com.pulumi.gcp.accesscontextmanager.kotlin.ServicePerimeterEgressPolicyArgs.kt Maven / Gradle / Ivy
Go to download
Show more of this group Show more artifacts with this name
Show all versions of pulumi-gcp-kotlin Show documentation
Show all versions of pulumi-gcp-kotlin Show documentation
Build cloud applications and infrastructure by combining the safety and reliability of infrastructure as code with the power of the Kotlin programming language.
@file:Suppress("NAME_SHADOWING", "DEPRECATION")
package com.pulumi.gcp.accesscontextmanager.kotlin
import com.pulumi.core.Output
import com.pulumi.core.Output.of
import com.pulumi.gcp.accesscontextmanager.ServicePerimeterEgressPolicyArgs.builder
import com.pulumi.gcp.accesscontextmanager.kotlin.inputs.ServicePerimeterEgressPolicyEgressFromArgs
import com.pulumi.gcp.accesscontextmanager.kotlin.inputs.ServicePerimeterEgressPolicyEgressFromArgsBuilder
import com.pulumi.gcp.accesscontextmanager.kotlin.inputs.ServicePerimeterEgressPolicyEgressToArgs
import com.pulumi.gcp.accesscontextmanager.kotlin.inputs.ServicePerimeterEgressPolicyEgressToArgsBuilder
import com.pulumi.kotlin.ConvertibleToJava
import com.pulumi.kotlin.PulumiTagMarker
import com.pulumi.kotlin.applySuspend
import kotlin.String
import kotlin.Suppress
import kotlin.Unit
import kotlin.jvm.JvmName
/**
* EgressPolicies match requests based on egressFrom and egressTo stanzas.
* For an EgressPolicy to match, both egressFrom and egressTo stanzas must be matched.
* If an EgressPolicy matches a request, the request is allowed to span the ServicePerimeter
* boundary. For example, an EgressPolicy can be used to allow VMs on networks
* within the ServicePerimeter to access a defined set of projects outside the
* perimeter in certain contexts (e.g. to read data from a Cloud Storage bucket
* or query against a BigQuery dataset).
* > **Note:** By default, updates to this resource will remove the EgressPolicy from the
* from the perimeter and add it back in a non-atomic manner. To ensure that the new EgressPolicy
* is added before the old one is removed, add a `lifecycle` block with `create_before_destroy = true` to this resource.
* To get more information about ServicePerimeterEgressPolicy, see:
* * [API documentation](https://cloud.google.com/access-context-manager/docs/reference/rest/v1/accessPolicies.servicePerimeters#egresspolicy)
* ## Example Usage
* ### Access Context Manager Service Perimeter Egress Policy
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as gcp from "@pulumi/gcp";
* const access_policy = new gcp.accesscontextmanager.AccessPolicy("access-policy", {
* parent: "organizations/123456789",
* title: "Storage Policy",
* });
* const storage_perimeter = new gcp.accesscontextmanager.ServicePerimeter("storage-perimeter", {
* parent: pulumi.interpolate`accesspolicies/${access_policy.name}`,
* name: pulumi.interpolate`accesspolicies/${access_policy.name}/serviceperimeters/storage-perimeter`,
* title: "Storage Perimeter",
* status: {
* restrictedServices: ["storage.googleapis.com"],
* },
* });
* const egressPolicy = new gcp.accesscontextmanager.ServicePerimeterEgressPolicy("egress_policy", {
* perimeter: storage_perimeter.name,
* egressFrom: {
* identityType: "ANY_IDENTITY",
* },
* egressTo: {
* resources: ["*"],
* operations: [{
* serviceName: "bigquery.googleapis.com",
* methodSelectors: [{
* method: "*",
* }],
* }],
* },
* });
* ```
* ```python
* import pulumi
* import pulumi_gcp as gcp
* access_policy = gcp.accesscontextmanager.AccessPolicy("access-policy",
* parent="organizations/123456789",
* title="Storage Policy")
* storage_perimeter = gcp.accesscontextmanager.ServicePerimeter("storage-perimeter",
* parent=access_policy.name.apply(lambda name: f"accesspolicies/{name}"),
* name=access_policy.name.apply(lambda name: f"accesspolicies/{name}/serviceperimeters/storage-perimeter"),
* title="Storage Perimeter",
* status=gcp.accesscontextmanager.ServicePerimeterStatusArgs(
* restricted_services=["storage.googleapis.com"],
* ))
* egress_policy = gcp.accesscontextmanager.ServicePerimeterEgressPolicy("egress_policy",
* perimeter=storage_perimeter.name,
* egress_from=gcp.accesscontextmanager.ServicePerimeterEgressPolicyEgressFromArgs(
* identity_type="ANY_IDENTITY",
* ),
* egress_to=gcp.accesscontextmanager.ServicePerimeterEgressPolicyEgressToArgs(
* resources=["*"],
* operations=[gcp.accesscontextmanager.ServicePerimeterEgressPolicyEgressToOperationArgs(
* service_name="bigquery.googleapis.com",
* method_selectors=[gcp.accesscontextmanager.ServicePerimeterEgressPolicyEgressToOperationMethodSelectorArgs(
* method="*",
* )],
* )],
* ))
* ```
* ```csharp
* using System.Collections.Generic;
* using System.Linq;
* using Pulumi;
* using Gcp = Pulumi.Gcp;
* return await Deployment.RunAsync(() =>
* {
* var access_policy = new Gcp.AccessContextManager.AccessPolicy("access-policy", new()
* {
* Parent = "organizations/123456789",
* Title = "Storage Policy",
* });
* var storage_perimeter = new Gcp.AccessContextManager.ServicePerimeter("storage-perimeter", new()
* {
* Parent = access_policy.Name.Apply(name => $"accesspolicies/{name}"),
* Name = access_policy.Name.Apply(name => $"accesspolicies/{name}/serviceperimeters/storage-perimeter"),
* Title = "Storage Perimeter",
* Status = new Gcp.AccessContextManager.Inputs.ServicePerimeterStatusArgs
* {
* RestrictedServices = new[]
* {
* "storage.googleapis.com",
* },
* },
* });
* var egressPolicy = new Gcp.AccessContextManager.ServicePerimeterEgressPolicy("egress_policy", new()
* {
* Perimeter = storage_perimeter.Name,
* EgressFrom = new Gcp.AccessContextManager.Inputs.ServicePerimeterEgressPolicyEgressFromArgs
* {
* IdentityType = "ANY_IDENTITY",
* },
* EgressTo = new Gcp.AccessContextManager.Inputs.ServicePerimeterEgressPolicyEgressToArgs
* {
* Resources = new[]
* {
* "*",
* },
* Operations = new[]
* {
* new Gcp.AccessContextManager.Inputs.ServicePerimeterEgressPolicyEgressToOperationArgs
* {
* ServiceName = "bigquery.googleapis.com",
* MethodSelectors = new[]
* {
* new Gcp.AccessContextManager.Inputs.ServicePerimeterEgressPolicyEgressToOperationMethodSelectorArgs
* {
* Method = "*",
* },
* },
* },
* },
* },
* });
* });
* ```
* ```go
* package main
* import (
* "fmt"
* "github.com/pulumi/pulumi-gcp/sdk/v7/go/gcp/accesscontextmanager"
* "github.com/pulumi/pulumi/sdk/v3/go/pulumi"
* )
* func main() {
* pulumi.Run(func(ctx *pulumi.Context) error {
* _, err := accesscontextmanager.NewAccessPolicy(ctx, "access-policy", &accesscontextmanager.AccessPolicyArgs{
* Parent: pulumi.String("organizations/123456789"),
* Title: pulumi.String("Storage Policy"),
* })
* if err != nil {
* return err
* }
* _, err = accesscontextmanager.NewServicePerimeter(ctx, "storage-perimeter", &accesscontextmanager.ServicePerimeterArgs{
* Parent: access_policy.Name.ApplyT(func(name string) (string, error) {
* return fmt.Sprintf("accesspolicies/%v", name), nil
* }).(pulumi.StringOutput),
* Name: access_policy.Name.ApplyT(func(name string) (string, error) {
* return fmt.Sprintf("accesspolicies/%v/serviceperimeters/storage-perimeter", name), nil
* }).(pulumi.StringOutput),
* Title: pulumi.String("Storage Perimeter"),
* Status: &accesscontextmanager.ServicePerimeterStatusArgs{
* RestrictedServices: pulumi.StringArray{
* pulumi.String("storage.googleapis.com"),
* },
* },
* })
* if err != nil {
* return err
* }
* _, err = accesscontextmanager.NewServicePerimeterEgressPolicy(ctx, "egress_policy", &accesscontextmanager.ServicePerimeterEgressPolicyArgs{
* Perimeter: storage_perimeter.Name,
* EgressFrom: &accesscontextmanager.ServicePerimeterEgressPolicyEgressFromArgs{
* IdentityType: pulumi.String("ANY_IDENTITY"),
* },
* EgressTo: &accesscontextmanager.ServicePerimeterEgressPolicyEgressToArgs{
* Resources: pulumi.StringArray{
* pulumi.String("*"),
* },
* Operations: accesscontextmanager.ServicePerimeterEgressPolicyEgressToOperationArray{
* &accesscontextmanager.ServicePerimeterEgressPolicyEgressToOperationArgs{
* ServiceName: pulumi.String("bigquery.googleapis.com"),
* MethodSelectors: accesscontextmanager.ServicePerimeterEgressPolicyEgressToOperationMethodSelectorArray{
* &accesscontextmanager.ServicePerimeterEgressPolicyEgressToOperationMethodSelectorArgs{
* Method: pulumi.String("*"),
* },
* },
* },
* },
* },
* })
* if err != nil {
* return err
* }
* return nil
* })
* }
* ```
* ```java
* package generated_program;
* import com.pulumi.Context;
* import com.pulumi.Pulumi;
* import com.pulumi.core.Output;
* import com.pulumi.gcp.accesscontextmanager.AccessPolicy;
* import com.pulumi.gcp.accesscontextmanager.AccessPolicyArgs;
* import com.pulumi.gcp.accesscontextmanager.ServicePerimeter;
* import com.pulumi.gcp.accesscontextmanager.ServicePerimeterArgs;
* import com.pulumi.gcp.accesscontextmanager.inputs.ServicePerimeterStatusArgs;
* import com.pulumi.gcp.accesscontextmanager.ServicePerimeterEgressPolicy;
* import com.pulumi.gcp.accesscontextmanager.ServicePerimeterEgressPolicyArgs;
* import com.pulumi.gcp.accesscontextmanager.inputs.ServicePerimeterEgressPolicyEgressFromArgs;
* import com.pulumi.gcp.accesscontextmanager.inputs.ServicePerimeterEgressPolicyEgressToArgs;
* import java.util.List;
* import java.util.ArrayList;
* import java.util.Map;
* import java.io.File;
* import java.nio.file.Files;
* import java.nio.file.Paths;
* public class App {
* public static void main(String[] args) {
* Pulumi.run(App::stack);
* }
* public static void stack(Context ctx) {
* var access_policy = new AccessPolicy("access-policy", AccessPolicyArgs.builder()
* .parent("organizations/123456789")
* .title("Storage Policy")
* .build());
* var storage_perimeter = new ServicePerimeter("storage-perimeter", ServicePerimeterArgs.builder()
* .parent(access_policy.name().applyValue(name -> String.format("accesspolicies/%s", name)))
* .name(access_policy.name().applyValue(name -> String.format("accesspolicies/%s/serviceperimeters/storage-perimeter", name)))
* .title("Storage Perimeter")
* .status(ServicePerimeterStatusArgs.builder()
* .restrictedServices("storage.googleapis.com")
* .build())
* .build());
* var egressPolicy = new ServicePerimeterEgressPolicy("egressPolicy", ServicePerimeterEgressPolicyArgs.builder()
* .perimeter(storage_perimeter.name())
* .egressFrom(ServicePerimeterEgressPolicyEgressFromArgs.builder()
* .identityType("ANY_IDENTITY")
* .build())
* .egressTo(ServicePerimeterEgressPolicyEgressToArgs.builder()
* .resources("*")
* .operations(ServicePerimeterEgressPolicyEgressToOperationArgs.builder()
* .serviceName("bigquery.googleapis.com")
* .methodSelectors(ServicePerimeterEgressPolicyEgressToOperationMethodSelectorArgs.builder()
* .method("*")
* .build())
* .build())
* .build())
* .build());
* }
* }
* ```
* ```yaml
* resources:
* storage-perimeter:
* type: gcp:accesscontextmanager:ServicePerimeter
* properties:
* parent: accesspolicies/${["access-policy"].name}
* name: accesspolicies/${["access-policy"].name}/serviceperimeters/storage-perimeter
* title: Storage Perimeter
* status:
* restrictedServices:
* - storage.googleapis.com
* egressPolicy:
* type: gcp:accesscontextmanager:ServicePerimeterEgressPolicy
* name: egress_policy
* properties:
* perimeter: ${["storage-perimeter"].name}
* egressFrom:
* identityType: ANY_IDENTITY
* egressTo:
* resources:
* - '*'
* operations:
* - serviceName: bigquery.googleapis.com
* methodSelectors:
* - method: '*'
* access-policy:
* type: gcp:accesscontextmanager:AccessPolicy
* properties:
* parent: organizations/123456789
* title: Storage Policy
* ```
*
* ## Import
* ServicePerimeterEgressPolicy can be imported using any of these accepted formats:
* * `{{perimeter}}`
* When using the `pulumi import` command, ServicePerimeterEgressPolicy can be imported using one of the formats above. For example:
* ```sh
* $ pulumi import gcp:accesscontextmanager/servicePerimeterEgressPolicy:ServicePerimeterEgressPolicy default {{perimeter}}
* ```
* @property egressFrom Defines conditions on the source of a request causing this `EgressPolicy` to apply.
* Structure is documented below.
* @property egressTo Defines the conditions on the `ApiOperation` and destination resources that
* cause this `EgressPolicy` to apply.
* Structure is documented below.
* @property perimeter The name of the Service Perimeter to add this resource to.
* - - -
*/
public data class ServicePerimeterEgressPolicyArgs(
public val egressFrom: Output? = null,
public val egressTo: Output? = null,
public val perimeter: Output? = null,
) : ConvertibleToJava {
override fun toJava(): com.pulumi.gcp.accesscontextmanager.ServicePerimeterEgressPolicyArgs =
com.pulumi.gcp.accesscontextmanager.ServicePerimeterEgressPolicyArgs.builder()
.egressFrom(egressFrom?.applyValue({ args0 -> args0.let({ args0 -> args0.toJava() }) }))
.egressTo(egressTo?.applyValue({ args0 -> args0.let({ args0 -> args0.toJava() }) }))
.perimeter(perimeter?.applyValue({ args0 -> args0 })).build()
}
/**
* Builder for [ServicePerimeterEgressPolicyArgs].
*/
@PulumiTagMarker
public class ServicePerimeterEgressPolicyArgsBuilder internal constructor() {
private var egressFrom: Output? = null
private var egressTo: Output? = null
private var perimeter: Output? = null
/**
* @param value Defines conditions on the source of a request causing this `EgressPolicy` to apply.
* Structure is documented below.
*/
@JvmName("cuicpabvocypgyns")
public suspend fun egressFrom(`value`: Output) {
this.egressFrom = value
}
/**
* @param value Defines the conditions on the `ApiOperation` and destination resources that
* cause this `EgressPolicy` to apply.
* Structure is documented below.
*/
@JvmName("ifewhudpxyungjya")
public suspend fun egressTo(`value`: Output) {
this.egressTo = value
}
/**
* @param value The name of the Service Perimeter to add this resource to.
* - - -
*/
@JvmName("xibexnlermrvqfru")
public suspend fun perimeter(`value`: Output) {
this.perimeter = value
}
/**
* @param value Defines conditions on the source of a request causing this `EgressPolicy` to apply.
* Structure is documented below.
*/
@JvmName("dadjewwlvroypryv")
public suspend fun egressFrom(`value`: ServicePerimeterEgressPolicyEgressFromArgs?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.egressFrom = mapped
}
/**
* @param argument Defines conditions on the source of a request causing this `EgressPolicy` to apply.
* Structure is documented below.
*/
@JvmName("krbivjdruvmrakrx")
public suspend fun egressFrom(argument: suspend ServicePerimeterEgressPolicyEgressFromArgsBuilder.() -> Unit) {
val toBeMapped = ServicePerimeterEgressPolicyEgressFromArgsBuilder().applySuspend {
argument()
}.build()
val mapped = of(toBeMapped)
this.egressFrom = mapped
}
/**
* @param value Defines the conditions on the `ApiOperation` and destination resources that
* cause this `EgressPolicy` to apply.
* Structure is documented below.
*/
@JvmName("lotdvaxvvirdbpyq")
public suspend fun egressTo(`value`: ServicePerimeterEgressPolicyEgressToArgs?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.egressTo = mapped
}
/**
* @param argument Defines the conditions on the `ApiOperation` and destination resources that
* cause this `EgressPolicy` to apply.
* Structure is documented below.
*/
@JvmName("oqoxmbpftrduvxvk")
public suspend fun egressTo(argument: suspend ServicePerimeterEgressPolicyEgressToArgsBuilder.() -> Unit) {
val toBeMapped = ServicePerimeterEgressPolicyEgressToArgsBuilder().applySuspend {
argument()
}.build()
val mapped = of(toBeMapped)
this.egressTo = mapped
}
/**
* @param value The name of the Service Perimeter to add this resource to.
* - - -
*/
@JvmName("pjlguhplolskfcdg")
public suspend fun perimeter(`value`: String?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.perimeter = mapped
}
internal fun build(): ServicePerimeterEgressPolicyArgs = ServicePerimeterEgressPolicyArgs(
egressFrom = egressFrom,
egressTo = egressTo,
perimeter = perimeter,
)
}
© 2015 - 2024 Weber Informatics LLC | Privacy Policy