stringGroup - (Output) A fully-qualified URL of a SecurityProfile resource instance. Example: https://networksecurity.googleapis.com/v1/projects/{project}/locations/{location}/securityProfileGroups/my-security-profile-group Must be specified if action is 'apply_security_profile_group'.
- target
Resources string[] - (Output) A list of network resource URLs to which this rule applies. This field allows you to control which network's VMs get this rule. If this field is left blank, all VMs within the organization will receive the rule.
- target
Service string[]Accounts - (Output) A list of service accounts indicating the sets of instances that are applied with this rule.
- tls
Inspect boolean - (Output) Boolean flag indicating if the traffic should be TLS decrypted. It can be set only if action = 'apply_security_profile_group' and cannot be set for other actions.
- action str
- (Output) The Action to perform when the client connection triggers the rule. Can currently be either "allow", "deny", "apply_security_profile_group" or "goto_next".
- description str
- (Output) A description of the rule.
- direction str
- (Output) The direction in which this rule applies. If unspecified an INGRESS rule is created.
- disabled bool
- (Output) Denotes whether the firewall policy rule is disabled. When set to true, the firewall policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the firewall policy rule will be enabled.
- enable_
logging bool - (Output) Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver.
- matches
Sequence[Firewall
Policy With Rules Predefined Rule Match] - (Output) A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
- priority int
- (Output) An integer indicating the priority of a rule in the list. The priority must be a value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
- rule_
name str - (Output) An optional name for the rule. This field is not a unique identifier and can be updated.
- security_
profile_ strgroup - (Output) A fully-qualified URL of a SecurityProfile resource instance. Example: https://networksecurity.googleapis.com/v1/projects/{project}/locations/{location}/securityProfileGroups/my-security-profile-group Must be specified if action is 'apply_security_profile_group'.
- target_
resources Sequence[str] - (Output) A list of network resource URLs to which this rule applies. This field allows you to control which network's VMs get this rule. If this field is left blank, all VMs within the organization will receive the rule.
- target_
service_ Sequence[str]accounts - (Output) A list of service accounts indicating the sets of instances that are applied with this rule.
- tls_
inspect bool - (Output) Boolean flag indicating if the traffic should be TLS decrypted. It can be set only if action = 'apply_security_profile_group' and cannot be set for other actions.
- action String
- (Output) The Action to perform when the client connection triggers the rule. Can currently be either "allow", "deny", "apply_security_profile_group" or "goto_next".
- description String
- (Output) A description of the rule.
- direction String
- (Output) The direction in which this rule applies. If unspecified an INGRESS rule is created.
- disabled Boolean
- (Output) Denotes whether the firewall policy rule is disabled. When set to true, the firewall policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the firewall policy rule will be enabled.
- enable
Logging Boolean - (Output) Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver.
- matches List<Property Map>
- (Output) A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
- priority Number
- (Output) An integer indicating the priority of a rule in the list. The priority must be a value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
- rule
Name String - (Output) An optional name for the rule. This field is not a unique identifier and can be updated.
- security
Profile StringGroup - (Output) A fully-qualified URL of a SecurityProfile resource instance. Example: https://networksecurity.googleapis.com/v1/projects/{project}/locations/{location}/securityProfileGroups/my-security-profile-group Must be specified if action is 'apply_security_profile_group'.
- target
Resources List<String> - (Output) A list of network resource URLs to which this rule applies. This field allows you to control which network's VMs get this rule. If this field is left blank, all VMs within the organization will receive the rule.
- target
Service List<String>Accounts - (Output) A list of service accounts indicating the sets of instances that are applied with this rule.
- tls
Inspect Boolean - (Output) Boolean flag indicating if the traffic should be TLS decrypted. It can be set only if action = 'apply_security_profile_group' and cannot be set for other actions.
FirewallPolicyWithRulesPredefinedRuleMatch, FirewallPolicyWithRulesPredefinedRuleMatchArgs
- Dest
Address List<string>Groups - Address groups which should be matched against the traffic destination. Maximum number of destination address groups is 10.
- Dest
Fqdns List<string> - Fully Qualified Domain Name (FQDN) which should be matched against traffic destination. Maximum number of destination fqdn allowed is 100.
- Dest
Ip List<string>Ranges - Destination IP address range in CIDR format. Required for EGRESS rules.
- Dest
Region List<string>Codes - Region codes whose IP addresses will be used to match for destination of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of destination region codes allowed is 5000.
- Dest
Threat List<string>Intelligences - Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic destination.
- Layer4Configs
List<Firewall
Policy With Rules Predefined Rule Match Layer4Config> Pairs of IP protocols and ports that the rule should match. Structure is documented below.
The
layer4_configblock supports:- Src
Address List<string>Groups - Address groups which should be matched against the traffic source. Maximum number of source address groups is 10.
- Src
Fqdns List<string> - Fully Qualified Domain Name (FQDN) which should be matched against traffic source. Maximum number of source fqdn allowed is 100.
- Src
Ip List<string>Ranges - Source IP address range in CIDR format. Required for INGRESS rules.
- Src
Region List<string>Codes - Region codes whose IP addresses will be used to match for source of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of source region codes allowed is 5000.
- Src
Threat List<string>Intelligences - Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic source.
- Dest
Address []stringGroups - Address groups which should be matched against the traffic destination. Maximum number of destination address groups is 10.
- Dest
Fqdns []string - Fully Qualified Domain Name (FQDN) which should be matched against traffic destination. Maximum number of destination fqdn allowed is 100.
- Dest
Ip []stringRanges - Destination IP address range in CIDR format. Required for EGRESS rules.
- Dest
Region []stringCodes - Region codes whose IP addresses will be used to match for destination of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of destination region codes allowed is 5000.
- Dest
Threat []stringIntelligences - Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic destination.
- Layer4Configs
[]Firewall
Policy With Rules Predefined Rule Match Layer4Config Pairs of IP protocols and ports that the rule should match. Structure is documented below.
The
layer4_configblock supports:- Src
Address []stringGroups - Address groups which should be matched against the traffic source. Maximum number of source address groups is 10.
- Src
Fqdns []string - Fully Qualified Domain Name (FQDN) which should be matched against traffic source. Maximum number of source fqdn allowed is 100.
- Src
Ip []stringRanges - Source IP address range in CIDR format. Required for INGRESS rules.
- Src
Region []stringCodes - Region codes whose IP addresses will be used to match for source of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of source region codes allowed is 5000.
- Src
Threat []stringIntelligences - Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic source.
- dest
Address List<String>Groups - Address groups which should be matched against the traffic destination. Maximum number of destination address groups is 10.
- dest
Fqdns List<String> - Fully Qualified Domain Name (FQDN) which should be matched against traffic destination. Maximum number of destination fqdn allowed is 100.
- dest
Ip List<String>Ranges - Destination IP address range in CIDR format. Required for EGRESS rules.
- dest
Region List<String>Codes - Region codes whose IP addresses will be used to match for destination of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of destination region codes allowed is 5000.
- dest
Threat List<String>Intelligences - Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic destination.
- layer4Configs
List<Firewall
Policy With Rules Predefined Rule Match Layer4Config> Pairs of IP protocols and ports that the rule should match. Structure is documented below.
The
layer4_configblock supports:- src
Address List<String>Groups - Address groups which should be matched against the traffic source. Maximum number of source address groups is 10.
- src
Fqdns List<String> - Fully Qualified Domain Name (FQDN) which should be matched against traffic source. Maximum number of source fqdn allowed is 100.
- src
Ip List<String>Ranges - Source IP address range in CIDR format. Required for INGRESS rules.
- src
Region List<String>Codes - Region codes whose IP addresses will be used to match for source of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of source region codes allowed is 5000.
- src
Threat List<String>Intelligences - Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic source.
- dest
Address string[]Groups - Address groups which should be matched against the traffic destination. Maximum number of destination address groups is 10.
- dest
Fqdns string[] - Fully Qualified Domain Name (FQDN) which should be matched against traffic destination. Maximum number of destination fqdn allowed is 100.
- dest
Ip string[]Ranges - Destination IP address range in CIDR format. Required for EGRESS rules.
- dest
Region string[]Codes - Region codes whose IP addresses will be used to match for destination of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of destination region codes allowed is 5000.
- dest
Threat string[]Intelligences - Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic destination.
- layer4Configs
Firewall
Policy With Rules Predefined Rule Match Layer4Config[] Pairs of IP protocols and ports that the rule should match. Structure is documented below.
The
layer4_configblock supports:- src
Address string[]Groups - Address groups which should be matched against the traffic source. Maximum number of source address groups is 10.
- src
Fqdns string[] - Fully Qualified Domain Name (FQDN) which should be matched against traffic source. Maximum number of source fqdn allowed is 100.
- src
Ip string[]Ranges - Source IP address range in CIDR format. Required for INGRESS rules.
- src
Region string[]Codes - Region codes whose IP addresses will be used to match for source of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of source region codes allowed is 5000.
- src
Threat string[]Intelligences - Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic source.
- dest_
address_ Sequence[str]groups - Address groups which should be matched against the traffic destination. Maximum number of destination address groups is 10.
- dest_
fqdns Sequence[str] - Fully Qualified Domain Name (FQDN) which should be matched against traffic destination. Maximum number of destination fqdn allowed is 100.
- dest_
ip_ Sequence[str]ranges - Destination IP address range in CIDR format. Required for EGRESS rules.
- dest_
region_ Sequence[str]codes - Region codes whose IP addresses will be used to match for destination of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of destination region codes allowed is 5000.
- dest_
threat_ Sequence[str]intelligences - Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic destination.
- layer4_
configs Sequence[FirewallPolicy With Rules Predefined Rule Match Layer4Config] Pairs of IP protocols and ports that the rule should match. Structure is documented below.
The
layer4_configblock supports:- src_
address_ Sequence[str]groups - Address groups which should be matched against the traffic source. Maximum number of source address groups is 10.
- src_
fqdns Sequence[str] - Fully Qualified Domain Name (FQDN) which should be matched against traffic source. Maximum number of source fqdn allowed is 100.
- src_
ip_ Sequence[str]ranges - Source IP address range in CIDR format. Required for INGRESS rules.
- src_
region_ Sequence[str]codes - Region codes whose IP addresses will be used to match for source of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of source region codes allowed is 5000.
- src_
threat_ Sequence[str]intelligences - Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic source.
- dest
Address List<String>Groups - Address groups which should be matched against the traffic destination. Maximum number of destination address groups is 10.
- dest
Fqdns List<String> - Fully Qualified Domain Name (FQDN) which should be matched against traffic destination. Maximum number of destination fqdn allowed is 100.
- dest
Ip List<String>Ranges - Destination IP address range in CIDR format. Required for EGRESS rules.
- dest
Region List<String>Codes - Region codes whose IP addresses will be used to match for destination of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of destination region codes allowed is 5000.
- dest
Threat List<String>Intelligences - Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic destination.
- layer4Configs List<Property Map>
Pairs of IP protocols and ports that the rule should match. Structure is documented below.
The
layer4_configblock supports:- src
Address List<String>Groups - Address groups which should be matched against the traffic source. Maximum number of source address groups is 10.
- src
Fqdns List<String> - Fully Qualified Domain Name (FQDN) which should be matched against traffic source. Maximum number of source fqdn allowed is 100.
- src
Ip List<String>Ranges - Source IP address range in CIDR format. Required for INGRESS rules.
- src
Region List<String>Codes - Region codes whose IP addresses will be used to match for source of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of source region codes allowed is 5000.
- src
Threat List<String>Intelligences - Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic source.
FirewallPolicyWithRulesPredefinedRuleMatchLayer4Config, FirewallPolicyWithRulesPredefinedRuleMatchLayer4ConfigArgs
- Ip
Protocol string - (Output) The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
- Ports List<string>
- (Output) An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].
- Ip
Protocol string - (Output) The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
- Ports []string
- (Output) An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].
- ip
Protocol String - (Output) The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
- ports List<String>
- (Output) An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].
- ip
Protocol string - (Output) The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
- ports string[]
- (Output) An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].
- ip_
protocol str - (Output) The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
- ports Sequence[str]
- (Output) An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].
- ip
Protocol String - (Output) The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
- ports List<String>
- (Output) An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].
FirewallPolicyWithRulesRule, FirewallPolicyWithRulesRuleArgs
- Action string
- The Action to perform when the client connection triggers the rule. Can currently be either "allow", "deny", "apply_security_profile_group" or "goto_next".
- Match
Firewall
Policy With Rules Rule Match - A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
- Priority int
- An integer indicating the priority of a rule in the list. The priority must be a value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
- Description string
- A description of the rule.
- Direction string
- The direction in which this rule applies. If unspecified an INGRESS rule is created.
Possible values are:
INGRESS,EGRESS. - Disabled bool
- Denotes whether the firewall policy rule is disabled. When set to true, the firewall policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the firewall policy rule will be enabled.
- Enable
Logging bool - Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver.
- Rule
Name string - An optional name for the rule. This field is not a unique identifier and can be updated.
- Security
Profile stringGroup - A fully-qualified URL of a SecurityProfile resource instance. Example: https://networksecurity.googleapis.com/v1/projects/{project}/locations/{location}/securityProfileGroups/my-security-profile-group Must be specified if action is 'apply_security_profile_group'.
- Target
Resources List<string> - A list of network resource URLs to which this rule applies. This field allows you to control which network's VMs get this rule. If this field is left blank, all VMs within the organization will receive the rule.
- Target
Service List<string>Accounts - A list of service accounts indicating the sets of instances that are applied with this rule.
- Tls
Inspect bool - Boolean flag indicating if the traffic should be TLS decrypted. It can be set only if action = 'apply_security_profile_group' and cannot be set for other actions.
- Action string
- The Action to perform when the client connection triggers the rule. Can currently be either "allow", "deny", "apply_security_profile_group" or "goto_next".
- Match
Firewall
Policy With Rules Rule Match - A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
- Priority int
- An integer indicating the priority of a rule in the list. The priority must be a value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
- Description string
- A description of the rule.
- Direction string
- The direction in which this rule applies. If unspecified an INGRESS rule is created.
Possible values are:
INGRESS,EGRESS. - Disabled bool
- Denotes whether the firewall policy rule is disabled. When set to true, the firewall policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the firewall policy rule will be enabled.
- Enable
Logging bool - Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver.
- Rule
Name string - An optional name for the rule. This field is not a unique identifier and can be updated.
- Security
Profile stringGroup - A fully-qualified URL of a SecurityProfile resource instance. Example: https://networksecurity.googleapis.com/v1/projects/{project}/locations/{location}/securityProfileGroups/my-security-profile-group Must be specified if action is 'apply_security_profile_group'.
- Target
Resources []string - A list of network resource URLs to which this rule applies. This field allows you to control which network's VMs get this rule. If this field is left blank, all VMs within the organization will receive the rule.
- Target
Service []stringAccounts - A list of service accounts indicating the sets of instances that are applied with this rule.
- Tls
Inspect bool - Boolean flag indicating if the traffic should be TLS decrypted. It can be set only if action = 'apply_security_profile_group' and cannot be set for other actions.
- action String
- The Action to perform when the client connection triggers the rule. Can currently be either "allow", "deny", "apply_security_profile_group" or "goto_next".
- match
Firewall
Policy With Rules Rule Match - A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
- priority Integer
- An integer indicating the priority of a rule in the list. The priority must be a value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
- description String
- A description of the rule.
- direction String
- The direction in which this rule applies. If unspecified an INGRESS rule is created.
Possible values are:
INGRESS,EGRESS. - disabled Boolean
- Denotes whether the firewall policy rule is disabled. When set to true, the firewall policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the firewall policy rule will be enabled.
- enable
Logging Boolean - Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver.
- rule
Name String - An optional name for the rule. This field is not a unique identifier and can be updated.
- security
Profile StringGroup - A fully-qualified URL of a SecurityProfile resource instance. Example: https://networksecurity.googleapis.com/v1/projects/{project}/locations/{location}/securityProfileGroups/my-security-profile-group Must be specified if action is 'apply_security_profile_group'.
- target
Resources List<String> - A list of network resource URLs to which this rule applies. This field allows you to control which network's VMs get this rule. If this field is left blank, all VMs within the organization will receive the rule.
- target
Service List<String>Accounts - A list of service accounts indicating the sets of instances that are applied with this rule.
- tls
Inspect Boolean - Boolean flag indicating if the traffic should be TLS decrypted. It can be set only if action = 'apply_security_profile_group' and cannot be set for other actions.
- action string
- The Action to perform when the client connection triggers the rule. Can currently be either "allow", "deny", "apply_security_profile_group" or "goto_next".
- match
Firewall
Policy With Rules Rule Match - A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
- priority number
- An integer indicating the priority of a rule in the list. The priority must be a value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
- description string
- A description of the rule.
- direction string
- The direction in which this rule applies. If unspecified an INGRESS rule is created.
Possible values are:
INGRESS,EGRESS. - disabled boolean
- Denotes whether the firewall policy rule is disabled. When set to true, the firewall policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the firewall policy rule will be enabled.
- enable
Logging boolean - Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver.
- rule
Name string - An optional name for the rule. This field is not a unique identifier and can be updated.
- security
Profile stringGroup - A fully-qualified URL of a SecurityProfile resource instance. Example: https://networksecurity.googleapis.com/v1/projects/{project}/locations/{location}/securityProfileGroups/my-security-profile-group Must be specified if action is 'apply_security_profile_group'.
- target
Resources string[] - A list of network resource URLs to which this rule applies. This field allows you to control which network's VMs get this rule. If this field is left blank, all VMs within the organization will receive the rule.
- target
Service string[]Accounts - A list of service accounts indicating the sets of instances that are applied with this rule.
- tls
Inspect boolean - Boolean flag indicating if the traffic should be TLS decrypted. It can be set only if action = 'apply_security_profile_group' and cannot be set for other actions.
- action str
- The Action to perform when the client connection triggers the rule. Can currently be either "allow", "deny", "apply_security_profile_group" or "goto_next".
- match
Firewall
Policy With Rules Rule Match - A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
- priority int
- An integer indicating the priority of a rule in the list. The priority must be a value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
- description str
- A description of the rule.
- direction str
- The direction in which this rule applies. If unspecified an INGRESS rule is created.
Possible values are:
INGRESS,EGRESS. - disabled bool
- Denotes whether the firewall policy rule is disabled. When set to true, the firewall policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the firewall policy rule will be enabled.
- enable_
logging bool - Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver.
- rule_
name str - An optional name for the rule. This field is not a unique identifier and can be updated.
- security_
profile_ strgroup - A fully-qualified URL of a SecurityProfile resource instance. Example: https://networksecurity.googleapis.com/v1/projects/{project}/locations/{location}/securityProfileGroups/my-security-profile-group Must be specified if action is 'apply_security_profile_group'.
- target_
resources Sequence[str] - A list of network resource URLs to which this rule applies. This field allows you to control which network's VMs get this rule. If this field is left blank, all VMs within the organization will receive the rule.
- target_
service_ Sequence[str]accounts - A list of service accounts indicating the sets of instances that are applied with this rule.
- tls_
inspect bool - Boolean flag indicating if the traffic should be TLS decrypted. It can be set only if action = 'apply_security_profile_group' and cannot be set for other actions.
- action String
- The Action to perform when the client connection triggers the rule. Can currently be either "allow", "deny", "apply_security_profile_group" or "goto_next".
- match Property Map
- A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
- priority Number
- An integer indicating the priority of a rule in the list. The priority must be a value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
- description String
- A description of the rule.
- direction String
- The direction in which this rule applies. If unspecified an INGRESS rule is created.
Possible values are:
INGRESS,EGRESS. - disabled Boolean
- Denotes whether the firewall policy rule is disabled. When set to true, the firewall policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the firewall policy rule will be enabled.
- enable
Logging Boolean - Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver.
- rule
Name String - An optional name for the rule. This field is not a unique identifier and can be updated.
- security
Profile StringGroup - A fully-qualified URL of a SecurityProfile resource instance. Example: https://networksecurity.googleapis.com/v1/projects/{project}/locations/{location}/securityProfileGroups/my-security-profile-group Must be specified if action is 'apply_security_profile_group'.
- target
Resources List<String> - A list of network resource URLs to which this rule applies. This field allows you to control which network's VMs get this rule. If this field is left blank, all VMs within the organization will receive the rule.
- target
Service List<String>Accounts - A list of service accounts indicating the sets of instances that are applied with this rule.
- tls
Inspect Boolean - Boolean flag indicating if the traffic should be TLS decrypted. It can be set only if action = 'apply_security_profile_group' and cannot be set for other actions.
FirewallPolicyWithRulesRuleMatch, FirewallPolicyWithRulesRuleMatchArgs
- Layer4Configs
List<Firewall
Policy With Rules Rule Match Layer4Config> Pairs of IP protocols and ports that the rule should match. Structure is documented below.
The
layer4_configblock supports:- Dest
Address List<string>Groups - Address groups which should be matched against the traffic destination. Maximum number of destination address groups is 10.
- Dest
Fqdns List<string> - Fully Qualified Domain Name (FQDN) which should be matched against traffic destination. Maximum number of destination fqdn allowed is 100.
- Dest
Ip List<string>Ranges - Destination IP address range in CIDR format. Required for EGRESS rules.
- Dest
Network stringScope - Network scope of the traffic destination.
Possible values are:
INTERNET,INTRA_VPC,NON_INTERNET,VPC_NETWORKS. - Dest
Region List<string>Codes - Region codes whose IP addresses will be used to match for destination of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of destination region codes allowed is 5000.
- Dest
Threat List<string>Intelligences - Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic destination.
- Src
Address List<string>Groups - Address groups which should be matched against the traffic source. Maximum number of source address groups is 10.
- Src
Fqdns List<string> - Fully Qualified Domain Name (FQDN) which should be matched against traffic source. Maximum number of source fqdn allowed is 100.
- Src
Ip List<string>Ranges - Source IP address range in CIDR format. Required for INGRESS rules.
- Src
Network stringScope - Network scope of the traffic source.
Possible values are:
INTERNET,INTRA_VPC,NON_INTERNET,VPC_NETWORKS. - Src
Networks List<string> - Networks of the traffic source. It can be either a full or partial url.
- Src
Region List<string>Codes - Region codes whose IP addresses will be used to match for source of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of source region codes allowed is 5000.
- Src
Threat List<string>Intelligences - Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic source.
- Layer4Configs
[]Firewall
Policy With Rules Rule Match Layer4Config Pairs of IP protocols and ports that the rule should match. Structure is documented below.
The
layer4_configblock supports:- Dest
Address []stringGroups - Address groups which should be matched against the traffic destination. Maximum number of destination address groups is 10.
- Dest
Fqdns []string - Fully Qualified Domain Name (FQDN) which should be matched against traffic destination. Maximum number of destination fqdn allowed is 100.
- Dest
Ip []stringRanges - Destination IP address range in CIDR format. Required for EGRESS rules.
- Dest
Network stringScope - Network scope of the traffic destination.
Possible values are:
INTERNET,INTRA_VPC,NON_INTERNET,VPC_NETWORKS. - Dest
Region []stringCodes - Region codes whose IP addresses will be used to match for destination of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of destination region codes allowed is 5000.
- Dest
Threat []stringIntelligences - Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic destination.
- Src
Address []stringGroups - Address groups which should be matched against the traffic source. Maximum number of source address groups is 10.
- Src
Fqdns []string - Fully Qualified Domain Name (FQDN) which should be matched against traffic source. Maximum number of source fqdn allowed is 100.
- Src
Ip []stringRanges - Source IP address range in CIDR format. Required for INGRESS rules.
- Src
Network stringScope - Network scope of the traffic source.
Possible values are:
INTERNET,INTRA_VPC,NON_INTERNET,VPC_NETWORKS. - Src
Networks []string - Networks of the traffic source. It can be either a full or partial url.
- Src
Region []stringCodes - Region codes whose IP addresses will be used to match for source of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of source region codes allowed is 5000.
- Src
Threat []stringIntelligences - Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic source.
- layer4Configs
List<Firewall
Policy With Rules Rule Match Layer4Config> Pairs of IP protocols and ports that the rule should match. Structure is documented below.
The
layer4_configblock supports:- dest
Address List<String>Groups - Address groups which should be matched against the traffic destination. Maximum number of destination address groups is 10.
- dest
Fqdns List<String> - Fully Qualified Domain Name (FQDN) which should be matched against traffic destination. Maximum number of destination fqdn allowed is 100.
- dest
Ip List<String>Ranges - Destination IP address range in CIDR format. Required for EGRESS rules.
- dest
Network StringScope - Network scope of the traffic destination.
Possible values are:
INTERNET,INTRA_VPC,NON_INTERNET,VPC_NETWORKS. - dest
Region List<String>Codes - Region codes whose IP addresses will be used to match for destination of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of destination region codes allowed is 5000.
- dest
Threat List<String>Intelligences - Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic destination.
- src
Address List<String>Groups - Address groups which should be matched against the traffic source. Maximum number of source address groups is 10.
- src
Fqdns List<String> - Fully Qualified Domain Name (FQDN) which should be matched against traffic source. Maximum number of source fqdn allowed is 100.
- src
Ip List<String>Ranges - Source IP address range in CIDR format. Required for INGRESS rules.
- src
Network StringScope - Network scope of the traffic source.
Possible values are:
INTERNET,INTRA_VPC,NON_INTERNET,VPC_NETWORKS. - src
Networks List<String> - Networks of the traffic source. It can be either a full or partial url.
- src
Region List<String>Codes - Region codes whose IP addresses will be used to match for source of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of source region codes allowed is 5000.
- src
Threat List<String>Intelligences - Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic source.
- layer4Configs
Firewall
Policy With Rules Rule Match Layer4Config[] Pairs of IP protocols and ports that the rule should match. Structure is documented below.
The
layer4_configblock supports:- dest
Address string[]Groups - Address groups which should be matched against the traffic destination. Maximum number of destination address groups is 10.
- dest
Fqdns string[] - Fully Qualified Domain Name (FQDN) which should be matched against traffic destination. Maximum number of destination fqdn allowed is 100.
- dest
Ip string[]Ranges - Destination IP address range in CIDR format. Required for EGRESS rules.
- dest
Network stringScope - Network scope of the traffic destination.
Possible values are:
INTERNET,INTRA_VPC,NON_INTERNET,VPC_NETWORKS. - dest
Region string[]Codes - Region codes whose IP addresses will be used to match for destination of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of destination region codes allowed is 5000.
- dest
Threat string[]Intelligences - Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic destination.
- src
Address string[]Groups - Address groups which should be matched against the traffic source. Maximum number of source address groups is 10.
- src
Fqdns string[] - Fully Qualified Domain Name (FQDN) which should be matched against traffic source. Maximum number of source fqdn allowed is 100.
- src
Ip string[]Ranges - Source IP address range in CIDR format. Required for INGRESS rules.
- src
Network stringScope - Network scope of the traffic source.
Possible values are:
INTERNET,INTRA_VPC,NON_INTERNET,VPC_NETWORKS. - src
Networks string[] - Networks of the traffic source. It can be either a full or partial url.
- src
Region string[]Codes - Region codes whose IP addresses will be used to match for source of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of source region codes allowed is 5000.
- src
Threat string[]Intelligences - Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic source.
- layer4_
configs Sequence[FirewallPolicy With Rules Rule Match Layer4Config] Pairs of IP protocols and ports that the rule should match. Structure is documented below.
The
layer4_configblock supports:- dest_
address_ Sequence[str]groups - Address groups which should be matched against the traffic destination. Maximum number of destination address groups is 10.
- dest_
fqdns Sequence[str] - Fully Qualified Domain Name (FQDN) which should be matched against traffic destination. Maximum number of destination fqdn allowed is 100.
- dest_
ip_ Sequence[str]ranges - Destination IP address range in CIDR format. Required for EGRESS rules.
- dest_
network_ strscope - Network scope of the traffic destination.
Possible values are:
INTERNET,INTRA_VPC,NON_INTERNET,VPC_NETWORKS. - dest_
region_ Sequence[str]codes - Region codes whose IP addresses will be used to match for destination of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of destination region codes allowed is 5000.
- dest_
threat_ Sequence[str]intelligences - Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic destination.
- src_
address_ Sequence[str]groups - Address groups which should be matched against the traffic source. Maximum number of source address groups is 10.
- src_
fqdns Sequence[str] - Fully Qualified Domain Name (FQDN) which should be matched against traffic source. Maximum number of source fqdn allowed is 100.
- src_
ip_ Sequence[str]ranges - Source IP address range in CIDR format. Required for INGRESS rules.
- src_
network_ strscope - Network scope of the traffic source.
Possible values are:
INTERNET,INTRA_VPC,NON_INTERNET,VPC_NETWORKS. - src_
networks Sequence[str] - Networks of the traffic source. It can be either a full or partial url.
- src_
region_ Sequence[str]codes - Region codes whose IP addresses will be used to match for source of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of source region codes allowed is 5000.
- src_
threat_ Sequence[str]intelligences - Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic source.
- layer4Configs List<Property Map>
Pairs of IP protocols and ports that the rule should match. Structure is documented below.
The
layer4_configblock supports:- dest
Address List<String>Groups - Address groups which should be matched against the traffic destination. Maximum number of destination address groups is 10.
- dest
Fqdns List<String> - Fully Qualified Domain Name (FQDN) which should be matched against traffic destination. Maximum number of destination fqdn allowed is 100.
- dest
Ip List<String>Ranges - Destination IP address range in CIDR format. Required for EGRESS rules.
- dest
Network StringScope - Network scope of the traffic destination.
Possible values are:
INTERNET,INTRA_VPC,NON_INTERNET,VPC_NETWORKS. - dest
Region List<String>Codes - Region codes whose IP addresses will be used to match for destination of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of destination region codes allowed is 5000.
- dest
Threat List<String>Intelligences - Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic destination.
- src
Address List<String>Groups - Address groups which should be matched against the traffic source. Maximum number of source address groups is 10.
- src
Fqdns List<String> - Fully Qualified Domain Name (FQDN) which should be matched against traffic source. Maximum number of source fqdn allowed is 100.
- src
Ip List<String>Ranges - Source IP address range in CIDR format. Required for INGRESS rules.
- src
Network StringScope - Network scope of the traffic source.
Possible values are:
INTERNET,INTRA_VPC,NON_INTERNET,VPC_NETWORKS. - src
Networks List<String> - Networks of the traffic source. It can be either a full or partial url.
- src
Region List<String>Codes - Region codes whose IP addresses will be used to match for source of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of source region codes allowed is 5000.
- src
Threat List<String>Intelligences - Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic source.
FirewallPolicyWithRulesRuleMatchLayer4Config, FirewallPolicyWithRulesRuleMatchLayer4ConfigArgs
- Ip
Protocol string - (Output) The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
- Ports List<string>
- (Output) An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].
- Ip
Protocol string - (Output) The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
- Ports []string
- (Output) An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].
- ip
Protocol String - (Output) The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
- ports List<String>
- (Output) An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].
- ip
Protocol string - (Output) The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
- ports string[]
- (Output) An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].
- ip_
protocol str - (Output) The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
- ports Sequence[str]
- (Output) An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].
- ip
Protocol String - (Output) The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
- ports List<String>
- (Output) An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].
Import
FirewallPolicyWithRules can be imported using any of these accepted formats:
locations/global/firewallPolicies/{{policy_id}}{{policy_id}}
When using the pulumi import command, FirewallPolicyWithRules can be imported using one of the formats above. For example:
$ pulumi import gcp:compute/firewallPolicyWithRules:FirewallPolicyWithRules default locations/global/firewallPolicies/{{policy_id}}
$ pulumi import gcp:compute/firewallPolicyWithRules:FirewallPolicyWithRules default {{policy_id}}
To learn more about importing existing cloud resources, see Importing resources.
Package Details
- Repository
- Google Cloud (GCP) Classic pulumi/pulumi-gcp
- License
- Apache-2.0
- Notes
- This Pulumi package is based on the
google-betaTerraform Provider.