Authz
AuthzExtension is a resource that allows traffic forwarding to a callout backend service to make an authorization decision. To get more information about AuthzExtension, see:
Example Usage
Network Services Authz Extension Basic
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const _default = new gcp.compute.RegionBackendService("default", {
name: "authz-service",
project: "my-project-name",
region: "us-west1",
protocol: "HTTP2",
loadBalancingScheme: "INTERNAL_MANAGED",
portName: "grpc",
});
const defaultAuthzExtension = new gcp.networkservices.AuthzExtension("default", {
name: "my-authz-ext",
project: "my-project-name",
location: "us-west1",
description: "my description",
loadBalancingScheme: "INTERNAL_MANAGED",
authority: "ext11.com",
service: _default.selfLink,
timeout: "0.1s",
failOpen: false,
forwardHeaders: ["Authorization"],
});import pulumi
import pulumi_gcp as gcp
default = gcp.compute.RegionBackendService("default",
name="authz-service",
project="my-project-name",
region="us-west1",
protocol="HTTP2",
load_balancing_scheme="INTERNAL_MANAGED",
port_name="grpc")
default_authz_extension = gcp.networkservices.AuthzExtension("default",
name="my-authz-ext",
project="my-project-name",
location="us-west1",
description="my description",
load_balancing_scheme="INTERNAL_MANAGED",
authority="ext11.com",
service=default.self_link,
timeout="0.1s",
fail_open=False,
forward_headers=["Authorization"])using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var @default = new Gcp.Compute.RegionBackendService("default", new()
{
Name = "authz-service",
Project = "my-project-name",
Region = "us-west1",
Protocol = "HTTP2",
LoadBalancingScheme = "INTERNAL_MANAGED",
PortName = "grpc",
});
var defaultAuthzExtension = new Gcp.NetworkServices.AuthzExtension("default", new()
{
Name = "my-authz-ext",
Project = "my-project-name",
Location = "us-west1",
Description = "my description",
LoadBalancingScheme = "INTERNAL_MANAGED",
Authority = "ext11.com",
Service = @default.SelfLink,
Timeout = "0.1s",
FailOpen = false,
ForwardHeaders = new[]
{
"Authorization",
},
});
});package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v8/go/gcp/compute"
"github.com/pulumi/pulumi-gcp/sdk/v8/go/gcp/networkservices"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_default, err := compute.NewRegionBackendService(ctx, "default", &compute.RegionBackendServiceArgs{
Name: pulumi.String("authz-service"),
Project: pulumi.String("my-project-name"),
Region: pulumi.String("us-west1"),
Protocol: pulumi.String("HTTP2"),
LoadBalancingScheme: pulumi.String("INTERNAL_MANAGED"),
PortName: pulumi.String("grpc"),
})
if err != nil {
return err
}
_, err = networkservices.NewAuthzExtension(ctx, "default", &networkservices.AuthzExtensionArgs{
Name: pulumi.String("my-authz-ext"),
Project: pulumi.String("my-project-name"),
Location: pulumi.String("us-west1"),
Description: pulumi.String("my description"),
LoadBalancingScheme: pulumi.String("INTERNAL_MANAGED"),
Authority: pulumi.String("ext11.com"),
Service: _default.SelfLink,
Timeout: pulumi.String("0.1s"),
FailOpen: pulumi.Bool(false),
ForwardHeaders: pulumi.StringArray{
pulumi.String("Authorization"),
},
})
if err != nil {
return err
}
return nil
})
}package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.compute.RegionBackendService;
import com.pulumi.gcp.compute.RegionBackendServiceArgs;
import com.pulumi.gcp.networkservices.AuthzExtension;
import com.pulumi.gcp.networkservices.AuthzExtensionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var default_ = new RegionBackendService("default", RegionBackendServiceArgs.builder()
.name("authz-service")
.project("my-project-name")
.region("us-west1")
.protocol("HTTP2")
.loadBalancingScheme("INTERNAL_MANAGED")
.portName("grpc")
.build());
var defaultAuthzExtension = new AuthzExtension("defaultAuthzExtension", AuthzExtensionArgs.builder()
.name("my-authz-ext")
.project("my-project-name")
.location("us-west1")
.description("my description")
.loadBalancingScheme("INTERNAL_MANAGED")
.authority("ext11.com")
.service(default_.selfLink())
.timeout("0.1s")
.failOpen(false)
.forwardHeaders("Authorization")
.build());
}
}resources:
default:
type: gcp:compute:RegionBackendService
properties:
name: authz-service
project: my-project-name
region: us-west1
protocol: HTTP2
loadBalancingScheme: INTERNAL_MANAGED
portName: grpc
defaultAuthzExtension:
type: gcp:networkservices:AuthzExtension
name: default
properties:
name: my-authz-ext
project: my-project-name
location: us-west1
description: my description
loadBalancingScheme: INTERNAL_MANAGED
authority: ext11.com
service: ${default.selfLink}
timeout: 0.1s
failOpen: false
forwardHeaders:
- AuthorizationImport
AuthzExtension can be imported using any of these accepted formats:
projects/{{project}}/locations/{{location}}/authzExtensions/{{name}}{{project}}/{{location}}/{{name}}{{location}}/{{name}}{{name}}When using thepulumi importcommand, AuthzExtension can be imported using one of the formats above. For example:
$ pulumi import gcp:networkservices/authzExtension:AuthzExtension default projects/{{project}}/locations/{{location}}/authzExtensions/{{name}}$ pulumi import gcp:networkservices/authzExtension:AuthzExtension default {{project}}/{{location}}/{{name}}$ pulumi import gcp:networkservices/authzExtension:AuthzExtension default {{location}}/{{name}}$ pulumi import gcp:networkservices/authzExtension:AuthzExtension default {{name}}Properties
The timestamp when the resource was created.
A human-readable description of the resource.
All of labels (key/value pairs) present on the resource in GCP, including the labels configured through Pulumi, other clients and services.
Determines how the proxy behaves if the call to the extension fails or times out. When set to TRUE, request or response processing continues without error. Any subsequent extensions in the extension chain are also executed. When set to FALSE or the default setting of FALSE is used, one of the following happens:
List of the HTTP headers to forward to the extension (from the client). If omitted, all headers are sent. Each element is a string indicating the header name.
All backend services and forwarding rules referenced by this extension must share the same load balancing scheme. For more information, refer to Backend services overview. Possible values are: INTERNAL_MANAGED, EXTERNAL_MANAGED.
The metadata provided here is included as part of the metadata_context (of type google.protobuf.Struct) in the ProcessingRequest message sent to the extension server. The metadata is available under the namespace com.google.authz_extension.
The combination of labels configured directly on the resource and default labels configured on the provider.
The reference to the service that runs the extension. To configure a callout extension, service must be a fully-qualified reference to a backend service in the format: https://www.googleapis.com/compute/v1/projects/{project}/regions/{region}/backendServices/{backendService} or https://www.googleapis.com/compute/v1/projects/{project}/global/backendServices/{backendService}.
The timestamp when the resource was updated.
The format of communication supported by the callout extension. Will be set to EXT_PROC_GRPC by the backend if no value is set. Possible values are: WIRE_FORMAT_UNSPECIFIED, EXT_PROC_GRPC.