pulumi-gcp-kotlin/com.pulumi.gcp.compute.kotlin/RegionSecurityPolicyRuleArgs

RegionSecurityPolicyRuleArgs

data class RegionSecurityPolicyRuleArgs(val action: Output<String>? = null, val description: Output<String>? = null, val match: Output<RegionSecurityPolicyRuleMatchArgs>? = null, val networkMatch: Output<RegionSecurityPolicyRuleNetworkMatchArgs>? = null, val preview: Output<Boolean>? = null, val priority: Output<Int>? = null, val project: Output<String>? = null, val region: Output<String>? = null, val securityPolicy: Output<String>? = null) : ConvertibleToJava<RegionSecurityPolicyRuleArgs>

Example Usage

Region Security Policy Rule Basic

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.compute.RegionSecurityPolicy;
import com.pulumi.gcp.compute.RegionSecurityPolicyArgs;
import com.pulumi.gcp.compute.RegionSecurityPolicyRule;
import com.pulumi.gcp.compute.RegionSecurityPolicyRuleArgs;
import com.pulumi.gcp.compute.inputs.RegionSecurityPolicyRuleMatchArgs;
import com.pulumi.gcp.compute.inputs.RegionSecurityPolicyRuleMatchConfigArgs;
import com.pulumi.resources.CustomResourceOptions;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var default_ = new RegionSecurityPolicy("default", RegionSecurityPolicyArgs.builder()
            .region("us-west2")
            .description("basic region security policy")
            .type("CLOUD_ARMOR")
            .build(), CustomResourceOptions.builder()
                .provider(google_beta)
                .build());
        var policyRule = new RegionSecurityPolicyRule("policyRule", RegionSecurityPolicyRuleArgs.builder()
            .region("us-west2")
            .securityPolicy(default_.name())
            .description("new rule")
            .priority(100)
            .match(RegionSecurityPolicyRuleMatchArgs.builder()
                .versionedExpr("SRC_IPS_V1")
                .config(RegionSecurityPolicyRuleMatchConfigArgs.builder()
                    .srcIpRanges("10.10.0.0/16")
                    .build())
                .build())
            .action("allow")
            .preview(true)
            .build(), CustomResourceOptions.builder()
                .provider(google_beta)
                .build());
    }
}
Content copied to clipboard

Region Security Policy Rule Multiple Rules

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.compute.RegionSecurityPolicy;
import com.pulumi.gcp.compute.RegionSecurityPolicyArgs;
import com.pulumi.gcp.compute.RegionSecurityPolicyRule;
import com.pulumi.gcp.compute.RegionSecurityPolicyRuleArgs;
import com.pulumi.gcp.compute.inputs.RegionSecurityPolicyRuleMatchArgs;
import com.pulumi.gcp.compute.inputs.RegionSecurityPolicyRuleMatchConfigArgs;
import com.pulumi.resources.CustomResourceOptions;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var default_ = new RegionSecurityPolicy("default", RegionSecurityPolicyArgs.builder()
            .region("us-west2")
            .description("basic region security policy")
            .type("CLOUD_ARMOR")
            .build(), CustomResourceOptions.builder()
                .provider(google_beta)
                .build());
        var policyRuleOne = new RegionSecurityPolicyRule("policyRuleOne", RegionSecurityPolicyRuleArgs.builder()
            .region("us-west2")
            .securityPolicy(default_.name())
            .description("new rule one")
            .priority(100)
            .match(RegionSecurityPolicyRuleMatchArgs.builder()
                .versionedExpr("SRC_IPS_V1")
                .config(RegionSecurityPolicyRuleMatchConfigArgs.builder()
                    .srcIpRanges("10.10.0.0/16")
                    .build())
                .build())
            .action("allow")
            .preview(true)
            .build(), CustomResourceOptions.builder()
                .provider(google_beta)
                .build());
        var policyRuleTwo = new RegionSecurityPolicyRule("policyRuleTwo", RegionSecurityPolicyRuleArgs.builder()
            .region("us-west2")
            .securityPolicy(default_.name())
            .description("new rule two")
            .priority(101)
            .match(RegionSecurityPolicyRuleMatchArgs.builder()
                .versionedExpr("SRC_IPS_V1")
                .config(RegionSecurityPolicyRuleMatchConfigArgs.builder()
                    .srcIpRanges(
                        "192.168.0.0/16",
                        "10.0.0.0/8")
                    .build())
                .build())
            .action("allow")
            .preview(true)
            .build(), CustomResourceOptions.builder()
                .provider(google_beta)
                .build());
    }
}
Content copied to clipboard

Region Security Policy Rule With Network Match

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.compute.RegionSecurityPolicy;
import com.pulumi.gcp.compute.RegionSecurityPolicyArgs;
import com.pulumi.gcp.compute.inputs.RegionSecurityPolicyDdosProtectionConfigArgs;
import com.pulumi.gcp.compute.NetworkEdgeSecurityService;
import com.pulumi.gcp.compute.NetworkEdgeSecurityServiceArgs;
import com.pulumi.gcp.compute.inputs.RegionSecurityPolicyUserDefinedFieldArgs;
import com.pulumi.gcp.compute.RegionSecurityPolicyRule;
import com.pulumi.gcp.compute.RegionSecurityPolicyRuleArgs;
import com.pulumi.gcp.compute.inputs.RegionSecurityPolicyRuleNetworkMatchArgs;
import com.pulumi.resources.CustomResourceOptions;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var policyddosprotection = new RegionSecurityPolicy("policyddosprotection", RegionSecurityPolicyArgs.builder()
            .region("us-west2")
            .description("policy for activating network DDoS protection for the desired region")
            .type("CLOUD_ARMOR_NETWORK")
            .ddosProtectionConfig(RegionSecurityPolicyDdosProtectionConfigArgs.builder()
                .ddosProtection("ADVANCED_PREVIEW")
                .build())
            .build(), CustomResourceOptions.builder()
                .provider(google_beta)
                .build());
        var edgeSecService = new NetworkEdgeSecurityService("edgeSecService", NetworkEdgeSecurityServiceArgs.builder()
            .region("us-west2")
            .description("linking policy to edge security service")
            .securityPolicy(policyddosprotection.selfLink())
            .build(), CustomResourceOptions.builder()
                .provider(google_beta)
                .build());
        var policynetworkmatch = new RegionSecurityPolicy("policynetworkmatch", RegionSecurityPolicyArgs.builder()
            .region("us-west2")
            .description("region security policy for network match")
            .type("CLOUD_ARMOR_NETWORK")
            .userDefinedFields(RegionSecurityPolicyUserDefinedFieldArgs.builder()
                .name("SIG1_AT_0")
                .base("TCP")
                .offset(8)
                .size(2)
                .mask("0x8F00")
                .build())
            .build(), CustomResourceOptions.builder()
                .provider(google_beta)
                .dependsOn(edgeSecService)
                .build());
        var policyRuleNetworkMatch = new RegionSecurityPolicyRule("policyRuleNetworkMatch", RegionSecurityPolicyRuleArgs.builder()
            .region("us-west2")
            .securityPolicy(policynetworkmatch.name())
            .description("custom rule for network match")
            .priority(100)
            .networkMatch(RegionSecurityPolicyRuleNetworkMatchArgs.builder()
                .srcIpRanges("10.10.0.0/16")
                .userDefinedFields(RegionSecurityPolicyRuleNetworkMatchUserDefinedFieldArgs.builder()
                    .name("SIG1_AT_0")
                    .values("0x8F00")
                    .build())
                .build())
            .action("allow")
            .preview(true)
            .build(), CustomResourceOptions.builder()
                .provider(google_beta)
                .build());
    }
}
Content copied to clipboard

Import

RegionSecurityPolicyRule can be imported using any of these accepted formats

$ pulumi import gcp:compute/regionSecurityPolicyRule:RegionSecurityPolicyRule default projects/{{project}}/regions/{{region}}/securityPolicies/{{security_policy}}/priority/{{priority}}
Content copied to clipboard
$ pulumi import gcp:compute/regionSecurityPolicyRule:RegionSecurityPolicyRule default {{project}}/{{region}}/{{security_policy}}/{{priority}}
Content copied to clipboard
$ pulumi import gcp:compute/regionSecurityPolicyRule:RegionSecurityPolicyRule default {{region}}/{{security_policy}}/{{priority}}
Content copied to clipboard
$ pulumi import gcp:compute/regionSecurityPolicyRule:RegionSecurityPolicyRule default {{security_policy}}/{{priority}}
Content copied to clipboard

Constructors

Link copied to clipboard
constructor(action: Output<String>? = null, description: Output<String>? = null, match: Output<RegionSecurityPolicyRuleMatchArgs>? = null, networkMatch: Output<RegionSecurityPolicyRuleNetworkMatchArgs>? = null, preview: Output<Boolean>? = null, priority: Output<Int>? = null, project: Output<String>? = null, region: Output<String>? = null, securityPolicy: Output<String>? = null)

Properties

Link copied to clipboard
val action: Output<String>? = null

The Action to perform when the rule is matched. The following are the valid actions:

Link copied to clipboard
val description: Output<String>? = null

An optional description of this resource. Provide this property when you create the resource.

Link copied to clipboard
val match: Output<RegionSecurityPolicyRuleMatchArgs>? = null

A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.

Link copied to clipboard
val networkMatch: Output<RegionSecurityPolicyRuleNetworkMatchArgs>? = null

A match condition that incoming packets are evaluated against for CLOUD_ARMOR_NETWORK security policies. If it matches, the corresponding 'action' is enforced. The match criteria for a rule consists of built-in match fields (like 'srcIpRanges') and potentially multiple user-defined match fields ('userDefinedFields'). Field values may be extracted directly from the packet or derived from it (e.g. 'srcRegionCodes'). Some fields may not be present in every packet (e.g. 'srcPorts'). A user-defined field is only present if the base header is found in the packet and the entire field is in bounds. Each match field may specify which values can match it, listing one or more ranges, prefixes, or exact values that are considered a match for the field. A field value must be present in order to match a specified match field. If no match values are specified for a match field, then any field value is considered to match it, and it's not required to be present. For strings specifying '*' is also equivalent to match all. For a packet to match a rule, all specified match fields must match the corresponding field values derived from the packet. Example: networkMatch: srcIpRanges: - "192.0.2.0/24" - "198.51.100.0/24" userDefinedFields: - name: "ipv4_fragment_offset" values: - "1-0x1fff" The above match condition matches packets with a source IP in 192.0.2.0/24 or 198.51.100.0/24 and a user-defined field named "ipv4_fragment_offset" with a value between 1 and 0x1fff inclusive Structure is documented below.

Link copied to clipboard
val preview: Output<Boolean>? = null

If set to true, the specified action is not enforced.

Link copied to clipboard
val priority: Output<Int>? = null

An integer indicating the priority of a rule in the list. The priority must be a positive value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.

Link copied to clipboard
val project: Output<String>? = null

The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

Link copied to clipboard
val region: Output<String>? = null

The Region in which the created Region Security Policy rule should reside.

Link copied to clipboard
val securityPolicy: Output<String>? = null

The name of the security policy this rule belongs to.

Functions

Link copied to clipboard
open override fun toJava(): RegionSecurityPolicyRuleArgs