Docs Home
Google Cloud v8.25.0 published on Thursday, Apr 3, 2025 by Pulumi
gcp.accesscontextmanager.AccessLevelCondition
Explore with Pulumi AI
Allows configuring a single access level condition to be appended to an access level’s conditions.
This resource is intended to be used in cases where it is not possible to compile a full list
of conditions to include in a gcp.accesscontextmanager.AccessLevel resource,
to enable them to be added separately.
Note: If this resource is used alongside a
gcp.accesscontextmanager.AccessLevelresource, the access level resource must have alifecycleblock withignore_changes = [basic[0].conditions]so they don’t fight over which service accounts should be included.
To get more information about AccessLevelCondition, see:
- API documentation
- How-to Guides
Warning: If you are using User ADCs (Application Default Credentials) with this resource, you must specify a
billing_projectand setuser_project_overrideto true in the provider configuration. Otherwise the ACM API will return a 403 error. Your account must have theserviceusage.services.usepermission on thebilling_projectyou defined.
Example Usage
Access Context Manager Access Level Condition Basic
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const access_policy = new gcp.accesscontextmanager.AccessPolicy("access-policy", {
parent: "organizations/123456789",
title: "my policy",
});
const access_level_service_account = new gcp.accesscontextmanager.AccessLevel("access-level-service-account", {
parent: pulumi.interpolate`accessPolicies/${access_policy.name}`,
name: pulumi.interpolate`accessPolicies/${access_policy.name}/accessLevels/chromeos_no_lock`,
title: "chromeos_no_lock",
basic: {
conditions: [{
devicePolicy: {
requireScreenLock: true,
osConstraints: [{
osType: "DESKTOP_CHROME_OS",
}],
},
regions: [
"CH",
"IT",
"US",
],
}],
},
});
const created_later = new gcp.serviceaccount.Account("created-later", {accountId: "my-account-id"});
const access_level_conditions = new gcp.accesscontextmanager.AccessLevelCondition("access-level-conditions", {
accessLevel: access_level_service_account.name,
ipSubnetworks: ["192.0.4.0/24"],
members: [
"user:test@google.com",
"user:test2@google.com",
pulumi.interpolate`serviceAccount:${created_later.email}`,
],
negate: false,
devicePolicy: {
requireScreenLock: false,
requireAdminApproval: false,
requireCorpOwned: true,
osConstraints: [{
osType: "DESKTOP_CHROME_OS",
}],
},
regions: [
"IT",
"US",
],
});
import pulumi
import pulumi_gcp as gcp
access_policy = gcp.accesscontextmanager.AccessPolicy("access-policy",
parent="organizations/123456789",
title="my policy")
access_level_service_account = gcp.accesscontextmanager.AccessLevel("access-level-service-account",
parent=access_policy.name.apply(lambda name: f"accessPolicies/{name}"),
name=access_policy.name.apply(lambda name: f"accessPolicies/{name}/accessLevels/chromeos_no_lock"),
title="chromeos_no_lock",
basic={
"conditions": [{
"device_policy": {
"require_screen_lock": True,
"os_constraints": [{
"os_type": "DESKTOP_CHROME_OS",
}],
},
"regions": [
"CH",
"IT",
"US",
],
}],
})
created_later = gcp.serviceaccount.Account("created-later", account_id="my-account-id")
access_level_conditions = gcp.accesscontextmanager.AccessLevelCondition("access-level-conditions",
access_level=access_level_service_account.name,
ip_subnetworks=["192.0.4.0/24"],
members=[
"user:test@google.com",
"user:test2@google.com",
created_later.email.apply(lambda email: f"serviceAccount:{email}"),
],
negate=False,
device_policy={
"require_screen_lock": False,
"require_admin_approval": False,
"require_corp_owned": True,
"os_constraints": [{
"os_type": "DESKTOP_CHROME_OS",
}],
},
regions=[
"IT",
"US",
])
package main
import (
"fmt"
"github.com/pulumi/pulumi-gcp/sdk/v8/go/gcp/accesscontextmanager"
"github.com/pulumi/pulumi-gcp/sdk/v8/go/gcp/serviceaccount"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
access_policy, err := accesscontextmanager.NewAccessPolicy(ctx, "access-policy", &accesscontextmanager.AccessPolicyArgs{
Parent: pulumi.String("organizations/123456789"),
Title: pulumi.String("my policy"),
})
if err != nil {
return err
}
access_level_service_account, err := accesscontextmanager.NewAccessLevel(ctx, "access-level-service-account", &accesscontextmanager.AccessLevelArgs{
Parent: access_policy.Name.ApplyT(func(name string) (string, error) {
return fmt.Sprintf("accessPolicies/%v", name), nil
}).(pulumi.StringOutput),
Name: access_policy.Name.ApplyT(func(name string) (string, error) {
return fmt.Sprintf("accessPolicies/%v/accessLevels/chromeos_no_lock", name), nil
}).(pulumi.StringOutput),
Title: pulumi.String("chromeos_no_lock"),
Basic: &accesscontextmanager.AccessLevelBasicArgs{
Conditions: accesscontextmanager.AccessLevelBasicConditionArray{
&accesscontextmanager.AccessLevelBasicConditionArgs{
DevicePolicy: &accesscontextmanager.AccessLevelBasicConditionDevicePolicyArgs{
RequireScreenLock: pulumi.Bool(true),
OsConstraints: accesscontextmanager.AccessLevelBasicConditionDevicePolicyOsConstraintArray{
&accesscontextmanager.AccessLevelBasicConditionDevicePolicyOsConstraintArgs{
OsType: pulumi.String("DESKTOP_CHROME_OS"),
},
},
},
Regions: pulumi.StringArray{
pulumi.String("CH"),
pulumi.String("IT"),
pulumi.String("US"),
},
},
},
},
})
if err != nil {
return err
}
created_later, err := serviceaccount.NewAccount(ctx, "created-later", &serviceaccount.AccountArgs{
AccountId: pulumi.String("my-account-id"),
})
if err != nil {
return err
}
_, err = accesscontextmanager.NewAccessLevelCondition(ctx, "access-level-conditions", &accesscontextmanager.AccessLevelConditionArgs{
AccessLevel: access_level_service_account.Name,
IpSubnetworks: pulumi.StringArray{
pulumi.String("192.0.4.0/24"),
},
Members: pulumi.StringArray{
pulumi.String("user:test@google.com"),
pulumi.String("user:test2@google.com"),
created_later.Email.ApplyT(func(email string) (string, error) {
return fmt.Sprintf("serviceAccount:%v", email), nil
}).(pulumi.StringOutput),
},
Negate: pulumi.Bool(false),
DevicePolicy: &accesscontextmanager.AccessLevelConditionDevicePolicyArgs{
RequireScreenLock: pulumi.Bool(false),
RequireAdminApproval: pulumi.Bool(false),
RequireCorpOwned: pulumi.Bool(true),
OsConstraints: accesscontextmanager.AccessLevelConditionDevicePolicyOsConstraintArray{
&accesscontextmanager.AccessLevelConditionDevicePolicyOsConstraintArgs{
OsType: pulumi.String("DESKTOP_CHROME_OS"),
},
},
},
Regions: pulumi.StringArray{
pulumi.String("IT"),
pulumi.String("US"),
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var access_policy = new Gcp.AccessContextManager.AccessPolicy("access-policy", new()
{
Parent = "organizations/123456789",
Title = "my policy",
});
var access_level_service_account = new Gcp.AccessContextManager.AccessLevel("access-level-service-account", new()
{
Parent = access_policy.Name.Apply(name => $"accessPolicies/{name}"),
Name = access_policy.Name.Apply(name => $"accessPolicies/{name}/accessLevels/chromeos_no_lock"),
Title = "chromeos_no_lock",
Basic = new Gcp.AccessContextManager.Inputs.AccessLevelBasicArgs
{
Conditions = new[]
{
new Gcp.AccessContextManager.Inputs.AccessLevelBasicConditionArgs
{
DevicePolicy = new Gcp.AccessContextManager.Inputs.AccessLevelBasicConditionDevicePolicyArgs
{
RequireScreenLock = true,
OsConstraints = new[]
{
new Gcp.AccessContextManager.Inputs.AccessLevelBasicConditionDevicePolicyOsConstraintArgs
{
OsType = "DESKTOP_CHROME_OS",
},
},
},
Regions = new[]
{
"CH",
"IT",
"US",
},
},
},
},
});
var created_later = new Gcp.ServiceAccount.Account("created-later", new()
{
AccountId = "my-account-id",
});
var access_level_conditions = new Gcp.AccessContextManager.AccessLevelCondition("access-level-conditions", new()
{
AccessLevel = access_level_service_account.Name,
IpSubnetworks = new[]
{
"192.0.4.0/24",
},
Members = new[]
{
"user:test@google.com",
"user:test2@google.com",
created_later.Email.Apply(email => $"serviceAccount:{email}"),
},
Negate = false,
DevicePolicy = new Gcp.AccessContextManager.Inputs.AccessLevelConditionDevicePolicyArgs
{
RequireScreenLock = false,
RequireAdminApproval = false,
RequireCorpOwned = true,
OsConstraints = new[]
{
new Gcp.AccessContextManager.Inputs.AccessLevelConditionDevicePolicyOsConstraintArgs
{
OsType = "DESKTOP_CHROME_OS",
},
},
},
Regions = new[]
{
"IT",
"US",
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.accesscontextmanager.AccessPolicy;
import com.pulumi.gcp.accesscontextmanager.AccessPolicyArgs;
import com.pulumi.gcp.accesscontextmanager.AccessLevel;
import com.pulumi.gcp.accesscontextmanager.AccessLevelArgs;
import com.pulumi.gcp.accesscontextmanager.inputs.AccessLevelBasicArgs;
import com.pulumi.gcp.serviceaccount.Account;
import com.pulumi.gcp.serviceaccount.AccountArgs;
import com.pulumi.gcp.accesscontextmanager.AccessLevelCondition;
import com.pulumi.gcp.accesscontextmanager.AccessLevelConditionArgs;
import com.pulumi.gcp.accesscontextmanager.inputs.AccessLevelConditionDevicePolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var access_policy = new AccessPolicy("access-policy", AccessPolicyArgs.builder()
.parent("organizations/123456789")
.title("my policy")
.build());
var access_level_service_account = new AccessLevel("access-level-service-account", AccessLevelArgs.builder()
.parent(access_policy.name().applyValue(name -> String.format("accessPolicies/%s", name)))
.name(access_policy.name().applyValue(name -> String.format("accessPolicies/%s/accessLevels/chromeos_no_lock", name)))
.title("chromeos_no_lock")
.basic(AccessLevelBasicArgs.builder()
.conditions(AccessLevelBasicConditionArgs.builder()
.devicePolicy(AccessLevelBasicConditionDevicePolicyArgs.builder()
.requireScreenLock(true)
.osConstraints(AccessLevelBasicConditionDevicePolicyOsConstraintArgs.builder()
.osType("DESKTOP_CHROME_OS")
.build())
.build())
.regions(
"CH",
"IT",
"US")
.build())
.build())
.build());
var created_later = new Account("created-later", AccountArgs.builder()
.accountId("my-account-id")
.build());
var access_level_conditions = new AccessLevelCondition("access-level-conditions", AccessLevelConditionArgs.builder()
.accessLevel(access_level_service_account.name())
.ipSubnetworks("192.0.4.0/24")
.members(
"user:test@google.com",
"user:test2@google.com",
created_later.email().applyValue(email -> String.format("serviceAccount:%s", email)))
.negate(false)
.devicePolicy(AccessLevelConditionDevicePolicyArgs.builder()
.requireScreenLock(false)
.requireAdminApproval(false)
.requireCorpOwned(true)
.osConstraints(AccessLevelConditionDevicePolicyOsConstraintArgs.builder()
.osType("DESKTOP_CHROME_OS")
.build())
.build())
.regions(
"IT",
"US")
.build());
}
}
resources:
access-level-service-account:
type: gcp:accesscontextmanager:AccessLevel
properties:
parent: accessPolicies/${["access-policy"].name}
name: accessPolicies/${["access-policy"].name}/accessLevels/chromeos_no_lock
title: chromeos_no_lock
basic:
conditions:
- devicePolicy:
requireScreenLock: true
osConstraints:
- osType: DESKTOP_CHROME_OS
regions:
- CH
- IT
- US
created-later:
type: gcp:serviceaccount:Account
properties:
accountId: my-account-id
access-level-conditions:
type: gcp:accesscontextmanager:AccessLevelCondition
properties:
accessLevel: ${["access-level-service-account"].name}
ipSubnetworks:
- 192.0.4.0/24
members:
- user:test@google.com
- user:test2@google.com
- serviceAccount:${["created-later"].email}
negate: false
devicePolicy:
requireScreenLock: false
requireAdminApproval: false
requireCorpOwned: true
osConstraints:
- osType: DESKTOP_CHROME_OS
regions:
- IT
- US
access-policy:
type: gcp:accesscontextmanager:AccessPolicy
properties:
parent: organizations/123456789
title: my policy
Create AccessLevelCondition Resource
Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.
Constructor syntax
new AccessLevelCondition(name: string, args: AccessLevelConditionArgs, opts?: CustomResourceOptions);@overload
def AccessLevelCondition(resource_name: str,
args: AccessLevelConditionArgs,
opts: Optional[ResourceOptions] = None)
@overload
def AccessLevelCondition(resource_name: str,
opts: Optional[ResourceOptions] = None,
access_level: Optional[str] = None,
device_policy: Optional[AccessLevelConditionDevicePolicyArgs] = None,
ip_subnetworks: Optional[Sequence[str]] = None,
members: Optional[Sequence[str]] = None,
negate: Optional[bool] = None,
regions: Optional[Sequence[str]] = None,
required_access_levels: Optional[Sequence[str]] = None,
vpc_network_sources: Optional[Sequence[AccessLevelConditionVpcNetworkSourceArgs]] = None)func NewAccessLevelCondition(ctx *Context, name string, args AccessLevelConditionArgs, opts ...ResourceOption) (*AccessLevelCondition, error)public AccessLevelCondition(string name, AccessLevelConditionArgs args, CustomResourceOptions? opts = null)public AccessLevelCondition(String name, AccessLevelConditionArgs args)
public AccessLevelCondition(String name, AccessLevelConditionArgs args, CustomResourceOptions options)
type: gcp:accesscontextmanager:AccessLevelCondition
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
Parameters
- name
This property is required. string - The unique name of the resource.
- args
This property is required. AccessLevelConditionArgs - The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name
This property is required. str - The unique name of the resource.
- args
This property is required. AccessLevelConditionArgs - The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name
This property is required. string - The unique name of the resource.
- args
This property is required. AccessLevelConditionArgs - The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name
This property is required. string - The unique name of the resource.
- args
This property is required. AccessLevelConditionArgs - The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name
This property is required. String - The unique name of the resource.
- args
This property is required. AccessLevelConditionArgs - The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
Constructor example
The following reference example uses placeholder values for all input properties.
var accessLevelConditionResource = new Gcp.AccessContextManager.AccessLevelCondition("accessLevelConditionResource", new()
{
AccessLevel = "string",
DevicePolicy = new Gcp.AccessContextManager.Inputs.AccessLevelConditionDevicePolicyArgs
{
AllowedDeviceManagementLevels = new[]
{
"string",
},
AllowedEncryptionStatuses = new[]
{
"string",
},
OsConstraints = new[]
{
new Gcp.AccessContextManager.Inputs.AccessLevelConditionDevicePolicyOsConstraintArgs
{
OsType = "string",
MinimumVersion = "string",
},
},
RequireAdminApproval = false,
RequireCorpOwned = false,
RequireScreenLock = false,
},
IpSubnetworks = new[]
{
"string",
},
Members = new[]
{
"string",
},
Negate = false,
Regions = new[]
{
"string",
},
RequiredAccessLevels = new[]
{
"string",
},
VpcNetworkSources = new[]
{
new Gcp.AccessContextManager.Inputs.AccessLevelConditionVpcNetworkSourceArgs
{
VpcSubnetwork = new Gcp.AccessContextManager.Inputs.AccessLevelConditionVpcNetworkSourceVpcSubnetworkArgs
{
Network = "string",
VpcIpSubnetworks = new[]
{
"string",
},
},
},
},
});
example, err := accesscontextmanager.NewAccessLevelCondition(ctx, "accessLevelConditionResource", &accesscontextmanager.AccessLevelConditionArgs{
AccessLevel: pulumi.String("string"),
DevicePolicy: &accesscontextmanager.AccessLevelConditionDevicePolicyArgs{
AllowedDeviceManagementLevels: pulumi.StringArray{
pulumi.String("string"),
},
AllowedEncryptionStatuses: pulumi.StringArray{
pulumi.String("string"),
},
OsConstraints: accesscontextmanager.AccessLevelConditionDevicePolicyOsConstraintArray{
&accesscontextmanager.AccessLevelConditionDevicePolicyOsConstraintArgs{
OsType: pulumi.String("string"),
MinimumVersion: pulumi.String("string"),
},
},
RequireAdminApproval: pulumi.Bool(false),
RequireCorpOwned: pulumi.Bool(false),
RequireScreenLock: pulumi.Bool(false),
},
IpSubnetworks: pulumi.StringArray{
pulumi.String("string"),
},
Members: pulumi.StringArray{
pulumi.String("string"),
},
Negate: pulumi.Bool(false),
Regions: pulumi.StringArray{
pulumi.String("string"),
},
RequiredAccessLevels: pulumi.StringArray{
pulumi.String("string"),
},
VpcNetworkSources: accesscontextmanager.AccessLevelConditionVpcNetworkSourceArray{
&accesscontextmanager.AccessLevelConditionVpcNetworkSourceArgs{
VpcSubnetwork: &accesscontextmanager.AccessLevelConditionVpcNetworkSourceVpcSubnetworkArgs{
Network: pulumi.String("string"),
VpcIpSubnetworks: pulumi.StringArray{
pulumi.String("string"),
},
},
},
},
})
var accessLevelConditionResource = new AccessLevelCondition("accessLevelConditionResource", AccessLevelConditionArgs.builder()
.accessLevel("string")
.devicePolicy(AccessLevelConditionDevicePolicyArgs.builder()
.allowedDeviceManagementLevels("string")
.allowedEncryptionStatuses("string")
.osConstraints(AccessLevelConditionDevicePolicyOsConstraintArgs.builder()
.osType("string")
.minimumVersion("string")
.build())
.requireAdminApproval(false)
.requireCorpOwned(false)
.requireScreenLock(false)
.build())
.ipSubnetworks("string")
.members("string")
.negate(false)
.regions("string")
.requiredAccessLevels("string")
.vpcNetworkSources(AccessLevelConditionVpcNetworkSourceArgs.builder()
.vpcSubnetwork(AccessLevelConditionVpcNetworkSourceVpcSubnetworkArgs.builder()
.network("string")
.vpcIpSubnetworks("string")
.build())
.build())
.build());
access_level_condition_resource = gcp.accesscontextmanager.AccessLevelCondition("accessLevelConditionResource",
access_level="string",
device_policy={
"allowed_device_management_levels": ["string"],
"allowed_encryption_statuses": ["string"],
"os_constraints": [{
"os_type": "string",
"minimum_version": "string",
}],
"require_admin_approval": False,
"require_corp_owned": False,
"require_screen_lock": False,
},
ip_subnetworks=["string"],
members=["string"],
negate=False,
regions=["string"],
required_access_levels=["string"],
vpc_network_sources=[{
"vpc_subnetwork": {
"network": "string",
"vpc_ip_subnetworks": ["string"],
},
}])
const accessLevelConditionResource = new gcp.accesscontextmanager.AccessLevelCondition("accessLevelConditionResource", {
accessLevel: "string",
devicePolicy: {
allowedDeviceManagementLevels: ["string"],
allowedEncryptionStatuses: ["string"],
osConstraints: [{
osType: "string",
minimumVersion: "string",
}],
requireAdminApproval: false,
requireCorpOwned: false,
requireScreenLock: false,
},
ipSubnetworks: ["string"],
members: ["string"],
negate: false,
regions: ["string"],
requiredAccessLevels: ["string"],
vpcNetworkSources: [{
vpcSubnetwork: {
network: "string",
vpcIpSubnetworks: ["string"],
},
}],
});
type: gcp:accesscontextmanager:AccessLevelCondition
properties:
accessLevel: string
devicePolicy:
allowedDeviceManagementLevels:
- string
allowedEncryptionStatuses:
- string
osConstraints:
- minimumVersion: string
osType: string
requireAdminApproval: false
requireCorpOwned: false
requireScreenLock: false
ipSubnetworks:
- string
members:
- string
negate: false
regions:
- string
requiredAccessLevels:
- string
vpcNetworkSources:
- vpcSubnetwork:
network: string
vpcIpSubnetworks:
- string
AccessLevelCondition Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.
The AccessLevelCondition resource accepts the following input properties:
- Access
Level stringThis property is required. 
Changes to this property will trigger replacement. - The name of the Access Level to add this condition to.
- Device
Policy Level Condition Device Policy - Device specific restrictions, all restrictions must hold for the Condition to be true. If not specified, all devices are allowed. Structure is documented below.
- Ip
Subnetworks - A list of CIDR block IP subnetwork specification. May be IPv4 or IPv6. Note that for a CIDR IP address block, the specified IP address portion must be properly truncated (i.e. all the host bits must be zero) or the input is considered malformed. For example, "192.0.2.0/24" is accepted but "192.0.2.1/24" is not. Similarly, for IPv6, "2001:db8::/32" is accepted whereas "2001:db8::1/32" is not. The originating IP of a request must be in one of the listed subnets in order for this Condition to be true. If empty, all IP addresses are allowed.
- Members
- An allowed list of members (users, service accounts).
Using groups is not supported yet.
The signed-in user originating the request must be a part of one
of the provided members. If not specified, a request may come
from any user (logged in/not logged in, not present in any
groups, etc.).
Formats:
user:{emailid},serviceAccount:{emailid} - Negate
- Whether to negate the Condition. If true, the Condition becomes a NAND over its non-empty fields, each field must be false for the Condition overall to be satisfied. Defaults to false.
- Regions
- The request must originate from one of the provided countries/regions. Format: A valid ISO 3166-1 alpha-2 code.
- Required
Access Levels - A list of other access levels defined in the same Policy, referenced by resource name. Referencing an AccessLevel which does not exist is an error. All access levels listed must be granted for the Condition to be true. Format: accessPolicies/{policy_id}/accessLevels/{short_name}
- Vpc
Network Sources Level Condition Vpc Network Source> - The request must originate from one of the provided VPC networks in Google Cloud. Cannot specify this field together with
ip_subnetworks. Structure is documented below.
- Access
Level stringThis property is required. Changes to this property will trigger replacement. - The name of the Access Level to add this condition to.
- Device
Policy Level Condition Device Policy Args - Device specific restrictions, all restrictions must hold for the Condition to be true. If not specified, all devices are allowed. Structure is documented below.
- Ip
Subnetworks - A list of CIDR block IP subnetwork specification. May be IPv4 or IPv6. Note that for a CIDR IP address block, the specified IP address portion must be properly truncated (i.e. all the host bits must be zero) or the input is considered malformed. For example, "192.0.2.0/24" is accepted but "192.0.2.1/24" is not. Similarly, for IPv6, "2001:db8::/32" is accepted whereas "2001:db8::1/32" is not. The originating IP of a request must be in one of the listed subnets in order for this Condition to be true. If empty, all IP addresses are allowed.
- Members
- An allowed list of members (users, service accounts).
Using groups is not supported yet.
The signed-in user originating the request must be a part of one
of the provided members. If not specified, a request may come
from any user (logged in/not logged in, not present in any
groups, etc.).
Formats:
user:{emailid},serviceAccount:{emailid} - Negate
- Whether to negate the Condition. If true, the Condition becomes a NAND over its non-empty fields, each field must be false for the Condition overall to be satisfied. Defaults to false.
- Regions
- The request must originate from one of the provided countries/regions. Format: A valid ISO 3166-1 alpha-2 code.
- Required
Access Levels - A list of other access levels defined in the same Policy, referenced by resource name. Referencing an AccessLevel which does not exist is an error. All access levels listed must be granted for the Condition to be true. Format: accessPolicies/{policy_id}/accessLevels/{short_name}
- Vpc
Network Sources Level Condition Vpc Network Source Args - The request must originate from one of the provided VPC networks in Google Cloud. Cannot specify this field together with
ip_subnetworks. Structure is documented below.
- access
Level StringThis property is required. Changes to this property will trigger replacement. - The name of the Access Level to add this condition to.
- device
Policy Level Condition Device Policy - Device specific restrictions, all restrictions must hold for the Condition to be true. If not specified, all devices are allowed. Structure is documented below.
- ip
Subnetworks - A list of CIDR block IP subnetwork specification. May be IPv4 or IPv6. Note that for a CIDR IP address block, the specified IP address portion must be properly truncated (i.e. all the host bits must be zero) or the input is considered malformed. For example, "192.0.2.0/24" is accepted but "192.0.2.1/24" is not. Similarly, for IPv6, "2001:db8::/32" is accepted whereas "2001:db8::1/32" is not. The originating IP of a request must be in one of the listed subnets in order for this Condition to be true. If empty, all IP addresses are allowed.
- members
- An allowed list of members (users, service accounts).
Using groups is not supported yet.
The signed-in user originating the request must be a part of one
of the provided members. If not specified, a request may come
from any user (logged in/not logged in, not present in any
groups, etc.).
Formats:
user:{emailid},serviceAccount:{emailid} - negate
- Whether to negate the Condition. If true, the Condition becomes a NAND over its non-empty fields, each field must be false for the Condition overall to be satisfied. Defaults to false.
- regions
- The request must originate from one of the provided countries/regions. Format: A valid ISO 3166-1 alpha-2 code.
- required
Access Levels - A list of other access levels defined in the same Policy, referenced by resource name. Referencing an AccessLevel which does not exist is an error. All access levels listed must be granted for the Condition to be true. Format: accessPolicies/{policy_id}/accessLevels/{short_name}
- vpc
Network Sources Level Condition Vpc Network Source> - The request must originate from one of the provided VPC networks in Google Cloud. Cannot specify this field together with
ip_subnetworks. Structure is documented below.
- access
Level stringThis property is required. Changes to this property will trigger replacement. - The name of the Access Level to add this condition to.
- device
Policy Level Condition Device Policy - Device specific restrictions, all restrictions must hold for the Condition to be true. If not specified, all devices are allowed. Structure is documented below.
- ip
Subnetworks - A list of CIDR block IP subnetwork specification. May be IPv4 or IPv6. Note that for a CIDR IP address block, the specified IP address portion must be properly truncated (i.e. all the host bits must be zero) or the input is considered malformed. For example, "192.0.2.0/24" is accepted but "192.0.2.1/24" is not. Similarly, for IPv6, "2001:db8::/32" is accepted whereas "2001:db8::1/32" is not. The originating IP of a request must be in one of the listed subnets in order for this Condition to be true. If empty, all IP addresses are allowed.
- members
- An allowed list of members (users, service accounts).
Using groups is not supported yet.
The signed-in user originating the request must be a part of one
of the provided members. If not specified, a request may come
from any user (logged in/not logged in, not present in any
groups, etc.).
Formats:
user:{emailid},serviceAccount:{emailid} - negate
- Whether to negate the Condition. If true, the Condition becomes a NAND over its non-empty fields, each field must be false for the Condition overall to be satisfied. Defaults to false.
- regions
- The request must originate from one of the provided countries/regions. Format: A valid ISO 3166-1 alpha-2 code.
- required
Access Levels - A list of other access levels defined in the same Policy, referenced by resource name. Referencing an AccessLevel which does not exist is an error. All access levels listed must be granted for the Condition to be true. Format: accessPolicies/{policy_id}/accessLevels/{short_name}
- vpc
Network Sources Level Condition Vpc Network Source[] - The request must originate from one of the provided VPC networks in Google Cloud. Cannot specify this field together with
ip_subnetworks. Structure is documented below.
- access_
level strThis property is required. Changes to this property will trigger replacement. - The name of the Access Level to add this condition to.
- device_
policy Level Condition Device Policy Args - Device specific restrictions, all restrictions must hold for the Condition to be true. If not specified, all devices are allowed. Structure is documented below.
- ip_
subnetworks - A list of CIDR block IP subnetwork specification. May be IPv4 or IPv6. Note that for a CIDR IP address block, the specified IP address portion must be properly truncated (i.e. all the host bits must be zero) or the input is considered malformed. For example, "192.0.2.0/24" is accepted but "192.0.2.1/24" is not. Similarly, for IPv6, "2001:db8::/32" is accepted whereas "2001:db8::1/32" is not. The originating IP of a request must be in one of the listed subnets in order for this Condition to be true. If empty, all IP addresses are allowed.
- members
- An allowed list of members (users, service accounts).
Using groups is not supported yet.
The signed-in user originating the request must be a part of one
of the provided members. If not specified, a request may come
from any user (logged in/not logged in, not present in any
groups, etc.).
Formats:
user:{emailid},serviceAccount:{emailid} - negate
- Whether to negate the Condition. If true, the Condition becomes a NAND over its non-empty fields, each field must be false for the Condition overall to be satisfied. Defaults to false.
- regions
- The request must originate from one of the provided countries/regions. Format: A valid ISO 3166-1 alpha-2 code.
- required_
access_ levels - A list of other access levels defined in the same Policy, referenced by resource name. Referencing an AccessLevel which does not exist is an error. All access levels listed must be granted for the Condition to be true. Format: accessPolicies/{policy_id}/accessLevels/{short_name}
- vpc_
network_ sources Level Condition Vpc Network Source Args] - The request must originate from one of the provided VPC networks in Google Cloud. Cannot specify this field together with
ip_subnetworks. Structure is documented below.
- access
Level StringThis property is required. Changes to this property will trigger replacement. - The name of the Access Level to add this condition to.
- device
Policy - Device specific restrictions, all restrictions must hold for the Condition to be true. If not specified, all devices are allowed. Structure is documented below.
- ip
Subnetworks - A list of CIDR block IP subnetwork specification. May be IPv4 or IPv6. Note that for a CIDR IP address block, the specified IP address portion must be properly truncated (i.e. all the host bits must be zero) or the input is considered malformed. For example, "192.0.2.0/24" is accepted but "192.0.2.1/24" is not. Similarly, for IPv6, "2001:db8::/32" is accepted whereas "2001:db8::1/32" is not. The originating IP of a request must be in one of the listed subnets in order for this Condition to be true. If empty, all IP addresses are allowed.
- members
- An allowed list of members (users, service accounts).
Using groups is not supported yet.
The signed-in user originating the request must be a part of one
of the provided members. If not specified, a request may come
from any user (logged in/not logged in, not present in any
groups, etc.).
Formats:
user:{emailid},serviceAccount:{emailid} - negate
- Whether to negate the Condition. If true, the Condition becomes a NAND over its non-empty fields, each field must be false for the Condition overall to be satisfied. Defaults to false.
- regions
- The request must originate from one of the provided countries/regions. Format: A valid ISO 3166-1 alpha-2 code.
- required
Access Levels - A list of other access levels defined in the same Policy, referenced by resource name. Referencing an AccessLevel which does not exist is an error. All access levels listed must be granted for the Condition to be true. Format: accessPolicies/{policy_id}/accessLevels/{short_name}
- vpc
Network Sources - The request must originate from one of the provided VPC networks in Google Cloud. Cannot specify this field together with
ip_subnetworks. Structure is documented below.
Outputs
All input properties are implicitly available as output properties. Additionally, the AccessLevelCondition resource produces the following output properties:
- Access
Policy stringId - The name of the Access Policy this resource belongs to.
- Id string
- The provider-assigned unique ID for this managed resource.
- Access
Policy stringId - The name of the Access Policy this resource belongs to.
- Id string
- The provider-assigned unique ID for this managed resource.
- access
Policy StringId - The name of the Access Policy this resource belongs to.
- id String
- The provider-assigned unique ID for this managed resource.
- access
Policy stringId - The name of the Access Policy this resource belongs to.
- id string
- The provider-assigned unique ID for this managed resource.
- access_
policy_ strid - The name of the Access Policy this resource belongs to.
- id str
- The provider-assigned unique ID for this managed resource.
- access
Policy StringId - The name of the Access Policy this resource belongs to.
- id String
- The provider-assigned unique ID for this managed resource.
Look up Existing AccessLevelCondition Resource
Get an existing AccessLevelCondition resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.
public static get(name: string, id: Input<ID>, state?: AccessLevelConditionState, opts?: CustomResourceOptions): AccessLevelCondition@staticmethod
def get(resource_name: str,
id: str,
opts: Optional[ResourceOptions] = None,
access_level: Optional[str] = None,
access_policy_id: Optional[str] = None,
device_policy: Optional[AccessLevelConditionDevicePolicyArgs] = None,
ip_subnetworks: Optional[Sequence[str]] = None,
members: Optional[Sequence[str]] = None,
negate: Optional[bool] = None,
regions: Optional[Sequence[str]] = None,
required_access_levels: Optional[Sequence[str]] = None,
vpc_network_sources: Optional[Sequence[AccessLevelConditionVpcNetworkSourceArgs]] = None) -> AccessLevelConditionfunc GetAccessLevelCondition(ctx *Context, name string, id IDInput, state *AccessLevelConditionState, opts ...ResourceOption) (*AccessLevelCondition, error)public static AccessLevelCondition Get(string name, Input<string> id, AccessLevelConditionState? state, CustomResourceOptions? opts = null)public static AccessLevelCondition get(String name, Output<String> id, AccessLevelConditionState state, CustomResourceOptions options)resources: _: type: gcp:accesscontextmanager:AccessLevelCondition get: id: ${id}- name
This property is required. - The unique name of the resulting resource.
- id
This property is required. - The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- resource_name
This property is required. - The unique name of the resulting resource.
- id
This property is required. - The unique provider ID of the resource to lookup.
- name
This property is required. - The unique name of the resulting resource.
- id
This property is required. - The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
This property is required. - The unique name of the resulting resource.
- id
This property is required. - The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
This property is required. - The unique name of the resulting resource.
- id
This property is required. - The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
The following state arguments are supported:
- Access
Level - The name of the Access Level to add this condition to.
- Access
Policy stringId - The name of the Access Policy this resource belongs to.
- Device
Policy Level Condition Device Policy - Device specific restrictions, all restrictions must hold for the Condition to be true. If not specified, all devices are allowed. Structure is documented below.
- Ip
Subnetworks - A list of CIDR block IP subnetwork specification. May be IPv4 or IPv6. Note that for a CIDR IP address block, the specified IP address portion must be properly truncated (i.e. all the host bits must be zero) or the input is considered malformed. For example, "192.0.2.0/24" is accepted but "192.0.2.1/24" is not. Similarly, for IPv6, "2001:db8::/32" is accepted whereas "2001:db8::1/32" is not. The originating IP of a request must be in one of the listed subnets in order for this Condition to be true. If empty, all IP addresses are allowed.
- Members
- An allowed list of members (users, service accounts).
Using groups is not supported yet.
The signed-in user originating the request must be a part of one
of the provided members. If not specified, a request may come
from any user (logged in/not logged in, not present in any
groups, etc.).
Formats:
user:{emailid},serviceAccount:{emailid} - Negate
- Whether to negate the Condition. If true, the Condition becomes a NAND over its non-empty fields, each field must be false for the Condition overall to be satisfied. Defaults to false.
- Regions
- The request must originate from one of the provided countries/regions. Format: A valid ISO 3166-1 alpha-2 code.
- Required
Access Levels - A list of other access levels defined in the same Policy, referenced by resource name. Referencing an AccessLevel which does not exist is an error. All access levels listed must be granted for the Condition to be true. Format: accessPolicies/{policy_id}/accessLevels/{short_name}
- Vpc
Network Sources Level Condition Vpc Network Source> - The request must originate from one of the provided VPC networks in Google Cloud. Cannot specify this field together with
ip_subnetworks. Structure is documented below.
- Access
Level - The name of the Access Level to add this condition to.
- Access
Policy stringId - The name of the Access Policy this resource belongs to.
- Device
Policy Level Condition Device Policy Args - Device specific restrictions, all restrictions must hold for the Condition to be true. If not specified, all devices are allowed. Structure is documented below.
- Ip
Subnetworks - A list of CIDR block IP subnetwork specification. May be IPv4 or IPv6. Note that for a CIDR IP address block, the specified IP address portion must be properly truncated (i.e. all the host bits must be zero) or the input is considered malformed. For example, "192.0.2.0/24" is accepted but "192.0.2.1/24" is not. Similarly, for IPv6, "2001:db8::/32" is accepted whereas "2001:db8::1/32" is not. The originating IP of a request must be in one of the listed subnets in order for this Condition to be true. If empty, all IP addresses are allowed.
- Members
- An allowed list of members (users, service accounts).
Using groups is not supported yet.
The signed-in user originating the request must be a part of one
of the provided members. If not specified, a request may come
from any user (logged in/not logged in, not present in any
groups, etc.).
Formats:
user:{emailid},serviceAccount:{emailid} - Negate
- Whether to negate the Condition. If true, the Condition becomes a NAND over its non-empty fields, each field must be false for the Condition overall to be satisfied. Defaults to false.
- Regions
- The request must originate from one of the provided countries/regions. Format: A valid ISO 3166-1 alpha-2 code.
- Required
Access Levels - A list of other access levels defined in the same Policy, referenced by resource name. Referencing an AccessLevel which does not exist is an error. All access levels listed must be granted for the Condition to be true. Format: accessPolicies/{policy_id}/accessLevels/{short_name}
- Vpc
Network Sources Level Condition Vpc Network Source Args - The request must originate from one of the provided VPC networks in Google Cloud. Cannot specify this field together with
ip_subnetworks. Structure is documented below.
- access
Level - The name of the Access Level to add this condition to.
- access
Policy StringId - The name of the Access Policy this resource belongs to.
- device
Policy Level Condition Device Policy - Device specific restrictions, all restrictions must hold for the Condition to be true. If not specified, all devices are allowed. Structure is documented below.
- ip
Subnetworks - A list of CIDR block IP subnetwork specification. May be IPv4 or IPv6. Note that for a CIDR IP address block, the specified IP address portion must be properly truncated (i.e. all the host bits must be zero) or the input is considered malformed. For example, "192.0.2.0/24" is accepted but "192.0.2.1/24" is not. Similarly, for IPv6, "2001:db8::/32" is accepted whereas "2001:db8::1/32" is not. The originating IP of a request must be in one of the listed subnets in order for this Condition to be true. If empty, all IP addresses are allowed.
- members
- An allowed list of members (users, service accounts).
Using groups is not supported yet.
The signed-in user originating the request must be a part of one
of the provided members. If not specified, a request may come
from any user (logged in/not logged in, not present in any
groups, etc.).
Formats:
user:{emailid},serviceAccount:{emailid} - negate
- Whether to negate the Condition. If true, the Condition becomes a NAND over its non-empty fields, each field must be false for the Condition overall to be satisfied. Defaults to false.
- regions
- The request must originate from one of the provided countries/regions. Format: A valid ISO 3166-1 alpha-2 code.
- required
Access Levels - A list of other access levels defined in the same Policy, referenced by resource name. Referencing an AccessLevel which does not exist is an error. All access levels listed must be granted for the Condition to be true. Format: accessPolicies/{policy_id}/accessLevels/{short_name}
- vpc
Network Sources Level Condition Vpc Network Source> - The request must originate from one of the provided VPC networks in Google Cloud. Cannot specify this field together with
ip_subnetworks. Structure is documented below.
- access
Level - The name of the Access Level to add this condition to.
- access
Policy stringId - The name of the Access Policy this resource belongs to.
- device
Policy Level Condition Device Policy - Device specific restrictions, all restrictions must hold for the Condition to be true. If not specified, all devices are allowed. Structure is documented below.
- ip
Subnetworks - A list of CIDR block IP subnetwork specification. May be IPv4 or IPv6. Note that for a CIDR IP address block, the specified IP address portion must be properly truncated (i.e. all the host bits must be zero) or the input is considered malformed. For example, "192.0.2.0/24" is accepted but "192.0.2.1/24" is not. Similarly, for IPv6, "2001:db8::/32" is accepted whereas "2001:db8::1/32" is not. The originating IP of a request must be in one of the listed subnets in order for this Condition to be true. If empty, all IP addresses are allowed.
- members
- An allowed list of members (users, service accounts).
Using groups is not supported yet.
The signed-in user originating the request must be a part of one
of the provided members. If not specified, a request may come
from any user (logged in/not logged in, not present in any
groups, etc.).
Formats:
user:{emailid},serviceAccount:{emailid} - negate
- Whether to negate the Condition. If true, the Condition becomes a NAND over its non-empty fields, each field must be false for the Condition overall to be satisfied. Defaults to false.
- regions
- The request must originate from one of the provided countries/regions. Format: A valid ISO 3166-1 alpha-2 code.
- required
Access Levels - A list of other access levels defined in the same Policy, referenced by resource name. Referencing an AccessLevel which does not exist is an error. All access levels listed must be granted for the Condition to be true. Format: accessPolicies/{policy_id}/accessLevels/{short_name}
- vpc
Network Sources Level Condition Vpc Network Source[] - The request must originate from one of the provided VPC networks in Google Cloud. Cannot specify this field together with
ip_subnetworks. Structure is documented below.
- access_
level - The name of the Access Level to add this condition to.
- access_
policy_ strid - The name of the Access Policy this resource belongs to.
- device_
policy Level Condition Device Policy Args - Device specific restrictions, all restrictions must hold for the Condition to be true. If not specified, all devices are allowed. Structure is documented below.
- ip_
subnetworks - A list of CIDR block IP subnetwork specification. May be IPv4 or IPv6. Note that for a CIDR IP address block, the specified IP address portion must be properly truncated (i.e. all the host bits must be zero) or the input is considered malformed. For example, "192.0.2.0/24" is accepted but "192.0.2.1/24" is not. Similarly, for IPv6, "2001:db8::/32" is accepted whereas "2001:db8::1/32" is not. The originating IP of a request must be in one of the listed subnets in order for this Condition to be true. If empty, all IP addresses are allowed.
- members
- An allowed list of members (users, service accounts).
Using groups is not supported yet.
The signed-in user originating the request must be a part of one
of the provided members. If not specified, a request may come
from any user (logged in/not logged in, not present in any
groups, etc.).
Formats:
user:{emailid},serviceAccount:{emailid} - negate
- Whether to negate the Condition. If true, the Condition becomes a NAND over its non-empty fields, each field must be false for the Condition overall to be satisfied. Defaults to false.
- regions
- The request must originate from one of the provided countries/regions. Format: A valid ISO 3166-1 alpha-2 code.
- required_
access_ levels - A list of other access levels defined in the same Policy, referenced by resource name. Referencing an AccessLevel which does not exist is an error. All access levels listed must be granted for the Condition to be true. Format: accessPolicies/{policy_id}/accessLevels/{short_name}
- vpc_
network_ sources Level Condition Vpc Network Source Args] - The request must originate from one of the provided VPC networks in Google Cloud. Cannot specify this field together with
ip_subnetworks. Structure is documented below.
- access
Level - The name of the Access Level to add this condition to.
- access
Policy StringId - The name of the Access Policy this resource belongs to.
- device
Policy - Device specific restrictions, all restrictions must hold for the Condition to be true. If not specified, all devices are allowed. Structure is documented below.
- ip
Subnetworks - A list of CIDR block IP subnetwork specification. May be IPv4 or IPv6. Note that for a CIDR IP address block, the specified IP address portion must be properly truncated (i.e. all the host bits must be zero) or the input is considered malformed. For example, "192.0.2.0/24" is accepted but "192.0.2.1/24" is not. Similarly, for IPv6, "2001:db8::/32" is accepted whereas "2001:db8::1/32" is not. The originating IP of a request must be in one of the listed subnets in order for this Condition to be true. If empty, all IP addresses are allowed.
- members
- An allowed list of members (users, service accounts).
Using groups is not supported yet.
The signed-in user originating the request must be a part of one
of the provided members. If not specified, a request may come
from any user (logged in/not logged in, not present in any
groups, etc.).
Formats:
user:{emailid},serviceAccount:{emailid} - negate
- Whether to negate the Condition. If true, the Condition becomes a NAND over its non-empty fields, each field must be false for the Condition overall to be satisfied. Defaults to false.
- regions
- The request must originate from one of the provided countries/regions. Format: A valid ISO 3166-1 alpha-2 code.
- required
Access Levels - A list of other access levels defined in the same Policy, referenced by resource name. Referencing an AccessLevel which does not exist is an error. All access levels listed must be granted for the Condition to be true. Format: accessPolicies/{policy_id}/accessLevels/{short_name}
- vpc
Network Sources - The request must originate from one of the provided VPC networks in Google Cloud. Cannot specify this field together with
ip_subnetworks. Structure is documented below.
Supporting Types
AccessLevelConditionDevicePolicy, AccessLevelConditionDevicePolicyArgs
, AccessLevelConditionDevicePolicyArgs
- Allowed
Device Management Levels - A list of allowed device management levels.
An empty list allows all management levels.
Each value may be one of:
MANAGEMENT_UNSPECIFIED,NONE,BASIC,COMPLETE. - Allowed
Encryption Statuses - A list of allowed encryptions statuses.
An empty list allows all statuses.
Each value may be one of:
ENCRYPTION_UNSPECIFIED,ENCRYPTION_UNSUPPORTED,UNENCRYPTED,ENCRYPTED. - Os
Constraints Level Condition Device Policy Os Constraint> - A list of allowed OS versions. An empty list allows all types and all versions. Structure is documented below.
- Require
Admin Approval - Whether the device needs to be approved by the customer admin.
- Require
Corp Owned - Whether the device needs to be corp owned.
- Require
Screen Lock - Whether or not screenlock is required for the DevicePolicy to be true. Defaults to false.
- Allowed
Device Management Levels - A list of allowed device management levels.
An empty list allows all management levels.
Each value may be one of:
MANAGEMENT_UNSPECIFIED,NONE,BASIC,COMPLETE. - Allowed
Encryption Statuses - A list of allowed encryptions statuses.
An empty list allows all statuses.
Each value may be one of:
ENCRYPTION_UNSPECIFIED,ENCRYPTION_UNSUPPORTED,UNENCRYPTED,ENCRYPTED. - Os
Constraints Level Condition Device Policy Os Constraint - A list of allowed OS versions. An empty list allows all types and all versions. Structure is documented below.
- Require
Admin Approval - Whether the device needs to be approved by the customer admin.
- Require
Corp Owned - Whether the device needs to be corp owned.
- Require
Screen Lock - Whether or not screenlock is required for the DevicePolicy to be true. Defaults to false.
- allowed
Device Management Levels - A list of allowed device management levels.
An empty list allows all management levels.
Each value may be one of:
MANAGEMENT_UNSPECIFIED,NONE,BASIC,COMPLETE. - allowed
Encryption Statuses - A list of allowed encryptions statuses.
An empty list allows all statuses.
Each value may be one of:
ENCRYPTION_UNSPECIFIED,ENCRYPTION_UNSUPPORTED,UNENCRYPTED,ENCRYPTED. - os
Constraints Level Condition Device Policy Os Constraint> - A list of allowed OS versions. An empty list allows all types and all versions. Structure is documented below.
- require
Admin Approval - Whether the device needs to be approved by the customer admin.
- require
Corp Owned - Whether the device needs to be corp owned.
- require
Screen Lock - Whether or not screenlock is required for the DevicePolicy to be true. Defaults to false.
- allowed
Device Management Levels - A list of allowed device management levels.
An empty list allows all management levels.
Each value may be one of:
MANAGEMENT_UNSPECIFIED,NONE,BASIC,COMPLETE. - allowed
Encryption Statuses - A list of allowed encryptions statuses.
An empty list allows all statuses.
Each value may be one of:
ENCRYPTION_UNSPECIFIED,ENCRYPTION_UNSUPPORTED,UNENCRYPTED,ENCRYPTED. - os
Constraints Level Condition Device Policy Os Constraint[] - A list of allowed OS versions. An empty list allows all types and all versions. Structure is documented below.
- require
Admin Approval - Whether the device needs to be approved by the customer admin.
- require
Corp Owned - Whether the device needs to be corp owned.
- require
Screen Lock - Whether or not screenlock is required for the DevicePolicy to be true. Defaults to false.
- allowed_
device_ management_ levels - A list of allowed device management levels.
An empty list allows all management levels.
Each value may be one of:
MANAGEMENT_UNSPECIFIED,NONE,BASIC,COMPLETE. - allowed_
encryption_ statuses - A list of allowed encryptions statuses.
An empty list allows all statuses.
Each value may be one of:
ENCRYPTION_UNSPECIFIED,ENCRYPTION_UNSUPPORTED,UNENCRYPTED,ENCRYPTED. - os_
constraints Level Condition Device Policy Os Constraint] - A list of allowed OS versions. An empty list allows all types and all versions. Structure is documented below.
- require_
admin_ approval - Whether the device needs to be approved by the customer admin.
- require_
corp_ owned - Whether the device needs to be corp owned.
- require_
screen_ lock - Whether or not screenlock is required for the DevicePolicy to be true. Defaults to false.
- allowed
Device Management Levels - A list of allowed device management levels.
An empty list allows all management levels.
Each value may be one of:
MANAGEMENT_UNSPECIFIED,NONE,BASIC,COMPLETE. - allowed
Encryption Statuses - A list of allowed encryptions statuses.
An empty list allows all statuses.
Each value may be one of:
ENCRYPTION_UNSPECIFIED,ENCRYPTION_UNSUPPORTED,UNENCRYPTED,ENCRYPTED. - os
Constraints - A list of allowed OS versions. An empty list allows all types and all versions. Structure is documented below.
- require
Admin Approval - Whether the device needs to be approved by the customer admin.
- require
Corp Owned - Whether the device needs to be corp owned.
- require
Screen Lock - Whether or not screenlock is required for the DevicePolicy to be true. Defaults to false.
AccessLevelConditionDevicePolicyOsConstraint, AccessLevelConditionDevicePolicyOsConstraintArgs
, AccessLevelConditionDevicePolicyOsConstraintArgs
- Os
Type stringThis property is required. Changes to this property will trigger replacement. - The operating system type of the device.
Possible values are:
OS_UNSPECIFIED,DESKTOP_MAC,DESKTOP_WINDOWS,DESKTOP_LINUX,DESKTOP_CHROME_OS,ANDROID,IOS. - Minimum
Version - The minimum allowed OS version. If not set, any version of this OS satisfies the constraint. Format: "major.minor.patch" such as "10.5.301", "9.2.1".
- Os
Type stringThis property is required. Changes to this property will trigger replacement. - The operating system type of the device.
Possible values are:
OS_UNSPECIFIED,DESKTOP_MAC,DESKTOP_WINDOWS,DESKTOP_LINUX,DESKTOP_CHROME_OS,ANDROID,IOS. - Minimum
Version - The minimum allowed OS version. If not set, any version of this OS satisfies the constraint. Format: "major.minor.patch" such as "10.5.301", "9.2.1".
- os
Type StringThis property is required. Changes to this property will trigger replacement. - The operating system type of the device.
Possible values are:
OS_UNSPECIFIED,DESKTOP_MAC,DESKTOP_WINDOWS,DESKTOP_LINUX,DESKTOP_CHROME_OS,ANDROID,IOS. - minimum
Version - The minimum allowed OS version. If not set, any version of this OS satisfies the constraint. Format: "major.minor.patch" such as "10.5.301", "9.2.1".
- os
Type stringThis property is required. Changes to this property will trigger replacement. - The operating system type of the device.
Possible values are:
OS_UNSPECIFIED,DESKTOP_MAC,DESKTOP_WINDOWS,DESKTOP_LINUX,DESKTOP_CHROME_OS,ANDROID,IOS. - minimum
Version - The minimum allowed OS version. If not set, any version of this OS satisfies the constraint. Format: "major.minor.patch" such as "10.5.301", "9.2.1".
- os_
type strThis property is required. Changes to this property will trigger replacement. - The operating system type of the device.
Possible values are:
OS_UNSPECIFIED,DESKTOP_MAC,DESKTOP_WINDOWS,DESKTOP_LINUX,DESKTOP_CHROME_OS,ANDROID,IOS. - minimum_
version - The minimum allowed OS version. If not set, any version of this OS satisfies the constraint. Format: "major.minor.patch" such as "10.5.301", "9.2.1".
- os
Type StringThis property is required. Changes to this property will trigger replacement. - The operating system type of the device.
Possible values are:
OS_UNSPECIFIED,DESKTOP_MAC,DESKTOP_WINDOWS,DESKTOP_LINUX,DESKTOP_CHROME_OS,ANDROID,IOS. - minimum
Version - The minimum allowed OS version. If not set, any version of this OS satisfies the constraint. Format: "major.minor.patch" such as "10.5.301", "9.2.1".
AccessLevelConditionVpcNetworkSource, AccessLevelConditionVpcNetworkSourceArgs
, AccessLevelConditionVpcNetworkSourceArgs
- Vpc
Subnetwork Level Condition Vpc Network Source Vpc Subnetwork - Sub networks within a VPC network. Structure is documented below.
- Vpc
Subnetwork Level Condition Vpc Network Source Vpc Subnetwork - Sub networks within a VPC network. Structure is documented below.
- vpc
Subnetwork Level Condition Vpc Network Source Vpc Subnetwork - Sub networks within a VPC network. Structure is documented below.
- vpc
Subnetwork Level Condition Vpc Network Source Vpc Subnetwork - Sub networks within a VPC network. Structure is documented below.
- vpc_
subnetwork Level Condition Vpc Network Source Vpc Subnetwork - Sub networks within a VPC network. Structure is documented below.
- vpc
Subnetwork - Sub networks within a VPC network. Structure is documented below.
AccessLevelConditionVpcNetworkSourceVpcSubnetwork, AccessLevelConditionVpcNetworkSourceVpcSubnetworkArgs
, AccessLevelConditionVpcNetworkSourceVpcSubnetworkArgs
- Network
string
This property is required. Changes to this property will trigger replacement. - Required. Network name to be allowed by this Access Level. Networks of foreign organizations requires
compute.network.getpermission to be granted to caller. - Vpc
Ip Subnetworks - CIDR block IP subnetwork specification. Must be IPv4.
- Network
string
This property is required. Changes to this property will trigger replacement. - Required. Network name to be allowed by this Access Level. Networks of foreign organizations requires
compute.network.getpermission to be granted to caller. - Vpc
Ip Subnetworks - CIDR block IP subnetwork specification. Must be IPv4.
- network
String
This property is required. Changes to this property will trigger replacement. - Required. Network name to be allowed by this Access Level. Networks of foreign organizations requires
compute.network.getpermission to be granted to caller. - vpc
Ip Subnetworks - CIDR block IP subnetwork specification. Must be IPv4.
- network
string
This property is required. Changes to this property will trigger replacement. - Required. Network name to be allowed by this Access Level. Networks of foreign organizations requires
compute.network.getpermission to be granted to caller. - vpc
Ip Subnetworks - CIDR block IP subnetwork specification. Must be IPv4.
- network
str
This property is required. Changes to this property will trigger replacement. - Required. Network name to be allowed by this Access Level. Networks of foreign organizations requires
compute.network.getpermission to be granted to caller. - vpc_
ip_ subnetworks - CIDR block IP subnetwork specification. Must be IPv4.
- network
String
This property is required. Changes to this property will trigger replacement. - Required. Network name to be allowed by this Access Level. Networks of foreign organizations requires
compute.network.getpermission to be granted to caller. - vpc
Ip Subnetworks - CIDR block IP subnetwork specification. Must be IPv4.
Import
This resource does not support import.
To learn more about importing existing cloud resources, see Importing resources.
Package Details
- Repository
- Google Cloud (GCP) Classic pulumi/pulumi-gcp
- License
- Apache-2.0
- Notes
- This Pulumi package is based on the
google-betaTerraform Provider.