pulumi-gcp-kotlin/com.pulumi.gcp.networkservices.kotlin/AuthzExtensionArgs

AuthzExtensionArgs

data class AuthzExtensionArgs(val authority: Output<String>? = null, val description: Output<String>? = null, val failOpen: Output<Boolean>? = null, val forwardHeaders: Output<List<String>>? = null, val labels: Output<Map<String, String>>? = null, val loadBalancingScheme: Output<String>? = null, val location: Output<String>? = null, val metadata: Output<Map<String, String>>? = null, val name: Output<String>? = null, val project: Output<String>? = null, val service: Output<String>? = null, val timeout: Output<String>? = null, val wireFormat: Output<String>? = null) : ConvertibleToJava<AuthzExtensionArgs>

AuthzExtension is a resource that allows traffic forwarding to a callout backend service to make an authorization decision. To get more information about AuthzExtension, see:

Example Usage

Network Services Authz Extension Basic

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const _default = new gcp.compute.RegionBackendService("default", {
    name: "authz-service",
    project: "my-project-name",
    region: "us-west1",
    protocol: "HTTP2",
    loadBalancingScheme: "INTERNAL_MANAGED",
    portName: "grpc",
});
const defaultAuthzExtension = new gcp.networkservices.AuthzExtension("default", {
    name: "my-authz-ext",
    project: "my-project-name",
    location: "us-west1",
    description: "my description",
    loadBalancingScheme: "INTERNAL_MANAGED",
    authority: "ext11.com",
    service: _default.selfLink,
    timeout: "0.1s",
    failOpen: false,
    forwardHeaders: ["Authorization"],
});
Content copied to clipboard
import pulumi
import pulumi_gcp as gcp
default = gcp.compute.RegionBackendService("default",
    name="authz-service",
    project="my-project-name",
    region="us-west1",
    protocol="HTTP2",
    load_balancing_scheme="INTERNAL_MANAGED",
    port_name="grpc")
default_authz_extension = gcp.networkservices.AuthzExtension("default",
    name="my-authz-ext",
    project="my-project-name",
    location="us-west1",
    description="my description",
    load_balancing_scheme="INTERNAL_MANAGED",
    authority="ext11.com",
    service=default.self_link,
    timeout="0.1s",
    fail_open=False,
    forward_headers=["Authorization"])
Content copied to clipboard
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
    var @default = new Gcp.Compute.RegionBackendService("default", new()
    {
        Name = "authz-service",
        Project = "my-project-name",
        Region = "us-west1",
        Protocol = "HTTP2",
        LoadBalancingScheme = "INTERNAL_MANAGED",
        PortName = "grpc",
    });
    var defaultAuthzExtension = new Gcp.NetworkServices.AuthzExtension("default", new()
    {
        Name = "my-authz-ext",
        Project = "my-project-name",
        Location = "us-west1",
        Description = "my description",
        LoadBalancingScheme = "INTERNAL_MANAGED",
        Authority = "ext11.com",
        Service = @default.SelfLink,
        Timeout = "0.1s",
        FailOpen = false,
        ForwardHeaders = new[]
        {
            "Authorization",
        },
    });
});
Content copied to clipboard
package main
import (
	"github.com/pulumi/pulumi-gcp/sdk/v8/go/gcp/compute"
	"github.com/pulumi/pulumi-gcp/sdk/v8/go/gcp/networkservices"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_default, err := compute.NewRegionBackendService(ctx, "default", &compute.RegionBackendServiceArgs{
			Name:                pulumi.String("authz-service"),
			Project:             pulumi.String("my-project-name"),
			Region:              pulumi.String("us-west1"),
			Protocol:            pulumi.String("HTTP2"),
			LoadBalancingScheme: pulumi.String("INTERNAL_MANAGED"),
			PortName:            pulumi.String("grpc"),
		})
		if err != nil {
			return err
		}
		_, err = networkservices.NewAuthzExtension(ctx, "default", &networkservices.AuthzExtensionArgs{
			Name:                pulumi.String("my-authz-ext"),
			Project:             pulumi.String("my-project-name"),
			Location:            pulumi.String("us-west1"),
			Description:         pulumi.String("my description"),
			LoadBalancingScheme: pulumi.String("INTERNAL_MANAGED"),
			Authority:           pulumi.String("ext11.com"),
			Service:             _default.SelfLink,
			Timeout:             pulumi.String("0.1s"),
			FailOpen:            pulumi.Bool(false),
			ForwardHeaders: pulumi.StringArray{
				pulumi.String("Authorization"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}
Content copied to clipboard
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.compute.RegionBackendService;
import com.pulumi.gcp.compute.RegionBackendServiceArgs;
import com.pulumi.gcp.networkservices.AuthzExtension;
import com.pulumi.gcp.networkservices.AuthzExtensionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var default_ = new RegionBackendService("default", RegionBackendServiceArgs.builder()
            .name("authz-service")
            .project("my-project-name")
            .region("us-west1")
            .protocol("HTTP2")
            .loadBalancingScheme("INTERNAL_MANAGED")
            .portName("grpc")
            .build());
        var defaultAuthzExtension = new AuthzExtension("defaultAuthzExtension", AuthzExtensionArgs.builder()
            .name("my-authz-ext")
            .project("my-project-name")
            .location("us-west1")
            .description("my description")
            .loadBalancingScheme("INTERNAL_MANAGED")
            .authority("ext11.com")
            .service(default_.selfLink())
            .timeout("0.1s")
            .failOpen(false)
            .forwardHeaders("Authorization")
            .build());
    }
}
Content copied to clipboard
resources:
  default:
    type: gcp:compute:RegionBackendService
    properties:
      name: authz-service
      project: my-project-name
      region: us-west1
      protocol: HTTP2
      loadBalancingScheme: INTERNAL_MANAGED
      portName: grpc
  defaultAuthzExtension:
    type: gcp:networkservices:AuthzExtension
    name: default
    properties:
      name: my-authz-ext
      project: my-project-name
      location: us-west1
      description: my description
      loadBalancingScheme: INTERNAL_MANAGED
      authority: ext11.com
      service: ${default.selfLink}
      timeout: 0.1s
      failOpen: false
      forwardHeaders:
        - Authorization
Content copied to clipboard

Import

AuthzExtension can be imported using any of these accepted formats:

  • projects/{{project}}/locations/{{location}}/authzExtensions/{{name}}

  • {{project}}/{{location}}/{{name}}

  • {{location}}/{{name}}

  • {{name}} When using the pulumi import command, AuthzExtension can be imported using one of the formats above. For example:

$ pulumi import gcp:networkservices/authzExtension:AuthzExtension default projects/{{project}}/locations/{{location}}/authzExtensions/{{name}}
Content copied to clipboard
$ pulumi import gcp:networkservices/authzExtension:AuthzExtension default {{project}}/{{location}}/{{name}}
Content copied to clipboard
$ pulumi import gcp:networkservices/authzExtension:AuthzExtension default {{location}}/{{name}}
Content copied to clipboard
$ pulumi import gcp:networkservices/authzExtension:AuthzExtension default {{name}}
Content copied to clipboard

Constructors

Link copied to clipboard
constructor(authority: Output<String>? = null, description: Output<String>? = null, failOpen: Output<Boolean>? = null, forwardHeaders: Output<List<String>>? = null, labels: Output<Map<String, String>>? = null, loadBalancingScheme: Output<String>? = null, location: Output<String>? = null, metadata: Output<Map<String, String>>? = null, name: Output<String>? = null, project: Output<String>? = null, service: Output<String>? = null, timeout: Output<String>? = null, wireFormat: Output<String>? = null)

Properties

Link copied to clipboard
val authority: Output<String>? = null

The :authority header in the gRPC request sent from Envoy to the extension service.

Link copied to clipboard
val description: Output<String>? = null

A human-readable description of the resource.

Link copied to clipboard
val failOpen: Output<Boolean>? = null

Determines how the proxy behaves if the call to the extension fails or times out. When set to TRUE, request or response processing continues without error. Any subsequent extensions in the extension chain are also executed. When set to FALSE or the default setting of FALSE is used, one of the following happens:

Link copied to clipboard
val forwardHeaders: Output<List<String>>? = null

List of the HTTP headers to forward to the extension (from the client). If omitted, all headers are sent. Each element is a string indicating the header name.

Link copied to clipboard
val labels: Output<Map<String, String>>? = null

Set of labels associated with the AuthzExtension resource. Note: This field is non-authoritative, and will only manage the labels present in your configuration. Please refer to the field effective_labels for all of the labels present on the resource.

Link copied to clipboard
val loadBalancingScheme: Output<String>? = null

All backend services and forwarding rules referenced by this extension must share the same load balancing scheme. For more information, refer to Backend services overview. Possible values are: INTERNAL_MANAGED, EXTERNAL_MANAGED.

Link copied to clipboard
val location: Output<String>? = null

The location of the resource.

Link copied to clipboard
val metadata: Output<Map<String, String>>? = null

The metadata provided here is included as part of the metadata_context (of type google.protobuf.Struct) in the ProcessingRequest message sent to the extension server. The metadata is available under the namespace com.google.authz_extension.. The following variables are supported in the metadata Struct: {forwarding_rule_id} - substituted with the forwarding rule's fully qualified resource name.

Link copied to clipboard
val name: Output<String>? = null

Identifier. Name of the AuthzExtension resource.

Link copied to clipboard
val project: Output<String>? = null

The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

Link copied to clipboard
val service: Output<String>? = null

The reference to the service that runs the extension. To configure a callout extension, service must be a fully-qualified reference to a backend service in the format: https://www.googleapis.com/compute/v1/projects/{project}/regions/{region}/backendServices/{backendService} or https://www.googleapis.com/compute/v1/projects/{project}/global/backendServices/{backendService}.

Link copied to clipboard
val timeout: Output<String>? = null

Specifies the timeout for each individual message on the stream. The timeout must be between 10-10000 milliseconds.

Link copied to clipboard
val wireFormat: Output<String>? = null

The format of communication supported by the callout extension. Will be set to EXT_PROC_GRPC by the backend if no value is set. Possible values are: WIRE_FORMAT_UNSPECIFIED, EXT_PROC_GRPC.

Functions

Link copied to clipboard
open override fun toJava(): AuthzExtensionArgs