com.pulumi.gcp.accesscontextmanager.kotlin.ServicePerimeterIngressPolicyArgs.kt Maven / Gradle / Ivy
Go to download
Show more of this group Show more artifacts with this name
Show all versions of pulumi-gcp-kotlin Show documentation
Show all versions of pulumi-gcp-kotlin Show documentation
Build cloud applications and infrastructure by combining the safety and reliability of infrastructure as code with the power of the Kotlin programming language.
@file:Suppress("NAME_SHADOWING", "DEPRECATION")
package com.pulumi.gcp.accesscontextmanager.kotlin
import com.pulumi.core.Output
import com.pulumi.core.Output.of
import com.pulumi.gcp.accesscontextmanager.ServicePerimeterIngressPolicyArgs.builder
import com.pulumi.gcp.accesscontextmanager.kotlin.inputs.ServicePerimeterIngressPolicyIngressFromArgs
import com.pulumi.gcp.accesscontextmanager.kotlin.inputs.ServicePerimeterIngressPolicyIngressFromArgsBuilder
import com.pulumi.gcp.accesscontextmanager.kotlin.inputs.ServicePerimeterIngressPolicyIngressToArgs
import com.pulumi.gcp.accesscontextmanager.kotlin.inputs.ServicePerimeterIngressPolicyIngressToArgsBuilder
import com.pulumi.kotlin.ConvertibleToJava
import com.pulumi.kotlin.PulumiTagMarker
import com.pulumi.kotlin.applySuspend
import kotlin.String
import kotlin.Suppress
import kotlin.Unit
import kotlin.jvm.JvmName
/**
* IngressPolicies match requests based on ingressFrom and ingressTo stanzas. For an ingress policy to match,
* both the ingressFrom and ingressTo stanzas must be matched. If an IngressPolicy matches a request,
* the request is allowed through the perimeter boundary from outside the perimeter.
* For example, access from the internet can be allowed either based on an AccessLevel or,
* for traffic hosted on Google Cloud, the project of the source network.
* For access from private networks, using the project of the hosting network is required.
* Individual ingress policies can be limited by restricting which services and/
* or actions they match using the ingressTo field.
* > **Note:** By default, updates to this resource will remove the IngressPolicy from the
* from the perimeter and add it back in a non-atomic manner. To ensure that the new IngressPolicy
* is added before the old one is removed, add a `lifecycle` block with `create_before_destroy = true` to this resource.
* To get more information about ServicePerimeterIngressPolicy, see:
* * [API documentation](https://cloud.google.com/access-context-manager/docs/reference/rest/v1/accessPolicies.servicePerimeters#ingresspolicy)
* ## Example Usage
* ### Access Context Manager Service Perimeter Ingress Policy
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as gcp from "@pulumi/gcp";
* const access_policy = new gcp.accesscontextmanager.AccessPolicy("access-policy", {
* parent: "organizations/123456789",
* title: "Storage Policy",
* });
* const storage_perimeter = new gcp.accesscontextmanager.ServicePerimeter("storage-perimeter", {
* parent: pulumi.interpolate`accesspolicies/${access_policy.name}`,
* name: pulumi.interpolate`accesspolicies/${access_policy.name}/serviceperimeters/storage-perimeter`,
* title: "Storage Perimeter",
* status: {
* restrictedServices: ["storage.googleapis.com"],
* },
* });
* const ingressPolicy = new gcp.accesscontextmanager.ServicePerimeterIngressPolicy("ingress_policy", {
* perimeter: storage_perimeter.name,
* ingressFrom: {
* identityType: "any_identity",
* sources: [{
* accessLevel: "*",
* }],
* },
* ingressTo: {
* resources: ["*"],
* operations: [{
* serviceName: "bigquery.googleapis.com",
* methodSelectors: [{
* method: "*",
* }],
* }],
* },
* });
* ```
* ```python
* import pulumi
* import pulumi_gcp as gcp
* access_policy = gcp.accesscontextmanager.AccessPolicy("access-policy",
* parent="organizations/123456789",
* title="Storage Policy")
* storage_perimeter = gcp.accesscontextmanager.ServicePerimeter("storage-perimeter",
* parent=access_policy.name.apply(lambda name: f"accesspolicies/{name}"),
* name=access_policy.name.apply(lambda name: f"accesspolicies/{name}/serviceperimeters/storage-perimeter"),
* title="Storage Perimeter",
* status=gcp.accesscontextmanager.ServicePerimeterStatusArgs(
* restricted_services=["storage.googleapis.com"],
* ))
* ingress_policy = gcp.accesscontextmanager.ServicePerimeterIngressPolicy("ingress_policy",
* perimeter=storage_perimeter.name,
* ingress_from=gcp.accesscontextmanager.ServicePerimeterIngressPolicyIngressFromArgs(
* identity_type="any_identity",
* sources=[gcp.accesscontextmanager.ServicePerimeterIngressPolicyIngressFromSourceArgs(
* access_level="*",
* )],
* ),
* ingress_to=gcp.accesscontextmanager.ServicePerimeterIngressPolicyIngressToArgs(
* resources=["*"],
* operations=[gcp.accesscontextmanager.ServicePerimeterIngressPolicyIngressToOperationArgs(
* service_name="bigquery.googleapis.com",
* method_selectors=[gcp.accesscontextmanager.ServicePerimeterIngressPolicyIngressToOperationMethodSelectorArgs(
* method="*",
* )],
* )],
* ))
* ```
* ```csharp
* using System.Collections.Generic;
* using System.Linq;
* using Pulumi;
* using Gcp = Pulumi.Gcp;
* return await Deployment.RunAsync(() =>
* {
* var access_policy = new Gcp.AccessContextManager.AccessPolicy("access-policy", new()
* {
* Parent = "organizations/123456789",
* Title = "Storage Policy",
* });
* var storage_perimeter = new Gcp.AccessContextManager.ServicePerimeter("storage-perimeter", new()
* {
* Parent = access_policy.Name.Apply(name => $"accesspolicies/{name}"),
* Name = access_policy.Name.Apply(name => $"accesspolicies/{name}/serviceperimeters/storage-perimeter"),
* Title = "Storage Perimeter",
* Status = new Gcp.AccessContextManager.Inputs.ServicePerimeterStatusArgs
* {
* RestrictedServices = new[]
* {
* "storage.googleapis.com",
* },
* },
* });
* var ingressPolicy = new Gcp.AccessContextManager.ServicePerimeterIngressPolicy("ingress_policy", new()
* {
* Perimeter = storage_perimeter.Name,
* IngressFrom = new Gcp.AccessContextManager.Inputs.ServicePerimeterIngressPolicyIngressFromArgs
* {
* IdentityType = "any_identity",
* Sources = new[]
* {
* new Gcp.AccessContextManager.Inputs.ServicePerimeterIngressPolicyIngressFromSourceArgs
* {
* AccessLevel = "*",
* },
* },
* },
* IngressTo = new Gcp.AccessContextManager.Inputs.ServicePerimeterIngressPolicyIngressToArgs
* {
* Resources = new[]
* {
* "*",
* },
* Operations = new[]
* {
* new Gcp.AccessContextManager.Inputs.ServicePerimeterIngressPolicyIngressToOperationArgs
* {
* ServiceName = "bigquery.googleapis.com",
* MethodSelectors = new[]
* {
* new Gcp.AccessContextManager.Inputs.ServicePerimeterIngressPolicyIngressToOperationMethodSelectorArgs
* {
* Method = "*",
* },
* },
* },
* },
* },
* });
* });
* ```
* ```go
* package main
* import (
* "fmt"
* "github.com/pulumi/pulumi-gcp/sdk/v7/go/gcp/accesscontextmanager"
* "github.com/pulumi/pulumi/sdk/v3/go/pulumi"
* )
* func main() {
* pulumi.Run(func(ctx *pulumi.Context) error {
* _, err := accesscontextmanager.NewAccessPolicy(ctx, "access-policy", &accesscontextmanager.AccessPolicyArgs{
* Parent: pulumi.String("organizations/123456789"),
* Title: pulumi.String("Storage Policy"),
* })
* if err != nil {
* return err
* }
* _, err = accesscontextmanager.NewServicePerimeter(ctx, "storage-perimeter", &accesscontextmanager.ServicePerimeterArgs{
* Parent: access_policy.Name.ApplyT(func(name string) (string, error) {
* return fmt.Sprintf("accesspolicies/%v", name), nil
* }).(pulumi.StringOutput),
* Name: access_policy.Name.ApplyT(func(name string) (string, error) {
* return fmt.Sprintf("accesspolicies/%v/serviceperimeters/storage-perimeter", name), nil
* }).(pulumi.StringOutput),
* Title: pulumi.String("Storage Perimeter"),
* Status: &accesscontextmanager.ServicePerimeterStatusArgs{
* RestrictedServices: pulumi.StringArray{
* pulumi.String("storage.googleapis.com"),
* },
* },
* })
* if err != nil {
* return err
* }
* _, err = accesscontextmanager.NewServicePerimeterIngressPolicy(ctx, "ingress_policy", &accesscontextmanager.ServicePerimeterIngressPolicyArgs{
* Perimeter: storage_perimeter.Name,
* IngressFrom: &accesscontextmanager.ServicePerimeterIngressPolicyIngressFromArgs{
* IdentityType: pulumi.String("any_identity"),
* Sources: accesscontextmanager.ServicePerimeterIngressPolicyIngressFromSourceArray{
* &accesscontextmanager.ServicePerimeterIngressPolicyIngressFromSourceArgs{
* AccessLevel: pulumi.String("*"),
* },
* },
* },
* IngressTo: &accesscontextmanager.ServicePerimeterIngressPolicyIngressToArgs{
* Resources: pulumi.StringArray{
* pulumi.String("*"),
* },
* Operations: accesscontextmanager.ServicePerimeterIngressPolicyIngressToOperationArray{
* &accesscontextmanager.ServicePerimeterIngressPolicyIngressToOperationArgs{
* ServiceName: pulumi.String("bigquery.googleapis.com"),
* MethodSelectors: accesscontextmanager.ServicePerimeterIngressPolicyIngressToOperationMethodSelectorArray{
* &accesscontextmanager.ServicePerimeterIngressPolicyIngressToOperationMethodSelectorArgs{
* Method: pulumi.String("*"),
* },
* },
* },
* },
* },
* })
* if err != nil {
* return err
* }
* return nil
* })
* }
* ```
* ```java
* package generated_program;
* import com.pulumi.Context;
* import com.pulumi.Pulumi;
* import com.pulumi.core.Output;
* import com.pulumi.gcp.accesscontextmanager.AccessPolicy;
* import com.pulumi.gcp.accesscontextmanager.AccessPolicyArgs;
* import com.pulumi.gcp.accesscontextmanager.ServicePerimeter;
* import com.pulumi.gcp.accesscontextmanager.ServicePerimeterArgs;
* import com.pulumi.gcp.accesscontextmanager.inputs.ServicePerimeterStatusArgs;
* import com.pulumi.gcp.accesscontextmanager.ServicePerimeterIngressPolicy;
* import com.pulumi.gcp.accesscontextmanager.ServicePerimeterIngressPolicyArgs;
* import com.pulumi.gcp.accesscontextmanager.inputs.ServicePerimeterIngressPolicyIngressFromArgs;
* import com.pulumi.gcp.accesscontextmanager.inputs.ServicePerimeterIngressPolicyIngressToArgs;
* import java.util.List;
* import java.util.ArrayList;
* import java.util.Map;
* import java.io.File;
* import java.nio.file.Files;
* import java.nio.file.Paths;
* public class App {
* public static void main(String[] args) {
* Pulumi.run(App::stack);
* }
* public static void stack(Context ctx) {
* var access_policy = new AccessPolicy("access-policy", AccessPolicyArgs.builder()
* .parent("organizations/123456789")
* .title("Storage Policy")
* .build());
* var storage_perimeter = new ServicePerimeter("storage-perimeter", ServicePerimeterArgs.builder()
* .parent(access_policy.name().applyValue(name -> String.format("accesspolicies/%s", name)))
* .name(access_policy.name().applyValue(name -> String.format("accesspolicies/%s/serviceperimeters/storage-perimeter", name)))
* .title("Storage Perimeter")
* .status(ServicePerimeterStatusArgs.builder()
* .restrictedServices("storage.googleapis.com")
* .build())
* .build());
* var ingressPolicy = new ServicePerimeterIngressPolicy("ingressPolicy", ServicePerimeterIngressPolicyArgs.builder()
* .perimeter(storage_perimeter.name())
* .ingressFrom(ServicePerimeterIngressPolicyIngressFromArgs.builder()
* .identityType("any_identity")
* .sources(ServicePerimeterIngressPolicyIngressFromSourceArgs.builder()
* .accessLevel("*")
* .build())
* .build())
* .ingressTo(ServicePerimeterIngressPolicyIngressToArgs.builder()
* .resources("*")
* .operations(ServicePerimeterIngressPolicyIngressToOperationArgs.builder()
* .serviceName("bigquery.googleapis.com")
* .methodSelectors(ServicePerimeterIngressPolicyIngressToOperationMethodSelectorArgs.builder()
* .method("*")
* .build())
* .build())
* .build())
* .build());
* }
* }
* ```
* ```yaml
* resources:
* storage-perimeter:
* type: gcp:accesscontextmanager:ServicePerimeter
* properties:
* parent: accesspolicies/${["access-policy"].name}
* name: accesspolicies/${["access-policy"].name}/serviceperimeters/storage-perimeter
* title: Storage Perimeter
* status:
* restrictedServices:
* - storage.googleapis.com
* ingressPolicy:
* type: gcp:accesscontextmanager:ServicePerimeterIngressPolicy
* name: ingress_policy
* properties:
* perimeter: ${["storage-perimeter"].name}
* ingressFrom:
* identityType: any_identity
* sources:
* - accessLevel: '*'
* ingressTo:
* resources:
* - '*'
* operations:
* - serviceName: bigquery.googleapis.com
* methodSelectors:
* - method: '*'
* access-policy:
* type: gcp:accesscontextmanager:AccessPolicy
* properties:
* parent: organizations/123456789
* title: Storage Policy
* ```
*
* ## Import
* ServicePerimeterIngressPolicy can be imported using any of these accepted formats:
* * `{{perimeter}}`
* When using the `pulumi import` command, ServicePerimeterIngressPolicy can be imported using one of the formats above. For example:
* ```sh
* $ pulumi import gcp:accesscontextmanager/servicePerimeterIngressPolicy:ServicePerimeterIngressPolicy default {{perimeter}}
* ```
* @property ingressFrom Defines the conditions on the source of a request causing this `IngressPolicy`
* to apply.
* Structure is documented below.
* @property ingressTo Defines the conditions on the `ApiOperation` and request destination that cause
* this `IngressPolicy` to apply.
* Structure is documented below.
* @property perimeter The name of the Service Perimeter to add this resource to.
* - - -
*/
public data class ServicePerimeterIngressPolicyArgs(
public val ingressFrom: Output? = null,
public val ingressTo: Output? = null,
public val perimeter: Output? = null,
) : ConvertibleToJava {
override fun toJava(): com.pulumi.gcp.accesscontextmanager.ServicePerimeterIngressPolicyArgs =
com.pulumi.gcp.accesscontextmanager.ServicePerimeterIngressPolicyArgs.builder()
.ingressFrom(ingressFrom?.applyValue({ args0 -> args0.let({ args0 -> args0.toJava() }) }))
.ingressTo(ingressTo?.applyValue({ args0 -> args0.let({ args0 -> args0.toJava() }) }))
.perimeter(perimeter?.applyValue({ args0 -> args0 })).build()
}
/**
* Builder for [ServicePerimeterIngressPolicyArgs].
*/
@PulumiTagMarker
public class ServicePerimeterIngressPolicyArgsBuilder internal constructor() {
private var ingressFrom: Output? = null
private var ingressTo: Output? = null
private var perimeter: Output? = null
/**
* @param value Defines the conditions on the source of a request causing this `IngressPolicy`
* to apply.
* Structure is documented below.
*/
@JvmName("lxsnbynbrbkvvpqr")
public suspend fun ingressFrom(`value`: Output) {
this.ingressFrom = value
}
/**
* @param value Defines the conditions on the `ApiOperation` and request destination that cause
* this `IngressPolicy` to apply.
* Structure is documented below.
*/
@JvmName("fotrpjxbbneoycuq")
public suspend fun ingressTo(`value`: Output) {
this.ingressTo = value
}
/**
* @param value The name of the Service Perimeter to add this resource to.
* - - -
*/
@JvmName("psgrnwaumqwgbwqn")
public suspend fun perimeter(`value`: Output) {
this.perimeter = value
}
/**
* @param value Defines the conditions on the source of a request causing this `IngressPolicy`
* to apply.
* Structure is documented below.
*/
@JvmName("qwqsduumebonmydl")
public suspend fun ingressFrom(`value`: ServicePerimeterIngressPolicyIngressFromArgs?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.ingressFrom = mapped
}
/**
* @param argument Defines the conditions on the source of a request causing this `IngressPolicy`
* to apply.
* Structure is documented below.
*/
@JvmName("yhwhulpmidsrttrk")
public suspend fun ingressFrom(argument: suspend ServicePerimeterIngressPolicyIngressFromArgsBuilder.() -> Unit) {
val toBeMapped = ServicePerimeterIngressPolicyIngressFromArgsBuilder().applySuspend {
argument()
}.build()
val mapped = of(toBeMapped)
this.ingressFrom = mapped
}
/**
* @param value Defines the conditions on the `ApiOperation` and request destination that cause
* this `IngressPolicy` to apply.
* Structure is documented below.
*/
@JvmName("snfcwcdjvakpcsxg")
public suspend fun ingressTo(`value`: ServicePerimeterIngressPolicyIngressToArgs?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.ingressTo = mapped
}
/**
* @param argument Defines the conditions on the `ApiOperation` and request destination that cause
* this `IngressPolicy` to apply.
* Structure is documented below.
*/
@JvmName("ajmtvawgtefudsjj")
public suspend fun ingressTo(argument: suspend ServicePerimeterIngressPolicyIngressToArgsBuilder.() -> Unit) {
val toBeMapped = ServicePerimeterIngressPolicyIngressToArgsBuilder().applySuspend {
argument()
}.build()
val mapped = of(toBeMapped)
this.ingressTo = mapped
}
/**
* @param value The name of the Service Perimeter to add this resource to.
* - - -
*/
@JvmName("bpnxgbqevflxjeog")
public suspend fun perimeter(`value`: String?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.perimeter = mapped
}
internal fun build(): ServicePerimeterIngressPolicyArgs = ServicePerimeterIngressPolicyArgs(
ingressFrom = ingressFrom,
ingressTo = ingressTo,
perimeter = perimeter,
)
}
© 2015 - 2024 Weber Informatics LLC | Privacy Policy