Google Cloud v8.25.0, Apr 3 25

Google Cloud v8.25.0 published on Thursday, Apr 3, 2025 by Pulumi

gcp.compute.NetworkFirewallPolicyWithRules

Explore with Pulumi AI

Google Cloud v8.25.0 published on Thursday, Apr 3, 2025 by Pulumi

Example Usage

Compute Network Firewall Policy With Rules Full

TypeScript
Python
Go
C#
Java
YAML

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const project = gcp.organizations.getProject({});
const addressGroup1 = new gcp.networksecurity.AddressGroup("address_group_1", {
    name: "address-group",
    parent: project.then(project => project.id),
    description: "Global address group",
    location: "global",
    items: ["208.80.154.224/32"],
    type: "IPV4",
    capacity: 100,
});
const secureTagKey1 = new gcp.tags.TagKey("secure_tag_key_1", {
    description: "Tag key",
    parent: project.then(project => project.id),
    purpose: "GCE_FIREWALL",
    shortName: "tag-key",
    purposeData: {
        network: project.then(project => `${project.name}/default`),
    },
});
const secureTagValue1 = new gcp.tags.TagValue("secure_tag_value_1", {
    description: "Tag value",
    parent: secureTagKey1.id,
    shortName: "tag-value",
});
const securityProfile1 = new gcp.networksecurity.SecurityProfile("security_profile_1", {
    name: "sp",
    type: "THREAT_PREVENTION",
    parent: "organizations/123456789",
    location: "global",
});
const securityProfileGroup1 = new gcp.networksecurity.SecurityProfileGroup("security_profile_group_1", {
    name: "spg",
    parent: "organizations/123456789",
    description: "my description",
    threatPreventionProfile: securityProfile1.id,
});
const network = new gcp.compute.Network("network", {
    name: "network",
    autoCreateSubnetworks: false,
});
const primary = new gcp.compute.NetworkFirewallPolicyWithRules("primary", {
    name: "fw-policy",
    description: "Terraform test",
    rules: [
        {
            description: "tcp rule",
            priority: 1000,
            enableLogging: true,
            action: "allow",
            direction: "EGRESS",
            match: {
                destIpRanges: ["11.100.0.1/32"],
                destFqdns: [
                    "www.yyy.com",
                    "www.zzz.com",
                ],
                destRegionCodes: [
                    "HK",
                    "IN",
                ],
                destThreatIntelligences: [
                    "iplist-search-engines-crawlers",
                    "iplist-tor-exit-nodes",
                ],
                destAddressGroups: [addressGroup1.id],
                layer4Configs: [{
                    ipProtocol: "tcp",
                    ports: [
                        "8080",
                        "7070",
                    ],
                }],
            },
            targetSecureTags: [{
                name: secureTagValue1.id,
            }],
        },
        {
            description: "udp rule",
            priority: 2000,
            enableLogging: false,
            action: "deny",
            direction: "INGRESS",
            disabled: true,
            match: {
                srcIpRanges: ["0.0.0.0/0"],
                srcFqdns: [
                    "www.abc.com",
                    "www.def.com",
                ],
                srcRegionCodes: [
                    "US",
                    "CA",
                ],
                srcThreatIntelligences: [
                    "iplist-known-malicious-ips",
                    "iplist-public-clouds",
                ],
                srcAddressGroups: [addressGroup1.id],
                srcSecureTags: [{
                    name: secureTagValue1.id,
                }],
                layer4Configs: [{
                    ipProtocol: "udp",
                }],
            },
        },
        {
            description: "security profile group rule",
            ruleName: "tcp rule",
            priority: 3000,
            enableLogging: false,
            action: "apply_security_profile_group",
            direction: "INGRESS",
            targetServiceAccounts: ["test@google.com"],
            securityProfileGroup: pulumi.interpolate`//networksecurity.googleapis.com/${securityProfileGroup1.id}`,
            tlsInspect: true,
            match: {
                srcIpRanges: ["0.0.0.0/0"],
                layer4Configs: [{
                    ipProtocol: "tcp",
                }],
            },
        },
        {
            description: "network scope rule 1",
            ruleName: "network scope 1",
            priority: 4000,
            enableLogging: false,
            action: "allow",
            direction: "INGRESS",
            match: {
                srcIpRanges: ["11.100.0.1/32"],
                srcNetworkScope: "VPC_NETWORKS",
                srcNetworks: [network.id],
                layer4Configs: [{
                    ipProtocol: "tcp",
                    ports: ["8080"],
                }],
            },
        },
        {
            description: "network scope rule 2",
            ruleName: "network scope 2",
            priority: 5000,
            enableLogging: false,
            action: "allow",
            direction: "EGRESS",
            match: {
                destIpRanges: ["0.0.0.0/0"],
                destNetworkScope: "INTERNET",
                layer4Configs: [{
                    ipProtocol: "tcp",
                    ports: ["8080"],
                }],
            },
        },
    ],
});

import pulumi
import pulumi_gcp as gcp

project = gcp.organizations.get_project()
address_group1 = gcp.networksecurity.AddressGroup("address_group_1",
    name="address-group",
    parent=project.id,
    description="Global address group",
    location="global",
    items=["208.80.154.224/32"],
    type="IPV4",
    capacity=100)
secure_tag_key1 = gcp.tags.TagKey("secure_tag_key_1",
    description="Tag key",
    parent=project.id,
    purpose="GCE_FIREWALL",
    short_name="tag-key",
    purpose_data={
        "network": f"{project.name}/default",
    })
secure_tag_value1 = gcp.tags.TagValue("secure_tag_value_1",
    description="Tag value",
    parent=secure_tag_key1.id,
    short_name="tag-value")
security_profile1 = gcp.networksecurity.SecurityProfile("security_profile_1",
    name="sp",
    type="THREAT_PREVENTION",
    parent="organizations/123456789",
    location="global")
security_profile_group1 = gcp.networksecurity.SecurityProfileGroup("security_profile_group_1",
    name="spg",
    parent="organizations/123456789",
    description="my description",
    threat_prevention_profile=security_profile1.id)
network = gcp.compute.Network("network",
    name="network",
    auto_create_subnetworks=False)
primary = gcp.compute.NetworkFirewallPolicyWithRules("primary",
    name="fw-policy",
    description="Terraform test",
    rules=[
        {
            "description": "tcp rule",
            "priority": 1000,
            "enable_logging": True,
            "action": "allow",
            "direction": "EGRESS",
            "match": {
                "dest_ip_ranges": ["11.100.0.1/32"],
                "dest_fqdns": [
                    "www.yyy.com",
                    "www.zzz.com",
                ],
                "dest_region_codes": [
                    "HK",
                    "IN",
                ],
                "dest_threat_intelligences": [
                    "iplist-search-engines-crawlers",
                    "iplist-tor-exit-nodes",
                ],
                "dest_address_groups": [address_group1.id],
                "layer4_configs": [{
                    "ip_protocol": "tcp",
                    "ports": [
                        "8080",
                        "7070",
                    ],
                }],
            },
            "target_secure_tags": [{
                "name": secure_tag_value1.id,
            }],
        },
        {
            "description": "udp rule",
            "priority": 2000,
            "enable_logging": False,
            "action": "deny",
            "direction": "INGRESS",
            "disabled": True,
            "match": {
                "src_ip_ranges": ["0.0.0.0/0"],
                "src_fqdns": [
                    "www.abc.com",
                    "www.def.com",
                ],
                "src_region_codes": [
                    "US",
                    "CA",
                ],
                "src_threat_intelligences": [
                    "iplist-known-malicious-ips",
                    "iplist-public-clouds",
                ],
                "src_address_groups": [address_group1.id],
                "src_secure_tags": [{
                    "name": secure_tag_value1.id,
                }],
                "layer4_configs": [{
                    "ip_protocol": "udp",
                }],
            },
        },
        {
            "description": "security profile group rule",
            "rule_name": "tcp rule",
            "priority": 3000,
            "enable_logging": False,
            "action": "apply_security_profile_group",
            "direction": "INGRESS",
            "target_service_accounts": ["test@google.com"],
            "security_profile_group": security_profile_group1.id.apply(lambda id: f"//networksecurity.googleapis.com/{id}"),
            "tls_inspect": True,
            "match": {
                "src_ip_ranges": ["0.0.0.0/0"],
                "layer4_configs": [{
                    "ip_protocol": "tcp",
                }],
            },
        },
        {
            "description": "network scope rule 1",
            "rule_name": "network scope 1",
            "priority": 4000,
            "enable_logging": False,
            "action": "allow",
            "direction": "INGRESS",
            "match": {
                "src_ip_ranges": ["11.100.0.1/32"],
                "src_network_scope": "VPC_NETWORKS",
                "src_networks": [network.id],
                "layer4_configs": [{
                    "ip_protocol": "tcp",
                    "ports": ["8080"],
                }],
            },
        },
        {
            "description": "network scope rule 2",
            "rule_name": "network scope 2",
            "priority": 5000,
            "enable_logging": False,
            "action": "allow",
            "direction": "EGRESS",
            "match": {
                "dest_ip_ranges": ["0.0.0.0/0"],
                "dest_network_scope": "INTERNET",
                "layer4_configs": [{
                    "ip_protocol": "tcp",
                    "ports": ["8080"],
                }],
            },
        },
    ])

package main

import (
	"fmt"

	"github.com/pulumi/pulumi-gcp/sdk/v8/go/gcp/compute"
	"github.com/pulumi/pulumi-gcp/sdk/v8/go/gcp/networksecurity"
	"github.com/pulumi/pulumi-gcp/sdk/v8/go/gcp/organizations"
	"github.com/pulumi/pulumi-gcp/sdk/v8/go/gcp/tags"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		project, err := organizations.LookupProject(ctx, &organizations.LookupProjectArgs{}, nil)
		if err != nil {
			return err
		}
		addressGroup1, err := networksecurity.NewAddressGroup(ctx, "address_group_1", &networksecurity.AddressGroupArgs{
			Name:        pulumi.String("address-group"),
			Parent:      pulumi.String(project.Id),
			Description: pulumi.String("Global address group"),
			Location:    pulumi.String("global"),
			Items: pulumi.StringArray{
				pulumi.String("208.80.154.224/32"),
			},
			Type:     pulumi.String("IPV4"),
			Capacity: pulumi.Int(100),
		})
		if err != nil {
			return err
		}
		secureTagKey1, err := tags.NewTagKey(ctx, "secure_tag_key_1", &tags.TagKeyArgs{
			Description: pulumi.String("Tag key"),
			Parent:      pulumi.String(project.Id),
			Purpose:     pulumi.String("GCE_FIREWALL"),
			ShortName:   pulumi.String("tag-key"),
			PurposeData: pulumi.StringMap{
				"network": pulumi.Sprintf("%v/default", project.Name),
			},
		})
		if err != nil {
			return err
		}
		secureTagValue1, err := tags.NewTagValue(ctx, "secure_tag_value_1", &tags.TagValueArgs{
			Description: pulumi.String("Tag value"),
			Parent:      secureTagKey1.ID(),
			ShortName:   pulumi.String("tag-value"),
		})
		if err != nil {
			return err
		}
		securityProfile1, err := networksecurity.NewSecurityProfile(ctx, "security_profile_1", &networksecurity.SecurityProfileArgs{
			Name:     pulumi.String("sp"),
			Type:     pulumi.String("THREAT_PREVENTION"),
			Parent:   pulumi.String("organizations/123456789"),
			Location: pulumi.String("global"),
		})
		if err != nil {
			return err
		}
		securityProfileGroup1, err := networksecurity.NewSecurityProfileGroup(ctx, "security_profile_group_1", &networksecurity.SecurityProfileGroupArgs{
			Name:                    pulumi.String("spg"),
			Parent:                  pulumi.String("organizations/123456789"),
			Description:             pulumi.String("my description"),
			ThreatPreventionProfile: securityProfile1.ID(),
		})
		if err != nil {
			return err
		}
		network, err := compute.NewNetwork(ctx, "network", &compute.NetworkArgs{
			Name:                  pulumi.String("network"),
			AutoCreateSubnetworks: pulumi.Bool(false),
		})
		if err != nil {
			return err
		}
		_, err = compute.NewNetworkFirewallPolicyWithRules(ctx, "primary", &compute.NetworkFirewallPolicyWithRulesArgs{
			Name:        pulumi.String("fw-policy"),
			Description: pulumi.String("Terraform test"),
			Rules: compute.NetworkFirewallPolicyWithRulesRuleArray{
				&compute.NetworkFirewallPolicyWithRulesRuleArgs{
					Description:   pulumi.String("tcp rule"),
					Priority:      pulumi.Int(1000),
					EnableLogging: pulumi.Bool(true),
					Action:        pulumi.String("allow"),
					Direction:     pulumi.String("EGRESS"),
					Match: &compute.NetworkFirewallPolicyWithRulesRuleMatchArgs{
						DestIpRanges: pulumi.StringArray{
							pulumi.String("11.100.0.1/32"),
						},
						DestFqdns: pulumi.StringArray{
							pulumi.String("www.yyy.com"),
							pulumi.String("www.zzz.com"),
						},
						DestRegionCodes: pulumi.StringArray{
							pulumi.String("HK"),
							pulumi.String("IN"),
						},
						DestThreatIntelligences: pulumi.StringArray{
							pulumi.String("iplist-search-engines-crawlers"),
							pulumi.String("iplist-tor-exit-nodes"),
						},
						DestAddressGroups: pulumi.StringArray{
							addressGroup1.ID(),
						},
						Layer4Configs: compute.NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArray{
							&compute.NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArgs{
								IpProtocol: pulumi.String("tcp"),
								Ports: pulumi.StringArray{
									pulumi.String("8080"),
									pulumi.String("7070"),
								},
							},
						},
					},
					TargetSecureTags: compute.NetworkFirewallPolicyWithRulesRuleTargetSecureTagArray{
						&compute.NetworkFirewallPolicyWithRulesRuleTargetSecureTagArgs{
							Name: secureTagValue1.ID(),
						},
					},
				},
				&compute.NetworkFirewallPolicyWithRulesRuleArgs{
					Description:   pulumi.String("udp rule"),
					Priority:      pulumi.Int(2000),
					EnableLogging: pulumi.Bool(false),
					Action:        pulumi.String("deny"),
					Direction:     pulumi.String("INGRESS"),
					Disabled:      pulumi.Bool(true),
					Match: &compute.NetworkFirewallPolicyWithRulesRuleMatchArgs{
						SrcIpRanges: pulumi.StringArray{
							pulumi.String("0.0.0.0/0"),
						},
						SrcFqdns: pulumi.StringArray{
							pulumi.String("www.abc.com"),
							pulumi.String("www.def.com"),
						},
						SrcRegionCodes: pulumi.StringArray{
							pulumi.String("US"),
							pulumi.String("CA"),
						},
						SrcThreatIntelligences: pulumi.StringArray{
							pulumi.String("iplist-known-malicious-ips"),
							pulumi.String("iplist-public-clouds"),
						},
						SrcAddressGroups: pulumi.StringArray{
							addressGroup1.ID(),
						},
						SrcSecureTags: compute.NetworkFirewallPolicyWithRulesRuleMatchSrcSecureTagArray{
							&compute.NetworkFirewallPolicyWithRulesRuleMatchSrcSecureTagArgs{
								Name: secureTagValue1.ID(),
							},
						},
						Layer4Configs: compute.NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArray{
							&compute.NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArgs{
								IpProtocol: pulumi.String("udp"),
							},
						},
					},
				},
				&compute.NetworkFirewallPolicyWithRulesRuleArgs{
					Description:   pulumi.String("security profile group rule"),
					RuleName:      pulumi.String("tcp rule"),
					Priority:      pulumi.Int(3000),
					EnableLogging: pulumi.Bool(false),
					Action:        pulumi.String("apply_security_profile_group"),
					Direction:     pulumi.String("INGRESS"),
					TargetServiceAccounts: pulumi.StringArray{
						pulumi.String("test@google.com"),
					},
					SecurityProfileGroup: securityProfileGroup1.ID().ApplyT(func(id string) (string, error) {
						return fmt.Sprintf("//networksecurity.googleapis.com/%v", id), nil
					}).(pulumi.StringOutput),
					TlsInspect: pulumi.Bool(true),
					Match: &compute.NetworkFirewallPolicyWithRulesRuleMatchArgs{
						SrcIpRanges: pulumi.StringArray{
							pulumi.String("0.0.0.0/0"),
						},
						Layer4Configs: compute.NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArray{
							&compute.NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArgs{
								IpProtocol: pulumi.String("tcp"),
							},
						},
					},
				},
				&compute.NetworkFirewallPolicyWithRulesRuleArgs{
					Description:   pulumi.String("network scope rule 1"),
					RuleName:      pulumi.String("network scope 1"),
					Priority:      pulumi.Int(4000),
					EnableLogging: pulumi.Bool(false),
					Action:        pulumi.String("allow"),
					Direction:     pulumi.String("INGRESS"),
					Match: &compute.NetworkFirewallPolicyWithRulesRuleMatchArgs{
						SrcIpRanges: pulumi.StringArray{
							pulumi.String("11.100.0.1/32"),
						},
						SrcNetworkScope: pulumi.String("VPC_NETWORKS"),
						SrcNetworks: pulumi.StringArray{
							network.ID(),
						},
						Layer4Configs: compute.NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArray{
							&compute.NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArgs{
								IpProtocol: pulumi.String("tcp"),
								Ports: pulumi.StringArray{
									pulumi.String("8080"),
								},
							},
						},
					},
				},
				&compute.NetworkFirewallPolicyWithRulesRuleArgs{
					Description:   pulumi.String("network scope rule 2"),
					RuleName:      pulumi.String("network scope 2"),
					Priority:      pulumi.Int(5000),
					EnableLogging: pulumi.Bool(false),
					Action:        pulumi.String("allow"),
					Direction:     pulumi.String("EGRESS"),
					Match: &compute.NetworkFirewallPolicyWithRulesRuleMatchArgs{
						DestIpRanges: pulumi.StringArray{
							pulumi.String("0.0.0.0/0"),
						},
						DestNetworkScope: pulumi.String("INTERNET"),
						Layer4Configs: compute.NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArray{
							&compute.NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArgs{
								IpProtocol: pulumi.String("tcp"),
								Ports: pulumi.StringArray{
									pulumi.String("8080"),
								},
							},
						},
					},
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var project = Gcp.Organizations.GetProject.Invoke();

    var addressGroup1 = new Gcp.NetworkSecurity.AddressGroup("address_group_1", new()
    {
        Name = "address-group",
        Parent = project.Apply(getProjectResult => getProjectResult.Id),
        Description = "Global address group",
        Location = "global",
        Items = new[]
        {
            "208.80.154.224/32",
        },
        Type = "IPV4",
        Capacity = 100,
    });

    var secureTagKey1 = new Gcp.Tags.TagKey("secure_tag_key_1", new()
    {
        Description = "Tag key",
        Parent = project.Apply(getProjectResult => getProjectResult.Id),
        Purpose = "GCE_FIREWALL",
        ShortName = "tag-key",
        PurposeData = 
        {
            { "network", $"{project.Apply(getProjectResult => getProjectResult.Name)}/default" },
        },
    });

    var secureTagValue1 = new Gcp.Tags.TagValue("secure_tag_value_1", new()
    {
        Description = "Tag value",
        Parent = secureTagKey1.Id,
        ShortName = "tag-value",
    });

    var securityProfile1 = new Gcp.NetworkSecurity.SecurityProfile("security_profile_1", new()
    {
        Name = "sp",
        Type = "THREAT_PREVENTION",
        Parent = "organizations/123456789",
        Location = "global",
    });

    var securityProfileGroup1 = new Gcp.NetworkSecurity.SecurityProfileGroup("security_profile_group_1", new()
    {
        Name = "spg",
        Parent = "organizations/123456789",
        Description = "my description",
        ThreatPreventionProfile = securityProfile1.Id,
    });

    var network = new Gcp.Compute.Network("network", new()
    {
        Name = "network",
        AutoCreateSubnetworks = false,
    });

    var primary = new Gcp.Compute.NetworkFirewallPolicyWithRules("primary", new()
    {
        Name = "fw-policy",
        Description = "Terraform test",
        Rules = new[]
        {
            new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleArgs
            {
                Description = "tcp rule",
                Priority = 1000,
                EnableLogging = true,
                Action = "allow",
                Direction = "EGRESS",
                Match = new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleMatchArgs
                {
                    DestIpRanges = new[]
                    {
                        "11.100.0.1/32",
                    },
                    DestFqdns = new[]
                    {
                        "www.yyy.com",
                        "www.zzz.com",
                    },
                    DestRegionCodes = new[]
                    {
                        "HK",
                        "IN",
                    },
                    DestThreatIntelligences = new[]
                    {
                        "iplist-search-engines-crawlers",
                        "iplist-tor-exit-nodes",
                    },
                    DestAddressGroups = new[]
                    {
                        addressGroup1.Id,
                    },
                    Layer4Configs = new[]
                    {
                        new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArgs
                        {
                            IpProtocol = "tcp",
                            Ports = new[]
                            {
                                "8080",
                                "7070",
                            },
                        },
                    },
                },
                TargetSecureTags = new[]
                {
                    new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleTargetSecureTagArgs
                    {
                        Name = secureTagValue1.Id,
                    },
                },
            },
            new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleArgs
            {
                Description = "udp rule",
                Priority = 2000,
                EnableLogging = false,
                Action = "deny",
                Direction = "INGRESS",
                Disabled = true,
                Match = new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleMatchArgs
                {
                    SrcIpRanges = new[]
                    {
                        "0.0.0.0/0",
                    },
                    SrcFqdns = new[]
                    {
                        "www.abc.com",
                        "www.def.com",
                    },
                    SrcRegionCodes = new[]
                    {
                        "US",
                        "CA",
                    },
                    SrcThreatIntelligences = new[]
                    {
                        "iplist-known-malicious-ips",
                        "iplist-public-clouds",
                    },
                    SrcAddressGroups = new[]
                    {
                        addressGroup1.Id,
                    },
                    SrcSecureTags = new[]
                    {
                        new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleMatchSrcSecureTagArgs
                        {
                            Name = secureTagValue1.Id,
                        },
                    },
                    Layer4Configs = new[]
                    {
                        new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArgs
                        {
                            IpProtocol = "udp",
                        },
                    },
                },
            },
            new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleArgs
            {
                Description = "security profile group rule",
                RuleName = "tcp rule",
                Priority = 3000,
                EnableLogging = false,
                Action = "apply_security_profile_group",
                Direction = "INGRESS",
                TargetServiceAccounts = new[]
                {
                    "test@google.com",
                },
                SecurityProfileGroup = securityProfileGroup1.Id.Apply(id => $"//networksecurity.googleapis.com/{id}"),
                TlsInspect = true,
                Match = new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleMatchArgs
                {
                    SrcIpRanges = new[]
                    {
                        "0.0.0.0/0",
                    },
                    Layer4Configs = new[]
                    {
                        new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArgs
                        {
                            IpProtocol = "tcp",
                        },
                    },
                },
            },
            new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleArgs
            {
                Description = "network scope rule 1",
                RuleName = "network scope 1",
                Priority = 4000,
                EnableLogging = false,
                Action = "allow",
                Direction = "INGRESS",
                Match = new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleMatchArgs
                {
                    SrcIpRanges = new[]
                    {
                        "11.100.0.1/32",
                    },
                    SrcNetworkScope = "VPC_NETWORKS",
                    SrcNetworks = new[]
                    {
                        network.Id,
                    },
                    Layer4Configs = new[]
                    {
                        new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArgs
                        {
                            IpProtocol = "tcp",
                            Ports = new[]
                            {
                                "8080",
                            },
                        },
                    },
                },
            },
            new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleArgs
            {
                Description = "network scope rule 2",
                RuleName = "network scope 2",
                Priority = 5000,
                EnableLogging = false,
                Action = "allow",
                Direction = "EGRESS",
                Match = new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleMatchArgs
                {
                    DestIpRanges = new[]
                    {
                        "0.0.0.0/0",
                    },
                    DestNetworkScope = "INTERNET",
                    Layer4Configs = new[]
                    {
                        new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArgs
                        {
                            IpProtocol = "tcp",
                            Ports = new[]
                            {
                                "8080",
                            },
                        },
                    },
                },
            },
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetProjectArgs;
import com.pulumi.gcp.networksecurity.AddressGroup;
import com.pulumi.gcp.networksecurity.AddressGroupArgs;
import com.pulumi.gcp.tags.TagKey;
import com.pulumi.gcp.tags.TagKeyArgs;
import com.pulumi.gcp.tags.TagValue;
import com.pulumi.gcp.tags.TagValueArgs;
import com.pulumi.gcp.networksecurity.SecurityProfile;
import com.pulumi.gcp.networksecurity.SecurityProfileArgs;
import com.pulumi.gcp.networksecurity.SecurityProfileGroup;
import com.pulumi.gcp.networksecurity.SecurityProfileGroupArgs;
import com.pulumi.gcp.compute.Network;
import com.pulumi.gcp.compute.NetworkArgs;
import com.pulumi.gcp.compute.NetworkFirewallPolicyWithRules;
import com.pulumi.gcp.compute.NetworkFirewallPolicyWithRulesArgs;
import com.pulumi.gcp.compute.inputs.NetworkFirewallPolicyWithRulesRuleArgs;
import com.pulumi.gcp.compute.inputs.NetworkFirewallPolicyWithRulesRuleMatchArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var project = OrganizationsFunctions.getProject();

        var addressGroup1 = new AddressGroup("addressGroup1", AddressGroupArgs.builder()
            .name("address-group")
            .parent(project.applyValue(getProjectResult -> getProjectResult.id()))
            .description("Global address group")
            .location("global")
            .items("208.80.154.224/32")
            .type("IPV4")
            .capacity(100)
            .build());

        var secureTagKey1 = new TagKey("secureTagKey1", TagKeyArgs.builder()
            .description("Tag key")
            .parent(project.applyValue(getProjectResult -> getProjectResult.id()))
            .purpose("GCE_FIREWALL")
            .shortName("tag-key")
            .purposeData(Map.of("network", String.format("%s/default", project.applyValue(getProjectResult -> getProjectResult.name()))))
            .build());

        var secureTagValue1 = new TagValue("secureTagValue1", TagValueArgs.builder()
            .description("Tag value")
            .parent(secureTagKey1.id())
            .shortName("tag-value")
            .build());

        var securityProfile1 = new SecurityProfile("securityProfile1", SecurityProfileArgs.builder()
            .name("sp")
            .type("THREAT_PREVENTION")
            .parent("organizations/123456789")
            .location("global")
            .build());

        var securityProfileGroup1 = new SecurityProfileGroup("securityProfileGroup1", SecurityProfileGroupArgs.builder()
            .name("spg")
            .parent("organizations/123456789")
            .description("my description")
            .threatPreventionProfile(securityProfile1.id())
            .build());

        var network = new Network("network", NetworkArgs.builder()
            .name("network")
            .autoCreateSubnetworks(false)
            .build());

        var primary = new NetworkFirewallPolicyWithRules("primary", NetworkFirewallPolicyWithRulesArgs.builder()
            .name("fw-policy")
            .description("Terraform test")
            .rules(            
                NetworkFirewallPolicyWithRulesRuleArgs.builder()
                    .description("tcp rule")
                    .priority(1000)
                    .enableLogging(true)
                    .action("allow")
                    .direction("EGRESS")
                    .match(NetworkFirewallPolicyWithRulesRuleMatchArgs.builder()
                        .destIpRanges("11.100.0.1/32")
                        .destFqdns(                        
                            "www.yyy.com",
                            "www.zzz.com")
                        .destRegionCodes(                        
                            "HK",
                            "IN")
                        .destThreatIntelligences(                        
                            "iplist-search-engines-crawlers",
                            "iplist-tor-exit-nodes")
                        .destAddressGroups(addressGroup1.id())
                        .layer4Configs(NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArgs.builder()
                            .ipProtocol("tcp")
                            .ports(                            
                                8080,
                                7070)
                            .build())
                        .build())
                    .targetSecureTags(NetworkFirewallPolicyWithRulesRuleTargetSecureTagArgs.builder()
                        .name(secureTagValue1.id())
                        .build())
                    .build(),
                NetworkFirewallPolicyWithRulesRuleArgs.builder()
                    .description("udp rule")
                    .priority(2000)
                    .enableLogging(false)
                    .action("deny")
                    .direction("INGRESS")
                    .disabled(true)
                    .match(NetworkFirewallPolicyWithRulesRuleMatchArgs.builder()
                        .srcIpRanges("0.0.0.0/0")
                        .srcFqdns(                        
                            "www.abc.com",
                            "www.def.com")
                        .srcRegionCodes(                        
                            "US",
                            "CA")
                        .srcThreatIntelligences(                        
                            "iplist-known-malicious-ips",
                            "iplist-public-clouds")
                        .srcAddressGroups(addressGroup1.id())
                        .srcSecureTags(NetworkFirewallPolicyWithRulesRuleMatchSrcSecureTagArgs.builder()
                            .name(secureTagValue1.id())
                            .build())
                        .layer4Configs(NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArgs.builder()
                            .ipProtocol("udp")
                            .build())
                        .build())
                    .build(),
                NetworkFirewallPolicyWithRulesRuleArgs.builder()
                    .description("security profile group rule")
                    .ruleName("tcp rule")
                    .priority(3000)
                    .enableLogging(false)
                    .action("apply_security_profile_group")
                    .direction("INGRESS")
                    .targetServiceAccounts("test@google.com")
                    .securityProfileGroup(securityProfileGroup1.id().applyValue(id -> String.format("//networksecurity.googleapis.com/%s", id)))
                    .tlsInspect(true)
                    .match(NetworkFirewallPolicyWithRulesRuleMatchArgs.builder()
                        .srcIpRanges("0.0.0.0/0")
                        .layer4Configs(NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArgs.builder()
                            .ipProtocol("tcp")
                            .build())
                        .build())
                    .build(),
                NetworkFirewallPolicyWithRulesRuleArgs.builder()
                    .description("network scope rule 1")
                    .ruleName("network scope 1")
                    .priority(4000)
                    .enableLogging(false)
                    .action("allow")
                    .direction("INGRESS")
                    .match(NetworkFirewallPolicyWithRulesRuleMatchArgs.builder()
                        .srcIpRanges("11.100.0.1/32")
                        .srcNetworkScope("VPC_NETWORKS")
                        .srcNetworks(network.id())
                        .layer4Configs(NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArgs.builder()
                            .ipProtocol("tcp")
                            .ports(8080)
                            .build())
                        .build())
                    .build(),
                NetworkFirewallPolicyWithRulesRuleArgs.builder()
                    .description("network scope rule 2")
                    .ruleName("network scope 2")
                    .priority(5000)
                    .enableLogging(false)
                    .action("allow")
                    .direction("EGRESS")
                    .match(NetworkFirewallPolicyWithRulesRuleMatchArgs.builder()
                        .destIpRanges("0.0.0.0/0")
                        .destNetworkScope("INTERNET")
                        .layer4Configs(NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArgs.builder()
                            .ipProtocol("tcp")
                            .ports(8080)
                            .build())
                        .build())
                    .build())
            .build());

    }
}

resources:
  primary:
    type: gcp:compute:NetworkFirewallPolicyWithRules
    properties:
      name: fw-policy
      description: Terraform test
      rules:
        - description: tcp rule
          priority: 1000
          enableLogging: true
          action: allow
          direction: EGRESS
          match:
            destIpRanges:
              - 11.100.0.1/32
            destFqdns:
              - www.yyy.com
              - www.zzz.com
            destRegionCodes:
              - HK
              - IN
            destThreatIntelligences:
              - iplist-search-engines-crawlers
              - iplist-tor-exit-nodes
            destAddressGroups:
              - ${addressGroup1.id}
            layer4Configs:
              - ipProtocol: tcp
                ports:
                  - 8080
                  - 7070
          targetSecureTags:
            - name: ${secureTagValue1.id}
        - description: udp rule
          priority: 2000
          enableLogging: false
          action: deny
          direction: INGRESS
          disabled: true
          match:
            srcIpRanges:
              - 0.0.0.0/0
            srcFqdns:
              - www.abc.com
              - www.def.com
            srcRegionCodes:
              - US
              - CA
            srcThreatIntelligences:
              - iplist-known-malicious-ips
              - iplist-public-clouds
            srcAddressGroups:
              - ${addressGroup1.id}
            srcSecureTags:
              - name: ${secureTagValue1.id}
            layer4Configs:
              - ipProtocol: udp
        - description: security profile group rule
          ruleName: tcp rule
          priority: 3000
          enableLogging: false
          action: apply_security_profile_group
          direction: INGRESS
          targetServiceAccounts:
            - test@google.com
          securityProfileGroup: //networksecurity.googleapis.com/${securityProfileGroup1.id}
          tlsInspect: true
          match:
            srcIpRanges:
              - 0.0.0.0/0
            layer4Configs:
              - ipProtocol: tcp
        - description: network scope rule 1
          ruleName: network scope 1
          priority: 4000
          enableLogging: false
          action: allow
          direction: INGRESS
          match:
            srcIpRanges:
              - 11.100.0.1/32
            srcNetworkScope: VPC_NETWORKS
            srcNetworks:
              - ${network.id}
            layer4Configs:
              - ipProtocol: tcp
                ports:
                  - 8080
        - description: network scope rule 2
          ruleName: network scope 2
          priority: 5000
          enableLogging: false
          action: allow
          direction: EGRESS
          match:
            destIpRanges:
              - 0.0.0.0/0
            destNetworkScope: INTERNET
            layer4Configs:
              - ipProtocol: tcp
                ports:
                  - 8080
  addressGroup1:
    type: gcp:networksecurity:AddressGroup
    name: address_group_1
    properties:
      name: address-group
      parent: ${project.id}
      description: Global address group
      location: global
      items:
        - 208.80.154.224/32
      type: IPV4
      capacity: 100
  secureTagKey1:
    type: gcp:tags:TagKey
    name: secure_tag_key_1
    properties:
      description: Tag key
      parent: ${project.id}
      purpose: GCE_FIREWALL
      shortName: tag-key
      purposeData:
        network: ${project.name}/default
  secureTagValue1:
    type: gcp:tags:TagValue
    name: secure_tag_value_1
    properties:
      description: Tag value
      parent: ${secureTagKey1.id}
      shortName: tag-value
  securityProfileGroup1:
    type: gcp:networksecurity:SecurityProfileGroup
    name: security_profile_group_1
    properties:
      name: spg
      parent: organizations/123456789
      description: my description
      threatPreventionProfile: ${securityProfile1.id}
  securityProfile1:
    type: gcp:networksecurity:SecurityProfile
    name: security_profile_1
    properties:
      name: sp
      type: THREAT_PREVENTION
      parent: organizations/123456789
      location: global
  network:
    type: gcp:compute:Network
    properties:
      name: network
      autoCreateSubnetworks: false
variables:
  project:
    fn::invoke:
      function: gcp:organizations:getProject
      arguments: {}

Create NetworkFirewallPolicyWithRules Resource

Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

new NetworkFirewallPolicyWithRules(name: string, args: NetworkFirewallPolicyWithRulesArgs, opts?: CustomResourceOptions);

@overload
def NetworkFirewallPolicyWithRules(resource_name: str,
                                   args: NetworkFirewallPolicyWithRulesArgs,
                                   opts: Optional[ResourceOptions] = None)

@overload
def NetworkFirewallPolicyWithRules(resource_name: str,
                                   opts: Optional[ResourceOptions] = None,
                                   rules: Optional[Sequence[NetworkFirewallPolicyWithRulesRuleArgs]] = None,
                                   description: Optional[str] = None,
                                   name: Optional[str] = None,
                                   project: Optional[str] = None)

func NewNetworkFirewallPolicyWithRules(ctx *Context, name string, args NetworkFirewallPolicyWithRulesArgs, opts ...ResourceOption) (*NetworkFirewallPolicyWithRules, error)

public NetworkFirewallPolicyWithRules(string name, NetworkFirewallPolicyWithRulesArgs args, CustomResourceOptions? opts = null)

public NetworkFirewallPolicyWithRules(String name, NetworkFirewallPolicyWithRulesArgs args)
public NetworkFirewallPolicyWithRules(String name, NetworkFirewallPolicyWithRulesArgs args, CustomResourceOptions options)

type: gcp:compute:NetworkFirewallPolicyWithRules
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

Parameters

name string: The unique name of the resource.
args NetworkFirewallPolicyWithRulesArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
args NetworkFirewallPolicyWithRulesArgs: The arguments to resource properties.
opts ResourceOptions: Bag of options to control resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args NetworkFirewallPolicyWithRulesArgs: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args NetworkFirewallPolicyWithRulesArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

name String: The unique name of the resource.
args NetworkFirewallPolicyWithRulesArgs: The arguments to resource properties.
options CustomResourceOptions: Bag of options to control resource's behavior.

Constructor example

The following reference example uses placeholder values for all input properties.

TypeScript
Python
Go
C#
Java
YAML

var networkFirewallPolicyWithRulesResource = new Gcp.Compute.NetworkFirewallPolicyWithRules("networkFirewallPolicyWithRulesResource", new()
{
    Rules = new[]
    {
        new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleArgs
        {
            Action = "string",
            Match = new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleMatchArgs
            {
                Layer4Configs = new[]
                {
                    new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArgs
                    {
                        IpProtocol = "string",
                        Ports = new[]
                        {
                            "string",
                        },
                    },
                },
                DestNetworkScope = "string",
                SrcFqdns = new[]
                {
                    "string",
                },
                DestAddressGroups = new[]
                {
                    "string",
                },
                DestRegionCodes = new[]
                {
                    "string",
                },
                DestThreatIntelligences = new[]
                {
                    "string",
                },
                DestFqdns = new[]
                {
                    "string",
                },
                SrcAddressGroups = new[]
                {
                    "string",
                },
                DestIpRanges = new[]
                {
                    "string",
                },
                SrcIpRanges = new[]
                {
                    "string",
                },
                SrcNetworkScope = "string",
                SrcNetworks = new[]
                {
                    "string",
                },
                SrcRegionCodes = new[]
                {
                    "string",
                },
                SrcSecureTags = new[]
                {
                    new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleMatchSrcSecureTagArgs
                    {
                        Name = "string",
                        State = "string",
                    },
                },
                SrcThreatIntelligences = new[]
                {
                    "string",
                },
            },
            Priority = 0,
            Description = "string",
            Direction = "string",
            Disabled = false,
            EnableLogging = false,
            RuleName = "string",
            SecurityProfileGroup = "string",
            TargetSecureTags = new[]
            {
                new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleTargetSecureTagArgs
                {
                    Name = "string",
                    State = "string",
                },
            },
            TargetServiceAccounts = new[]
            {
                "string",
            },
            TlsInspect = false,
        },
    },
    Description = "string",
    Name = "string",
    Project = "string",
});

example, err := compute.NewNetworkFirewallPolicyWithRules(ctx, "networkFirewallPolicyWithRulesResource", &compute.NetworkFirewallPolicyWithRulesArgs{
	Rules: compute.NetworkFirewallPolicyWithRulesRuleArray{
		&compute.NetworkFirewallPolicyWithRulesRuleArgs{
			Action: pulumi.String("string"),
			Match: &compute.NetworkFirewallPolicyWithRulesRuleMatchArgs{
				Layer4Configs: compute.NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArray{
					&compute.NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArgs{
						IpProtocol: pulumi.String("string"),
						Ports: pulumi.StringArray{
							pulumi.String("string"),
						},
					},
				},
				DestNetworkScope: pulumi.String("string"),
				SrcFqdns: pulumi.StringArray{
					pulumi.String("string"),
				},
				DestAddressGroups: pulumi.StringArray{
					pulumi.String("string"),
				},
				DestRegionCodes: pulumi.StringArray{
					pulumi.String("string"),
				},
				DestThreatIntelligences: pulumi.StringArray{
					pulumi.String("string"),
				},
				DestFqdns: pulumi.StringArray{
					pulumi.String("string"),
				},
				SrcAddressGroups: pulumi.StringArray{
					pulumi.String("string"),
				},
				DestIpRanges: pulumi.StringArray{
					pulumi.String("string"),
				},
				SrcIpRanges: pulumi.StringArray{
					pulumi.String("string"),
				},
				SrcNetworkScope: pulumi.String("string"),
				SrcNetworks: pulumi.StringArray{
					pulumi.String("string"),
				},
				SrcRegionCodes: pulumi.StringArray{
					pulumi.String("string"),
				},
				SrcSecureTags: compute.NetworkFirewallPolicyWithRulesRuleMatchSrcSecureTagArray{
					&compute.NetworkFirewallPolicyWithRulesRuleMatchSrcSecureTagArgs{
						Name:  pulumi.String("string"),
						State: pulumi.String("string"),
					},
				},
				SrcThreatIntelligences: pulumi.StringArray{
					pulumi.String("string"),
				},
			},
			Priority:             pulumi.Int(0),
			Description:          pulumi.String("string"),
			Direction:            pulumi.String("string"),
			Disabled:             pulumi.Bool(false),
			EnableLogging:        pulumi.Bool(false),
			RuleName:             pulumi.String("string"),
			SecurityProfileGroup: pulumi.String("string"),
			TargetSecureTags: compute.NetworkFirewallPolicyWithRulesRuleTargetSecureTagArray{
				&compute.NetworkFirewallPolicyWithRulesRuleTargetSecureTagArgs{
					Name:  pulumi.String("string"),
					State: pulumi.String("string"),
				},
			},
			TargetServiceAccounts: pulumi.StringArray{
				pulumi.String("string"),
			},
			TlsInspect: pulumi.Bool(false),
		},
	},
	Description: pulumi.String("string"),
	Name:        pulumi.String("string"),
	Project:     pulumi.String("string"),
})

var networkFirewallPolicyWithRulesResource = new NetworkFirewallPolicyWithRules("networkFirewallPolicyWithRulesResource", NetworkFirewallPolicyWithRulesArgs.builder()
    .rules(NetworkFirewallPolicyWithRulesRuleArgs.builder()
        .action("string")
        .match(NetworkFirewallPolicyWithRulesRuleMatchArgs.builder()
            .layer4Configs(NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArgs.builder()
                .ipProtocol("string")
                .ports("string")
                .build())
            .destNetworkScope("string")
            .srcFqdns("string")
            .destAddressGroups("string")
            .destRegionCodes("string")
            .destThreatIntelligences("string")
            .destFqdns("string")
            .srcAddressGroups("string")
            .destIpRanges("string")
            .srcIpRanges("string")
            .srcNetworkScope("string")
            .srcNetworks("string")
            .srcRegionCodes("string")
            .srcSecureTags(NetworkFirewallPolicyWithRulesRuleMatchSrcSecureTagArgs.builder()
                .name("string")
                .state("string")
                .build())
            .srcThreatIntelligences("string")
            .build())
        .priority(0)
        .description("string")
        .direction("string")
        .disabled(false)
        .enableLogging(false)
        .ruleName("string")
        .securityProfileGroup("string")
        .targetSecureTags(NetworkFirewallPolicyWithRulesRuleTargetSecureTagArgs.builder()
            .name("string")
            .state("string")
            .build())
        .targetServiceAccounts("string")
        .tlsInspect(false)
        .build())
    .description("string")
    .name("string")
    .project("string")
    .build());

network_firewall_policy_with_rules_resource = gcp.compute.NetworkFirewallPolicyWithRules("networkFirewallPolicyWithRulesResource",
    rules=[{
        "action": "string",
        "match": {
            "layer4_configs": [{
                "ip_protocol": "string",
                "ports": ["string"],
            }],
            "dest_network_scope": "string",
            "src_fqdns": ["string"],
            "dest_address_groups": ["string"],
            "dest_region_codes": ["string"],
            "dest_threat_intelligences": ["string"],
            "dest_fqdns": ["string"],
            "src_address_groups": ["string"],
            "dest_ip_ranges": ["string"],
            "src_ip_ranges": ["string"],
            "src_network_scope": "string",
            "src_networks": ["string"],
            "src_region_codes": ["string"],
            "src_secure_tags": [{
                "name": "string",
                "state": "string",
            }],
            "src_threat_intelligences": ["string"],
        },
        "priority": 0,
        "description": "string",
        "direction": "string",
        "disabled": False,
        "enable_logging": False,
        "rule_name": "string",
        "security_profile_group": "string",
        "target_secure_tags": [{
            "name": "string",
            "state": "string",
        }],
        "target_service_accounts": ["string"],
        "tls_inspect": False,
    }],
    description="string",
    name="string",
    project="string")

const networkFirewallPolicyWithRulesResource = new gcp.compute.NetworkFirewallPolicyWithRules("networkFirewallPolicyWithRulesResource", {
    rules: [{
        action: "string",
        match: {
            layer4Configs: [{
                ipProtocol: "string",
                ports: ["string"],
            }],
            destNetworkScope: "string",
            srcFqdns: ["string"],
            destAddressGroups: ["string"],
            destRegionCodes: ["string"],
            destThreatIntelligences: ["string"],
            destFqdns: ["string"],
            srcAddressGroups: ["string"],
            destIpRanges: ["string"],
            srcIpRanges: ["string"],
            srcNetworkScope: "string",
            srcNetworks: ["string"],
            srcRegionCodes: ["string"],
            srcSecureTags: [{
                name: "string",
                state: "string",
            }],
            srcThreatIntelligences: ["string"],
        },
        priority: 0,
        description: "string",
        direction: "string",
        disabled: false,
        enableLogging: false,
        ruleName: "string",
        securityProfileGroup: "string",
        targetSecureTags: [{
            name: "string",
            state: "string",
        }],
        targetServiceAccounts: ["string"],
        tlsInspect: false,
    }],
    description: "string",
    name: "string",
    project: "string",
});

type: gcp:compute:NetworkFirewallPolicyWithRules
properties:
    description: string
    name: string
    project: string
    rules:
        - action: string
          description: string
          direction: string
          disabled: false
          enableLogging: false
          match:
            destAddressGroups:
                - string
            destFqdns:
                - string
            destIpRanges:
                - string
            destNetworkScope: string
            destRegionCodes:
                - string
            destThreatIntelligences:
                - string
            layer4Configs:
                - ipProtocol: string
                  ports:
                    - string
            srcAddressGroups:
                - string
            srcFqdns:
                - string
            srcIpRanges:
                - string
            srcNetworkScope: string
            srcNetworks:
                - string
            srcRegionCodes:
                - string
            srcSecureTags:
                - name: string
                  state: string
            srcThreatIntelligences:
                - string
          priority: 0
          ruleName: string
          securityProfileGroup: string
          targetSecureTags:
            - name: string
              state: string
          targetServiceAccounts:
            - string
          tlsInspect: false

NetworkFirewallPolicyWithRules Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

The NetworkFirewallPolicyWithRules resource accepts the following input properties:

Rules List<NetworkFirewallPolicyWithRulesRule>: A list of firewall policy rules. Structure is documented below.
Description string: (Output) A description of the rule.
Name string: User-provided name of the Network firewall policy. The name should be unique in the project in which the firewall policy is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression a-z? which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
Project string

Rules []NetworkFirewallPolicyWithRulesRuleArgs: A list of firewall policy rules. Structure is documented below.
Description string: (Output) A description of the rule.
Name string: User-provided name of the Network firewall policy. The name should be unique in the project in which the firewall policy is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression a-z? which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
Project string

rules List<NetworkFirewallPolicyWithRulesRule>: A list of firewall policy rules. Structure is documented below.
description String: (Output) A description of the rule.
name String: User-provided name of the Network firewall policy. The name should be unique in the project in which the firewall policy is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression a-z? which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
project String

rules NetworkFirewallPolicyWithRulesRule[]: A list of firewall policy rules. Structure is documented below.
description string: (Output) A description of the rule.
name string: User-provided name of the Network firewall policy. The name should be unique in the project in which the firewall policy is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression a-z? which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
project string

rules Sequence[NetworkFirewallPolicyWithRulesRuleArgs]: A list of firewall policy rules. Structure is documented below.
description str: (Output) A description of the rule.
name str: User-provided name of the Network firewall policy. The name should be unique in the project in which the firewall policy is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression a-z? which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
project str

rules List<Property Map>: A list of firewall policy rules. Structure is documented below.
description String: (Output) A description of the rule.
name String: User-provided name of the Network firewall policy. The name should be unique in the project in which the firewall policy is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression a-z? which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
project String

Outputs

All input properties are implicitly available as output properties. Additionally, the NetworkFirewallPolicyWithRules resource produces the following output properties:

CreationTimestamp string: Creation timestamp in RFC3339 text format.
Fingerprint string: Fingerprint of the resource. This field is used internally during updates of this resource.
Id string: The provider-assigned unique ID for this managed resource.
NetworkFirewallPolicyId string: The unique identifier for the resource. This identifier is defined by the server.
PredefinedRules List<NetworkFirewallPolicyWithRulesPredefinedRule>: A list of firewall policy pre-defined rules. Structure is documented below.
RuleTupleCount int: Total count of all firewall policy rule tuples. A firewall policy can not exceed a set number of tuples.
SelfLink string: Server-defined URL for the resource.
SelfLinkWithId string: Server-defined URL for this resource with the resource id.

CreationTimestamp string: Creation timestamp in RFC3339 text format.
Fingerprint string: Fingerprint of the resource. This field is used internally during updates of this resource.
Id string: The provider-assigned unique ID for this managed resource.
NetworkFirewallPolicyId string: The unique identifier for the resource. This identifier is defined by the server.
PredefinedRules []NetworkFirewallPolicyWithRulesPredefinedRule: A list of firewall policy pre-defined rules. Structure is documented below.
RuleTupleCount int: Total count of all firewall policy rule tuples. A firewall policy can not exceed a set number of tuples.
SelfLink string: Server-defined URL for the resource.
SelfLinkWithId string: Server-defined URL for this resource with the resource id.

creationTimestamp String: Creation timestamp in RFC3339 text format.
fingerprint String: Fingerprint of the resource. This field is used internally during updates of this resource.
id String: The provider-assigned unique ID for this managed resource.
networkFirewallPolicyId String: The unique identifier for the resource. This identifier is defined by the server.
predefinedRules List<NetworkFirewallPolicyWithRulesPredefinedRule>: A list of firewall policy pre-defined rules. Structure is documented below.
ruleTupleCount Integer: Total count of all firewall policy rule tuples. A firewall policy can not exceed a set number of tuples.
selfLink String: Server-defined URL for the resource.
selfLinkWithId String: Server-defined URL for this resource with the resource id.

creationTimestamp string: Creation timestamp in RFC3339 text format.
fingerprint string: Fingerprint of the resource. This field is used internally during updates of this resource.
id string: The provider-assigned unique ID for this managed resource.
networkFirewallPolicyId string: The unique identifier for the resource. This identifier is defined by the server.
predefinedRules NetworkFirewallPolicyWithRulesPredefinedRule[]: A list of firewall policy pre-defined rules. Structure is documented below.
ruleTupleCount number: Total count of all firewall policy rule tuples. A firewall policy can not exceed a set number of tuples.
selfLink string: Server-defined URL for the resource.
selfLinkWithId string: Server-defined URL for this resource with the resource id.

creation_timestamp str: Creation timestamp in RFC3339 text format.
fingerprint str: Fingerprint of the resource. This field is used internally during updates of this resource.
id str: The provider-assigned unique ID for this managed resource.
network_firewall_policy_id str: The unique identifier for the resource. This identifier is defined by the server.
predefined_rules Sequence[NetworkFirewallPolicyWithRulesPredefinedRule]: A list of firewall policy pre-defined rules. Structure is documented below.
rule_tuple_count int: Total count of all firewall policy rule tuples. A firewall policy can not exceed a set number of tuples.
self_link str: Server-defined URL for the resource.
self_link_with_id str: Server-defined URL for this resource with the resource id.

creationTimestamp String: Creation timestamp in RFC3339 text format.
fingerprint String: Fingerprint of the resource. This field is used internally during updates of this resource.
id String: The provider-assigned unique ID for this managed resource.
networkFirewallPolicyId String: The unique identifier for the resource. This identifier is defined by the server.
predefinedRules List<Property Map>: A list of firewall policy pre-defined rules. Structure is documented below.
ruleTupleCount Number: Total count of all firewall policy rule tuples. A firewall policy can not exceed a set number of tuples.
selfLink String: Server-defined URL for the resource.
selfLinkWithId String: Server-defined URL for this resource with the resource id.

Look up Existing NetworkFirewallPolicyWithRules Resource

Get an existing NetworkFirewallPolicyWithRules resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

TypeScript
Python
Go
C#
Java
YAML

public static get(name: string, id: Input<ID>, state?: NetworkFirewallPolicyWithRulesState, opts?: CustomResourceOptions): NetworkFirewallPolicyWithRules

@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        creation_timestamp: Optional[str] = None,
        description: Optional[str] = None,
        fingerprint: Optional[str] = None,
        name: Optional[str] = None,
        network_firewall_policy_id: Optional[str] = None,
        predefined_rules: Optional[Sequence[NetworkFirewallPolicyWithRulesPredefinedRuleArgs]] = None,
        project: Optional[str] = None,
        rule_tuple_count: Optional[int] = None,
        rules: Optional[Sequence[NetworkFirewallPolicyWithRulesRuleArgs]] = None,
        self_link: Optional[str] = None,
        self_link_with_id: Optional[str] = None) -> NetworkFirewallPolicyWithRules

func GetNetworkFirewallPolicyWithRules(ctx *Context, name string, id IDInput, state *NetworkFirewallPolicyWithRulesState, opts ...ResourceOption) (*NetworkFirewallPolicyWithRules, error)

public static NetworkFirewallPolicyWithRules Get(string name, Input<string> id, NetworkFirewallPolicyWithRulesState? state, CustomResourceOptions? opts = null)

public static NetworkFirewallPolicyWithRules get(String name, Output<String> id, NetworkFirewallPolicyWithRulesState state, CustomResourceOptions options)

resources:  _:    type: gcp:compute:NetworkFirewallPolicyWithRules    get:      id: ${id}

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

resource_name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

The following state arguments are supported:

CreationTimestamp string: Creation timestamp in RFC3339 text format.
Description string: (Output) A description of the rule.
Fingerprint string: Fingerprint of the resource. This field is used internally during updates of this resource.
Name string: User-provided name of the Network firewall policy. The name should be unique in the project in which the firewall policy is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression a-z? which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
NetworkFirewallPolicyId string: The unique identifier for the resource. This identifier is defined by the server.
PredefinedRules List<NetworkFirewallPolicyWithRulesPredefinedRule>: A list of firewall policy pre-defined rules. Structure is documented below.
Project string
RuleTupleCount int: Total count of all firewall policy rule tuples. A firewall policy can not exceed a set number of tuples.
Rules List<NetworkFirewallPolicyWithRulesRule>: A list of firewall policy rules. Structure is documented below.
SelfLink string: Server-defined URL for the resource.
SelfLinkWithId string: Server-defined URL for this resource with the resource id.

CreationTimestamp string: Creation timestamp in RFC3339 text format.
Description string: (Output) A description of the rule.
Fingerprint string: Fingerprint of the resource. This field is used internally during updates of this resource.
Name string: User-provided name of the Network firewall policy. The name should be unique in the project in which the firewall policy is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression a-z? which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
NetworkFirewallPolicyId string: The unique identifier for the resource. This identifier is defined by the server.
PredefinedRules []NetworkFirewallPolicyWithRulesPredefinedRuleArgs: A list of firewall policy pre-defined rules. Structure is documented below.
Project string
RuleTupleCount int: Total count of all firewall policy rule tuples. A firewall policy can not exceed a set number of tuples.
Rules []NetworkFirewallPolicyWithRulesRuleArgs: A list of firewall policy rules. Structure is documented below.
SelfLink string: Server-defined URL for the resource.
SelfLinkWithId string: Server-defined URL for this resource with the resource id.

creationTimestamp String: Creation timestamp in RFC3339 text format.
description String: (Output) A description of the rule.
fingerprint String: Fingerprint of the resource. This field is used internally during updates of this resource.
name String: User-provided name of the Network firewall policy. The name should be unique in the project in which the firewall policy is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression a-z? which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
networkFirewallPolicyId String: The unique identifier for the resource. This identifier is defined by the server.
predefinedRules List<NetworkFirewallPolicyWithRulesPredefinedRule>: A list of firewall policy pre-defined rules. Structure is documented below.
project String
ruleTupleCount Integer: Total count of all firewall policy rule tuples. A firewall policy can not exceed a set number of tuples.
rules List<NetworkFirewallPolicyWithRulesRule>: A list of firewall policy rules. Structure is documented below.
selfLink String: Server-defined URL for the resource.
selfLinkWithId String: Server-defined URL for this resource with the resource id.

creationTimestamp string: Creation timestamp in RFC3339 text format.
description string: (Output) A description of the rule.
fingerprint string: Fingerprint of the resource. This field is used internally during updates of this resource.
name string: User-provided name of the Network firewall policy. The name should be unique in the project in which the firewall policy is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression a-z? which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
networkFirewallPolicyId string: The unique identifier for the resource. This identifier is defined by the server.
predefinedRules NetworkFirewallPolicyWithRulesPredefinedRule[]: A list of firewall policy pre-defined rules. Structure is documented below.
project string
ruleTupleCount number: Total count of all firewall policy rule tuples. A firewall policy can not exceed a set number of tuples.
rules NetworkFirewallPolicyWithRulesRule[]: A list of firewall policy rules. Structure is documented below.
selfLink string: Server-defined URL for the resource.
selfLinkWithId string: Server-defined URL for this resource with the resource id.

creation_timestamp str: Creation timestamp in RFC3339 text format.
description str: (Output) A description of the rule.
fingerprint str: Fingerprint of the resource. This field is used internally during updates of this resource.
name str: User-provided name of the Network firewall policy. The name should be unique in the project in which the firewall policy is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression a-z? which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
network_firewall_policy_id str: The unique identifier for the resource. This identifier is defined by the server.
predefined_rules Sequence[NetworkFirewallPolicyWithRulesPredefinedRuleArgs]: A list of firewall policy pre-defined rules. Structure is documented below.
project str
rule_tuple_count int: Total count of all firewall policy rule tuples. A firewall policy can not exceed a set number of tuples.
rules Sequence[NetworkFirewallPolicyWithRulesRuleArgs]: A list of firewall policy rules. Structure is documented below.
self_link str: Server-defined URL for the resource.
self_link_with_id str: Server-defined URL for this resource with the resource id.

creationTimestamp String: Creation timestamp in RFC3339 text format.
description String: (Output) A description of the rule.
fingerprint String: Fingerprint of the resource. This field is used internally during updates of this resource.
name String: User-provided name of the Network firewall policy. The name should be unique in the project in which the firewall policy is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression a-z? which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
networkFirewallPolicyId String: The unique identifier for the resource. This identifier is defined by the server.
predefinedRules List<Property Map>: A list of firewall policy pre-defined rules. Structure is documented below.
project String
ruleTupleCount Number: Total count of all firewall policy rule tuples. A firewall policy can not exceed a set number of tuples.
rules List<Property Map>: A list of firewall policy rules. Structure is documented below.
selfLink String: Server-defined URL for the resource.
selfLinkWithId String: Server-defined URL for this resource with the resource id.

Supporting Types

NetworkFirewallPolicyWithRulesPredefinedRule
, NetworkFirewallPolicyWithRulesPredefinedRuleArgs

Action string: (Output) The Action to perform when the client connection triggers the rule. Can currently be either "allow", "deny", "apply_security_profile_group" or "goto_next".
Description string: (Output) A description of the rule.
Direction string: (Output) The direction in which this rule applies. If unspecified an INGRESS rule is created.
Disabled bool: (Output) Denotes whether the firewall policy rule is disabled. When set to true, the firewall policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the firewall policy rule will be enabled.
EnableLogging bool: (Output) Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver.
Matches List<NetworkFirewallPolicyWithRulesPredefinedRuleMatch>: (Output) A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
Priority int: (Output) An integer indicating the priority of a rule in the list. The priority must be a value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
RuleName string: (Output) An optional name for the rule. This field is not a unique identifier and can be updated.
SecurityProfileGroup string: (Output) A fully-qualified URL of a SecurityProfile resource instance. Example: https://networksecurity.googleapis.com/v1/projects/{project}/locations/{location}/securityProfileGroups/my-security-profile-group Must be specified if action is 'apply_security_profile_group'.
TargetSecureTags List<NetworkFirewallPolicyWithRulesPredefinedRuleTargetSecureTag>: (Output) A list of secure tags that controls which instances the firewall rule applies to. If targetSecureTag are specified, then the firewall rule applies only to instances in the VPC network that have one of those EFFECTIVE secure tags, if all the target_secure_tag are in INEFFECTIVE state, then this rule will be ignored. targetSecureTag may not be set at the same time as targetServiceAccounts. If neither targetServiceAccounts nor targetSecureTag are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label tags allowed is 256. Structure is documented below.
TargetServiceAccounts List<string>: (Output) A list of service accounts indicating the sets of instances that are applied with this rule.
TlsInspect bool: (Output) Boolean flag indicating if the traffic should be TLS decrypted. It can be set only if action = 'apply_security_profile_group' and cannot be set for other actions.

Action string: (Output) The Action to perform when the client connection triggers the rule. Can currently be either "allow", "deny", "apply_security_profile_group" or "goto_next".
Description string: (Output) A description of the rule.
Direction string: (Output) The direction in which this rule applies. If unspecified an INGRESS rule is created.
Disabled bool: (Output) Denotes whether the firewall policy rule is disabled. When set to true, the firewall policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the firewall policy rule will be enabled.
EnableLogging bool: (Output) Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver.
Matches []NetworkFirewallPolicyWithRulesPredefinedRuleMatch: (Output) A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
Priority int: (Output) An integer indicating the priority of a rule in the list. The priority must be a value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
RuleName string: (Output) An optional name for the rule. This field is not a unique identifier and can be updated.
SecurityProfileGroup string: (Output) A fully-qualified URL of a SecurityProfile resource instance. Example: https://networksecurity.googleapis.com/v1/projects/{project}/locations/{location}/securityProfileGroups/my-security-profile-group Must be specified if action is 'apply_security_profile_group'.
TargetSecureTags []NetworkFirewallPolicyWithRulesPredefinedRuleTargetSecureTag: (Output) A list of secure tags that controls which instances the firewall rule applies to. If targetSecureTag are specified, then the firewall rule applies only to instances in the VPC network that have one of those EFFECTIVE secure tags, if all the target_secure_tag are in INEFFECTIVE state, then this rule will be ignored. targetSecureTag may not be set at the same time as targetServiceAccounts. If neither targetServiceAccounts nor targetSecureTag are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label tags allowed is 256. Structure is documented below.
TargetServiceAccounts []string: (Output) A list of service accounts indicating the sets of instances that are applied with this rule.
TlsInspect bool: (Output) Boolean flag indicating if the traffic should be TLS decrypted. It can be set only if action = 'apply_security_profile_group' and cannot be set for other actions.

action String: (Output) The Action to perform when the client connection triggers the rule. Can currently be either "allow", "deny", "apply_security_profile_group" or "goto_next".
description String: (Output) A description of the rule.
direction String: (Output) The direction in which this rule applies. If unspecified an INGRESS rule is created.
disabled Boolean: (Output) Denotes whether the firewall policy rule is disabled. When set to true, the firewall policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the firewall policy rule will be enabled.
enableLogging Boolean: (Output) Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver.
matches List<NetworkFirewallPolicyWithRulesPredefinedRuleMatch>: (Output) A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
priority Integer: (Output) An integer indicating the priority of a rule in the list. The priority must be a value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
ruleName String: (Output) An optional name for the rule. This field is not a unique identifier and can be updated.
securityProfileGroup String: (Output) A fully-qualified URL of a SecurityProfile resource instance. Example: https://networksecurity.googleapis.com/v1/projects/{project}/locations/{location}/securityProfileGroups/my-security-profile-group Must be specified if action is 'apply_security_profile_group'.
targetSecureTags List<NetworkFirewallPolicyWithRulesPredefinedRuleTargetSecureTag>: (Output) A list of secure tags that controls which instances the firewall rule applies to. If targetSecureTag are specified, then the firewall rule applies only to instances in the VPC network that have one of those EFFECTIVE secure tags, if all the target_secure_tag are in INEFFECTIVE state, then this rule will be ignored. targetSecureTag may not be set at the same time as targetServiceAccounts. If neither targetServiceAccounts nor targetSecureTag are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label tags allowed is 256. Structure is documented below.
targetServiceAccounts List<String>: (Output) A list of service accounts indicating the sets of instances that are applied with this rule.
tlsInspect Boolean: (Output) Boolean flag indicating if the traffic should be TLS decrypted. It can be set only if action = 'apply_security_profile_group' and cannot be set for other actions.

action string: (Output) The Action to perform when the client connection triggers the rule. Can currently be either "allow", "deny", "apply_security_profile_group" or "goto_next".
description string: (Output) A description of the rule.
direction string: (Output) The direction in which this rule applies. If unspecified an INGRESS rule is created.
disabled boolean: (Output) Denotes whether the firewall policy rule is disabled. When set to true, the firewall policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the firewall policy rule will be enabled.
enableLogging boolean: (Output) Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver.
matches NetworkFirewallPolicyWithRulesPredefinedRuleMatch[]: (Output) A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
priority number: (Output) An integer indicating the priority of a rule in the list. The priority must be a value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
ruleName string: (Output) An optional name for the rule. This field is not a unique identifier and can be updated.
securityProfileGroup string: (Output) A fully-qualified URL of a SecurityProfile resource instance. Example: https://networksecurity.googleapis.com/v1/projects/{project}/locations/{location}/securityProfileGroups/my-security-profile-group Must be specified if action is 'apply_security_profile_group'.
targetSecureTags NetworkFirewallPolicyWithRulesPredefinedRuleTargetSecureTag[]: (Output) A list of secure tags that controls which instances the firewall rule applies to. If targetSecureTag are specified, then the firewall rule applies only to instances in the VPC network that have one of those EFFECTIVE secure tags, if all the target_secure_tag are in INEFFECTIVE state, then this rule will be ignored. targetSecureTag may not be set at the same time as targetServiceAccounts. If neither targetServiceAccounts nor targetSecureTag are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label tags allowed is 256. Structure is documented below.
targetServiceAccounts string[]: (Output) A list of service accounts indicating the sets of instances that are applied with this rule.
tlsInspect boolean: (Output) Boolean flag indicating if the traffic should be TLS decrypted. It can be set only if action = 'apply_security_profile_group' and cannot be set for other actions.

action str: (Output) The Action to perform when the client connection triggers the rule. Can currently be either "allow", "deny", "apply_security_profile_group" or "goto_next".
description str: (Output) A description of the rule.
direction str: (Output) The direction in which this rule applies. If unspecified an INGRESS rule is created.
disabled bool: (Output) Denotes whether the firewall policy rule is disabled. When set to true, the firewall policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the firewall policy rule will be enabled.
enable_logging bool: (Output) Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver.
matches Sequence[NetworkFirewallPolicyWithRulesPredefinedRuleMatch]: (Output) A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
priority int: (Output) An integer indicating the priority of a rule in the list. The priority must be a value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
rule_name str: (Output) An optional name for the rule. This field is not a unique identifier and can be updated.
security_profile_group str: (Output) A fully-qualified URL of a SecurityProfile resource instance. Example: https://networksecurity.googleapis.com/v1/projects/{project}/locations/{location}/securityProfileGroups/my-security-profile-group Must be specified if action is 'apply_security_profile_group'.
target_secure_tags Sequence[NetworkFirewallPolicyWithRulesPredefinedRuleTargetSecureTag]: (Output) A list of secure tags that controls which instances the firewall rule applies to. If targetSecureTag are specified, then the firewall rule applies only to instances in the VPC network that have one of those EFFECTIVE secure tags, if all the target_secure_tag are in INEFFECTIVE state, then this rule will be ignored. targetSecureTag may not be set at the same time as targetServiceAccounts. If neither targetServiceAccounts nor targetSecureTag are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label tags allowed is 256. Structure is documented below.
target_service_accounts Sequence[str]: (Output) A list of service accounts indicating the sets of instances that are applied with this rule.
tls_inspect bool: (Output) Boolean flag indicating if the traffic should be TLS decrypted. It can be set only if action = 'apply_security_profile_group' and cannot be set for other actions.

action String: (Output) The Action to perform when the client connection triggers the rule. Can currently be either "allow", "deny", "apply_security_profile_group" or "goto_next".
description String: (Output) A description of the rule.
direction String: (Output) The direction in which this rule applies. If unspecified an INGRESS rule is created.
disabled Boolean: (Output) Denotes whether the firewall policy rule is disabled. When set to true, the firewall policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the firewall policy rule will be enabled.
enableLogging Boolean: (Output) Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver.
matches List<Property Map>: (Output) A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
priority Number: (Output) An integer indicating the priority of a rule in the list. The priority must be a value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
ruleName String: (Output) An optional name for the rule. This field is not a unique identifier and can be updated.
securityProfileGroup String: (Output) A fully-qualified URL of a SecurityProfile resource instance. Example: https://networksecurity.googleapis.com/v1/projects/{project}/locations/{location}/securityProfileGroups/my-security-profile-group Must be specified if action is 'apply_security_profile_group'.
targetSecureTags List<Property Map>: (Output) A list of secure tags that controls which instances the firewall rule applies to. If targetSecureTag are specified, then the firewall rule applies only to instances in the VPC network that have one of those EFFECTIVE secure tags, if all the target_secure_tag are in INEFFECTIVE state, then this rule will be ignored. targetSecureTag may not be set at the same time as targetServiceAccounts. If neither targetServiceAccounts nor targetSecureTag are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label tags allowed is 256. Structure is documented below.
targetServiceAccounts List<String>: (Output) A list of service accounts indicating the sets of instances that are applied with this rule.
tlsInspect Boolean: (Output) Boolean flag indicating if the traffic should be TLS decrypted. It can be set only if action = 'apply_security_profile_group' and cannot be set for other actions.

NetworkFirewallPolicyWithRulesPredefinedRuleMatch
, NetworkFirewallPolicyWithRulesPredefinedRuleMatchArgs

DestAddressGroups List<string>

Address groups which should be matched against the traffic destination. Maximum number of destination address groups is 10.

DestFqdns List<string>

Fully Qualified Domain Name (FQDN) which should be matched against traffic destination. Maximum number of destination fqdn allowed is 100.

DestIpRanges List<string>

Destination IP address range in CIDR format. Required for EGRESS rules.

DestRegionCodes List<string>

Region codes whose IP addresses will be used to match for destination of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of destination region codes allowed is 5000.

DestThreatIntelligences List<string>

Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic destination.

Layer4Configs List<NetworkFirewallPolicyWithRulesPredefinedRuleMatchLayer4Config>

Pairs of IP protocols and ports that the rule should match. Structure is documented below.

SrcAddressGroups List<string>

Address groups which should be matched against the traffic source. Maximum number of source address groups is 10.

SrcFqdns List<string>

Fully Qualified Domain Name (FQDN) which should be matched against traffic source. Maximum number of source fqdn allowed is 100.

SrcIpRanges List<string>

Source IP address range in CIDR format. Required for INGRESS rules.

SrcRegionCodes List<string>

Region codes whose IP addresses will be used to match for source of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of source region codes allowed is 5000.

SrcSecureTags List<NetworkFirewallPolicyWithRulesPredefinedRuleMatchSrcSecureTag>

List of secure tag values, which should be matched at the source of the traffic. For INGRESS rule, if all the srcSecureTag are INEFFECTIVE, and there is no srcIpRange, this rule will be ignored. Maximum number of source tag values allowed is 256. Structure is documented below.

The layer4_config block supports:

SrcThreatIntelligences List<string>

Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic source.

DestAddressGroups []string

Address groups which should be matched against the traffic destination. Maximum number of destination address groups is 10.

DestFqdns []string

Fully Qualified Domain Name (FQDN) which should be matched against traffic destination. Maximum number of destination fqdn allowed is 100.

DestIpRanges []string

Destination IP address range in CIDR format. Required for EGRESS rules.

DestRegionCodes []string

DestThreatIntelligences []string

Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic destination.

Layer4Configs []NetworkFirewallPolicyWithRulesPredefinedRuleMatchLayer4Config

Pairs of IP protocols and ports that the rule should match. Structure is documented below.

SrcAddressGroups []string

Address groups which should be matched against the traffic source. Maximum number of source address groups is 10.

SrcFqdns []string

Fully Qualified Domain Name (FQDN) which should be matched against traffic source. Maximum number of source fqdn allowed is 100.

SrcIpRanges []string

Source IP address range in CIDR format. Required for INGRESS rules.

SrcRegionCodes []string

SrcSecureTags []NetworkFirewallPolicyWithRulesPredefinedRuleMatchSrcSecureTag

The layer4_config block supports:

SrcThreatIntelligences []string

Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic source.

destAddressGroups List<String>

Address groups which should be matched against the traffic destination. Maximum number of destination address groups is 10.

destFqdns List<String>

Fully Qualified Domain Name (FQDN) which should be matched against traffic destination. Maximum number of destination fqdn allowed is 100.

destIpRanges List<String>

Destination IP address range in CIDR format. Required for EGRESS rules.

destRegionCodes List<String>

destThreatIntelligences List<String>

Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic destination.

layer4Configs List<NetworkFirewallPolicyWithRulesPredefinedRuleMatchLayer4Config>

Pairs of IP protocols and ports that the rule should match. Structure is documented below.

srcAddressGroups List<String>

Address groups which should be matched against the traffic source. Maximum number of source address groups is 10.

srcFqdns List<String>

Fully Qualified Domain Name (FQDN) which should be matched against traffic source. Maximum number of source fqdn allowed is 100.

srcIpRanges List<String>

Source IP address range in CIDR format. Required for INGRESS rules.

srcRegionCodes List<String>

srcSecureTags List<NetworkFirewallPolicyWithRulesPredefinedRuleMatchSrcSecureTag>

The layer4_config block supports:

srcThreatIntelligences List<String>

Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic source.

destAddressGroups string[]

Address groups which should be matched against the traffic destination. Maximum number of destination address groups is 10.

destFqdns string[]

Fully Qualified Domain Name (FQDN) which should be matched against traffic destination. Maximum number of destination fqdn allowed is 100.

destIpRanges string[]

Destination IP address range in CIDR format. Required for EGRESS rules.

destRegionCodes string[]

destThreatIntelligences string[]

Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic destination.

layer4Configs NetworkFirewallPolicyWithRulesPredefinedRuleMatchLayer4Config[]

Pairs of IP protocols and ports that the rule should match. Structure is documented below.

srcAddressGroups string[]

Address groups which should be matched against the traffic source. Maximum number of source address groups is 10.

srcFqdns string[]

Fully Qualified Domain Name (FQDN) which should be matched against traffic source. Maximum number of source fqdn allowed is 100.

srcIpRanges string[]

Source IP address range in CIDR format. Required for INGRESS rules.

srcRegionCodes string[]

srcSecureTags NetworkFirewallPolicyWithRulesPredefinedRuleMatchSrcSecureTag[]

The layer4_config block supports:

srcThreatIntelligences string[]

Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic source.

dest_address_groups Sequence[str]

Address groups which should be matched against the traffic destination. Maximum number of destination address groups is 10.

dest_fqdns Sequence[str]

Fully Qualified Domain Name (FQDN) which should be matched against traffic destination. Maximum number of destination fqdn allowed is 100.

dest_ip_ranges Sequence[str]

Destination IP address range in CIDR format. Required for EGRESS rules.

dest_region_codes Sequence[str]

dest_threat_intelligences Sequence[str]

Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic destination.

layer4_configs Sequence[NetworkFirewallPolicyWithRulesPredefinedRuleMatchLayer4Config]

Pairs of IP protocols and ports that the rule should match. Structure is documented below.

src_address_groups Sequence[str]

Address groups which should be matched against the traffic source. Maximum number of source address groups is 10.

src_fqdns Sequence[str]

Fully Qualified Domain Name (FQDN) which should be matched against traffic source. Maximum number of source fqdn allowed is 100.

src_ip_ranges Sequence[str]

Source IP address range in CIDR format. Required for INGRESS rules.

src_region_codes Sequence[str]

src_secure_tags Sequence[NetworkFirewallPolicyWithRulesPredefinedRuleMatchSrcSecureTag]

The layer4_config block supports:

src_threat_intelligences Sequence[str]

Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic source.

destAddressGroups List<String>

Address groups which should be matched against the traffic destination. Maximum number of destination address groups is 10.

destFqdns List<String>

Fully Qualified Domain Name (FQDN) which should be matched against traffic destination. Maximum number of destination fqdn allowed is 100.

destIpRanges List<String>

Destination IP address range in CIDR format. Required for EGRESS rules.

destRegionCodes List<String>

destThreatIntelligences List<String>

Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic destination.

layer4Configs List<Property Map>

Pairs of IP protocols and ports that the rule should match. Structure is documented below.

srcAddressGroups List<String>

Address groups which should be matched against the traffic source. Maximum number of source address groups is 10.

srcFqdns List<String>

Fully Qualified Domain Name (FQDN) which should be matched against traffic source. Maximum number of source fqdn allowed is 100.

srcIpRanges List<String>

Source IP address range in CIDR format. Required for INGRESS rules.

srcRegionCodes List<String>

srcSecureTags List<Property Map>

The layer4_config block supports:

srcThreatIntelligences List<String>

Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic source.

NetworkFirewallPolicyWithRulesPredefinedRuleMatchLayer4Config
, NetworkFirewallPolicyWithRulesPredefinedRuleMatchLayer4ConfigArgs

IpProtocol string: (Output) The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
Ports List<string>: (Output) An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].

IpProtocol string: (Output) The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
Ports []string: (Output) An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].

ipProtocol String: (Output) The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
ports List<String>: (Output) An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].

ipProtocol string: (Output) The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
ports string[]: (Output) An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].

ip_protocol str: (Output) The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
ports Sequence[str]: (Output) An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].

ipProtocol String: (Output) The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
ports List<String>: (Output) An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].

NetworkFirewallPolicyWithRulesPredefinedRuleMatchSrcSecureTag
, NetworkFirewallPolicyWithRulesPredefinedRuleMatchSrcSecureTagArgs

Name string: Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
State string: (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.

Name string: Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
State string: (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.

name String: Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
state String: (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.

name string: Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
state string: (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.

name str: Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
state str: (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.

name String: Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
state String: (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.

NetworkFirewallPolicyWithRulesPredefinedRuleTargetSecureTag
, NetworkFirewallPolicyWithRulesPredefinedRuleTargetSecureTagArgs

Name string: Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
State string: (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.

Name string: Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
State string: (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.

name String: Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
state String: (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.

name string: Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
state string: (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.

name str: Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
state str: (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.

name String: Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
state String: (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.

NetworkFirewallPolicyWithRulesRule
, NetworkFirewallPolicyWithRulesRuleArgs

Action string: The Action to perform when the client connection triggers the rule. Can currently be either "allow", "deny", "apply_security_profile_group" or "goto_next".
Match NetworkFirewallPolicyWithRulesRuleMatch: A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
Priority int: An integer indicating the priority of a rule in the list. The priority must be a value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
Description string: A description of the rule.
Direction string: The direction in which this rule applies. If unspecified an INGRESS rule is created. Possible values are: INGRESS, EGRESS.
Disabled bool: Denotes whether the firewall policy rule is disabled. When set to true, the firewall policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the firewall policy rule will be enabled.
EnableLogging bool: Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver.
RuleName string: An optional name for the rule. This field is not a unique identifier and can be updated.
SecurityProfileGroup string: A fully-qualified URL of a SecurityProfile resource instance. Example: https://networksecurity.googleapis.com/v1/projects/{project}/locations/{location}/securityProfileGroups/my-security-profile-group Must be specified if action is 'apply_security_profile_group'.
TargetSecureTags List<NetworkFirewallPolicyWithRulesRuleTargetSecureTag>: A list of secure tags that controls which instances the firewall rule applies to. If targetSecureTag are specified, then the firewall rule applies only to instances in the VPC network that have one of those EFFECTIVE secure tags, if all the target_secure_tag are in INEFFECTIVE state, then this rule will be ignored. targetSecureTag may not be set at the same time as targetServiceAccounts. If neither targetServiceAccounts nor targetSecureTag are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label tags allowed is 256. Structure is documented below.
TargetServiceAccounts List<string>: A list of service accounts indicating the sets of instances that are applied with this rule.
TlsInspect bool: Boolean flag indicating if the traffic should be TLS decrypted. It can be set only if action = 'apply_security_profile_group' and cannot be set for other actions.

Action string: The Action to perform when the client connection triggers the rule. Can currently be either "allow", "deny", "apply_security_profile_group" or "goto_next".
Match NetworkFirewallPolicyWithRulesRuleMatch: A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
Priority int: An integer indicating the priority of a rule in the list. The priority must be a value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
Description string: A description of the rule.
Direction string: The direction in which this rule applies. If unspecified an INGRESS rule is created. Possible values are: INGRESS, EGRESS.
Disabled bool: Denotes whether the firewall policy rule is disabled. When set to true, the firewall policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the firewall policy rule will be enabled.
EnableLogging bool: Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver.
RuleName string: An optional name for the rule. This field is not a unique identifier and can be updated.
SecurityProfileGroup string: A fully-qualified URL of a SecurityProfile resource instance. Example: https://networksecurity.googleapis.com/v1/projects/{project}/locations/{location}/securityProfileGroups/my-security-profile-group Must be specified if action is 'apply_security_profile_group'.
TargetSecureTags []NetworkFirewallPolicyWithRulesRuleTargetSecureTag: A list of secure tags that controls which instances the firewall rule applies to. If targetSecureTag are specified, then the firewall rule applies only to instances in the VPC network that have one of those EFFECTIVE secure tags, if all the target_secure_tag are in INEFFECTIVE state, then this rule will be ignored. targetSecureTag may not be set at the same time as targetServiceAccounts. If neither targetServiceAccounts nor targetSecureTag are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label tags allowed is 256. Structure is documented below.
TargetServiceAccounts []string: A list of service accounts indicating the sets of instances that are applied with this rule.
TlsInspect bool: Boolean flag indicating if the traffic should be TLS decrypted. It can be set only if action = 'apply_security_profile_group' and cannot be set for other actions.

action String: The Action to perform when the client connection triggers the rule. Can currently be either "allow", "deny", "apply_security_profile_group" or "goto_next".
match NetworkFirewallPolicyWithRulesRuleMatch: A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
priority Integer: An integer indicating the priority of a rule in the list. The priority must be a value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
description String: A description of the rule.
direction String: The direction in which this rule applies. If unspecified an INGRESS rule is created. Possible values are: INGRESS, EGRESS.
disabled Boolean: Denotes whether the firewall policy rule is disabled. When set to true, the firewall policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the firewall policy rule will be enabled.
enableLogging Boolean: Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver.
ruleName String: An optional name for the rule. This field is not a unique identifier and can be updated.
securityProfileGroup String: A fully-qualified URL of a SecurityProfile resource instance. Example: https://networksecurity.googleapis.com/v1/projects/{project}/locations/{location}/securityProfileGroups/my-security-profile-group Must be specified if action is 'apply_security_profile_group'.
targetSecureTags List<NetworkFirewallPolicyWithRulesRuleTargetSecureTag>: A list of secure tags that controls which instances the firewall rule applies to. If targetSecureTag are specified, then the firewall rule applies only to instances in the VPC network that have one of those EFFECTIVE secure tags, if all the target_secure_tag are in INEFFECTIVE state, then this rule will be ignored. targetSecureTag may not be set at the same time as targetServiceAccounts. If neither targetServiceAccounts nor targetSecureTag are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label tags allowed is 256. Structure is documented below.
targetServiceAccounts List<String>: A list of service accounts indicating the sets of instances that are applied with this rule.
tlsInspect Boolean: Boolean flag indicating if the traffic should be TLS decrypted. It can be set only if action = 'apply_security_profile_group' and cannot be set for other actions.

action string: The Action to perform when the client connection triggers the rule. Can currently be either "allow", "deny", "apply_security_profile_group" or "goto_next".
match NetworkFirewallPolicyWithRulesRuleMatch: A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
priority number: An integer indicating the priority of a rule in the list. The priority must be a value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
description string: A description of the rule.
direction string: The direction in which this rule applies. If unspecified an INGRESS rule is created. Possible values are: INGRESS, EGRESS.
disabled boolean: Denotes whether the firewall policy rule is disabled. When set to true, the firewall policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the firewall policy rule will be enabled.
enableLogging boolean: Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver.
ruleName string: An optional name for the rule. This field is not a unique identifier and can be updated.
securityProfileGroup string: A fully-qualified URL of a SecurityProfile resource instance. Example: https://networksecurity.googleapis.com/v1/projects/{project}/locations/{location}/securityProfileGroups/my-security-profile-group Must be specified if action is 'apply_security_profile_group'.
targetSecureTags NetworkFirewallPolicyWithRulesRuleTargetSecureTag[]: A list of secure tags that controls which instances the firewall rule applies to. If targetSecureTag are specified, then the firewall rule applies only to instances in the VPC network that have one of those EFFECTIVE secure tags, if all the target_secure_tag are in INEFFECTIVE state, then this rule will be ignored. targetSecureTag may not be set at the same time as targetServiceAccounts. If neither targetServiceAccounts nor targetSecureTag are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label tags allowed is 256. Structure is documented below.
targetServiceAccounts string[]: A list of service accounts indicating the sets of instances that are applied with this rule.
tlsInspect boolean: Boolean flag indicating if the traffic should be TLS decrypted. It can be set only if action = 'apply_security_profile_group' and cannot be set for other actions.

action str: The Action to perform when the client connection triggers the rule. Can currently be either "allow", "deny", "apply_security_profile_group" or "goto_next".
match NetworkFirewallPolicyWithRulesRuleMatch: A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
priority int: An integer indicating the priority of a rule in the list. The priority must be a value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
description str: A description of the rule.
direction str: The direction in which this rule applies. If unspecified an INGRESS rule is created. Possible values are: INGRESS, EGRESS.
disabled bool: Denotes whether the firewall policy rule is disabled. When set to true, the firewall policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the firewall policy rule will be enabled.
enable_logging bool: Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver.
rule_name str: An optional name for the rule. This field is not a unique identifier and can be updated.
security_profile_group str: A fully-qualified URL of a SecurityProfile resource instance. Example: https://networksecurity.googleapis.com/v1/projects/{project}/locations/{location}/securityProfileGroups/my-security-profile-group Must be specified if action is 'apply_security_profile_group'.
target_secure_tags Sequence[NetworkFirewallPolicyWithRulesRuleTargetSecureTag]: A list of secure tags that controls which instances the firewall rule applies to. If targetSecureTag are specified, then the firewall rule applies only to instances in the VPC network that have one of those EFFECTIVE secure tags, if all the target_secure_tag are in INEFFECTIVE state, then this rule will be ignored. targetSecureTag may not be set at the same time as targetServiceAccounts. If neither targetServiceAccounts nor targetSecureTag are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label tags allowed is 256. Structure is documented below.
target_service_accounts Sequence[str]: A list of service accounts indicating the sets of instances that are applied with this rule.
tls_inspect bool: Boolean flag indicating if the traffic should be TLS decrypted. It can be set only if action = 'apply_security_profile_group' and cannot be set for other actions.

action String: The Action to perform when the client connection triggers the rule. Can currently be either "allow", "deny", "apply_security_profile_group" or "goto_next".
match Property Map: A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
priority Number: An integer indicating the priority of a rule in the list. The priority must be a value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
description String: A description of the rule.
direction String: The direction in which this rule applies. If unspecified an INGRESS rule is created. Possible values are: INGRESS, EGRESS.
disabled Boolean: Denotes whether the firewall policy rule is disabled. When set to true, the firewall policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the firewall policy rule will be enabled.
enableLogging Boolean: Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver.
ruleName String: An optional name for the rule. This field is not a unique identifier and can be updated.
securityProfileGroup String: A fully-qualified URL of a SecurityProfile resource instance. Example: https://networksecurity.googleapis.com/v1/projects/{project}/locations/{location}/securityProfileGroups/my-security-profile-group Must be specified if action is 'apply_security_profile_group'.
targetSecureTags List<Property Map>: A list of secure tags that controls which instances the firewall rule applies to. If targetSecureTag are specified, then the firewall rule applies only to instances in the VPC network that have one of those EFFECTIVE secure tags, if all the target_secure_tag are in INEFFECTIVE state, then this rule will be ignored. targetSecureTag may not be set at the same time as targetServiceAccounts. If neither targetServiceAccounts nor targetSecureTag are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label tags allowed is 256. Structure is documented below.
targetServiceAccounts List<String>: A list of service accounts indicating the sets of instances that are applied with this rule.
tlsInspect Boolean: Boolean flag indicating if the traffic should be TLS decrypted. It can be set only if action = 'apply_security_profile_group' and cannot be set for other actions.

NetworkFirewallPolicyWithRulesRuleMatch
, NetworkFirewallPolicyWithRulesRuleMatchArgs

Layer4Configs List<NetworkFirewallPolicyWithRulesRuleMatchLayer4Config>

Pairs of IP protocols and ports that the rule should match. Structure is documented below.

DestAddressGroups List<string>

Address groups which should be matched against the traffic destination. Maximum number of destination address groups is 10.

DestFqdns List<string>

Fully Qualified Domain Name (FQDN) which should be matched against traffic destination. Maximum number of destination fqdn allowed is 100.

DestIpRanges List<string>

Destination IP address range in CIDR format. Required for EGRESS rules.

DestNetworkScope string

Network scope of the traffic destination. Possible values are: INTERNET, INTRA_VPC, NON_INTERNET, VPC_NETWORKS.

DestRegionCodes List<string>

DestThreatIntelligences List<string>

Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic destination.

SrcAddressGroups List<string>

Address groups which should be matched against the traffic source. Maximum number of source address groups is 10.

SrcFqdns List<string>

Fully Qualified Domain Name (FQDN) which should be matched against traffic source. Maximum number of source fqdn allowed is 100.

SrcIpRanges List<string>

Source IP address range in CIDR format. Required for INGRESS rules.

SrcNetworkScope string

Network scope of the traffic source. Possible values are: INTERNET, INTRA_VPC, NON_INTERNET, VPC_NETWORKS.

SrcNetworks List<string>

Networks of the traffic source. It can be either a full or partial url.

SrcRegionCodes List<string>

SrcSecureTags List<NetworkFirewallPolicyWithRulesRuleMatchSrcSecureTag>

The layer4_config block supports:

SrcThreatIntelligences List<string>

Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic source.

Layer4Configs []NetworkFirewallPolicyWithRulesRuleMatchLayer4Config

Pairs of IP protocols and ports that the rule should match. Structure is documented below.

DestAddressGroups []string

Address groups which should be matched against the traffic destination. Maximum number of destination address groups is 10.

DestFqdns []string

Fully Qualified Domain Name (FQDN) which should be matched against traffic destination. Maximum number of destination fqdn allowed is 100.

DestIpRanges []string

Destination IP address range in CIDR format. Required for EGRESS rules.

DestNetworkScope string

Network scope of the traffic destination. Possible values are: INTERNET, INTRA_VPC, NON_INTERNET, VPC_NETWORKS.

DestRegionCodes []string

DestThreatIntelligences []string

Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic destination.

SrcAddressGroups []string

Address groups which should be matched against the traffic source. Maximum number of source address groups is 10.

SrcFqdns []string

Fully Qualified Domain Name (FQDN) which should be matched against traffic source. Maximum number of source fqdn allowed is 100.

SrcIpRanges []string

Source IP address range in CIDR format. Required for INGRESS rules.

SrcNetworkScope string

Network scope of the traffic source. Possible values are: INTERNET, INTRA_VPC, NON_INTERNET, VPC_NETWORKS.

SrcNetworks []string

Networks of the traffic source. It can be either a full or partial url.

SrcRegionCodes []string

SrcSecureTags []NetworkFirewallPolicyWithRulesRuleMatchSrcSecureTag

The layer4_config block supports:

SrcThreatIntelligences []string

Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic source.

layer4Configs List<NetworkFirewallPolicyWithRulesRuleMatchLayer4Config>

Pairs of IP protocols and ports that the rule should match. Structure is documented below.

destAddressGroups List<String>

Address groups which should be matched against the traffic destination. Maximum number of destination address groups is 10.

destFqdns List<String>

Fully Qualified Domain Name (FQDN) which should be matched against traffic destination. Maximum number of destination fqdn allowed is 100.

destIpRanges List<String>

Destination IP address range in CIDR format. Required for EGRESS rules.

destNetworkScope String

Network scope of the traffic destination. Possible values are: INTERNET, INTRA_VPC, NON_INTERNET, VPC_NETWORKS.

destRegionCodes List<String>

destThreatIntelligences List<String>

Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic destination.

srcAddressGroups List<String>

Address groups which should be matched against the traffic source. Maximum number of source address groups is 10.

srcFqdns List<String>

Fully Qualified Domain Name (FQDN) which should be matched against traffic source. Maximum number of source fqdn allowed is 100.

srcIpRanges List<String>

Source IP address range in CIDR format. Required for INGRESS rules.

srcNetworkScope String

Network scope of the traffic source. Possible values are: INTERNET, INTRA_VPC, NON_INTERNET, VPC_NETWORKS.

srcNetworks List<String>

Networks of the traffic source. It can be either a full or partial url.

srcRegionCodes List<String>

srcSecureTags List<NetworkFirewallPolicyWithRulesRuleMatchSrcSecureTag>

The layer4_config block supports:

srcThreatIntelligences List<String>

Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic source.

layer4Configs NetworkFirewallPolicyWithRulesRuleMatchLayer4Config[]

Pairs of IP protocols and ports that the rule should match. Structure is documented below.

destAddressGroups string[]

Address groups which should be matched against the traffic destination. Maximum number of destination address groups is 10.

destFqdns string[]

Fully Qualified Domain Name (FQDN) which should be matched against traffic destination. Maximum number of destination fqdn allowed is 100.

destIpRanges string[]

Destination IP address range in CIDR format. Required for EGRESS rules.

destNetworkScope string

Network scope of the traffic destination. Possible values are: INTERNET, INTRA_VPC, NON_INTERNET, VPC_NETWORKS.

destRegionCodes string[]

destThreatIntelligences string[]

Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic destination.

srcAddressGroups string[]

Address groups which should be matched against the traffic source. Maximum number of source address groups is 10.

srcFqdns string[]

Fully Qualified Domain Name (FQDN) which should be matched against traffic source. Maximum number of source fqdn allowed is 100.

srcIpRanges string[]

Source IP address range in CIDR format. Required for INGRESS rules.

srcNetworkScope string

Network scope of the traffic source. Possible values are: INTERNET, INTRA_VPC, NON_INTERNET, VPC_NETWORKS.

srcNetworks string[]

Networks of the traffic source. It can be either a full or partial url.

srcRegionCodes string[]

srcSecureTags NetworkFirewallPolicyWithRulesRuleMatchSrcSecureTag[]

The layer4_config block supports:

srcThreatIntelligences string[]

Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic source.

layer4_configs Sequence[NetworkFirewallPolicyWithRulesRuleMatchLayer4Config]

Pairs of IP protocols and ports that the rule should match. Structure is documented below.

dest_address_groups Sequence[str]

Address groups which should be matched against the traffic destination. Maximum number of destination address groups is 10.

dest_fqdns Sequence[str]

Fully Qualified Domain Name (FQDN) which should be matched against traffic destination. Maximum number of destination fqdn allowed is 100.

dest_ip_ranges Sequence[str]

Destination IP address range in CIDR format. Required for EGRESS rules.

dest_network_scope str

Network scope of the traffic destination. Possible values are: INTERNET, INTRA_VPC, NON_INTERNET, VPC_NETWORKS.

dest_region_codes Sequence[str]

dest_threat_intelligences Sequence[str]

Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic destination.

src_address_groups Sequence[str]

Address groups which should be matched against the traffic source. Maximum number of source address groups is 10.

src_fqdns Sequence[str]

Fully Qualified Domain Name (FQDN) which should be matched against traffic source. Maximum number of source fqdn allowed is 100.

src_ip_ranges Sequence[str]

Source IP address range in CIDR format. Required for INGRESS rules.

src_network_scope str

Network scope of the traffic source. Possible values are: INTERNET, INTRA_VPC, NON_INTERNET, VPC_NETWORKS.

src_networks Sequence[str]

Networks of the traffic source. It can be either a full or partial url.

src_region_codes Sequence[str]

src_secure_tags Sequence[NetworkFirewallPolicyWithRulesRuleMatchSrcSecureTag]

The layer4_config block supports:

src_threat_intelligences Sequence[str]

Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic source.

layer4Configs List<Property Map>

Pairs of IP protocols and ports that the rule should match. Structure is documented below.

destAddressGroups List<String>

Address groups which should be matched against the traffic destination. Maximum number of destination address groups is 10.

destFqdns List<String>

Fully Qualified Domain Name (FQDN) which should be matched against traffic destination. Maximum number of destination fqdn allowed is 100.

destIpRanges List<String>

Destination IP address range in CIDR format. Required for EGRESS rules.

destNetworkScope String

Network scope of the traffic destination. Possible values are: INTERNET, INTRA_VPC, NON_INTERNET, VPC_NETWORKS.

destRegionCodes List<String>

destThreatIntelligences List<String>

Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic destination.

srcAddressGroups List<String>

Address groups which should be matched against the traffic source. Maximum number of source address groups is 10.

srcFqdns List<String>

Fully Qualified Domain Name (FQDN) which should be matched against traffic source. Maximum number of source fqdn allowed is 100.

srcIpRanges List<String>

Source IP address range in CIDR format. Required for INGRESS rules.

srcNetworkScope String

Network scope of the traffic source. Possible values are: INTERNET, INTRA_VPC, NON_INTERNET, VPC_NETWORKS.

srcNetworks List<String>

Networks of the traffic source. It can be either a full or partial url.

srcRegionCodes List<String>

srcSecureTags List<Property Map>

The layer4_config block supports:

srcThreatIntelligences List<String>

Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic source.

NetworkFirewallPolicyWithRulesRuleMatchLayer4Config
, NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArgs

IpProtocol string: (Output) The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
Ports List<string>: (Output) An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].

IpProtocol string: (Output) The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
Ports []string: (Output) An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].

ipProtocol String: (Output) The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
ports List<String>: (Output) An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].

ipProtocol string: (Output) The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
ports string[]: (Output) An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].

ip_protocol str: (Output) The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
ports Sequence[str]: (Output) An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].

ipProtocol String: (Output) The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
ports List<String>: (Output) An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].

NetworkFirewallPolicyWithRulesRuleMatchSrcSecureTag
, NetworkFirewallPolicyWithRulesRuleMatchSrcSecureTagArgs

Name string: Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
State string: (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.

Name string: Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
State string: (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.

name String: Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
state String: (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.

name string: Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
state string: (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.

name str: Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
state str: (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.

name String: Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
state String: (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.

NetworkFirewallPolicyWithRulesRuleTargetSecureTag
, NetworkFirewallPolicyWithRulesRuleTargetSecureTagArgs

Name string: Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
State string: (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.

Name string: Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
State string: (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.

name String: Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
state String: (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.

name string: Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
state string: (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.

name str: Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
state str: (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.

name String: Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
state String: (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.

Import

NetworkFirewallPolicyWithRules can be imported using any of these accepted formats:

projects/{{project}}/global/firewallPolicies/{{name}}
{{project}}/{{name}}
{{name}}

When using the pulumi import command, NetworkFirewallPolicyWithRules can be imported using one of the formats above. For example:

$ pulumi import gcp:compute/networkFirewallPolicyWithRules:NetworkFirewallPolicyWithRules default projects/{{project}}/global/firewallPolicies/{{name}}

$ pulumi import gcp:compute/networkFirewallPolicyWithRules:NetworkFirewallPolicyWithRules default {{project}}/{{name}}

$ pulumi import gcp:compute/networkFirewallPolicyWithRules:NetworkFirewallPolicyWithRules default {{name}}

To learn more about importing existing cloud resources, see Importing resources.

Package Details

Repository: Google Cloud (GCP) Classic pulumi/pulumi-gcp
License: Apache-2.0
Notes: This Pulumi package is based on the google-beta Terraform Provider.

Google Cloud v8.25.0 published on Thursday, Apr 3, 2025 by Pulumi

pulumi/pulumi-gcp

gcp.compute.NetworkFirewallPolicyWithRules

On this page

On this page

Example Usage

Compute Network Firewall Policy With Rules Full

Create NetworkFirewallPolicyWithRules Resource

Constructor syntax

Parameters

Constructor example

NetworkFirewallPolicyWithRules Resource Properties

Inputs

Outputs

Look up Existing NetworkFirewallPolicyWithRules Resource

Supporting Types

NetworkFirewallPolicyWithRulesPredefinedRule
, NetworkFirewallPolicyWithRulesPredefinedRuleArgs

NetworkFirewallPolicyWithRulesPredefinedRuleMatch
, NetworkFirewallPolicyWithRulesPredefinedRuleMatchArgs

NetworkFirewallPolicyWithRulesPredefinedRuleMatchLayer4Config
, NetworkFirewallPolicyWithRulesPredefinedRuleMatchLayer4ConfigArgs

NetworkFirewallPolicyWithRulesPredefinedRuleMatchSrcSecureTag
, NetworkFirewallPolicyWithRulesPredefinedRuleMatchSrcSecureTagArgs

NetworkFirewallPolicyWithRulesPredefinedRuleTargetSecureTag
, NetworkFirewallPolicyWithRulesPredefinedRuleTargetSecureTagArgs

NetworkFirewallPolicyWithRulesRule
, NetworkFirewallPolicyWithRulesRuleArgs

NetworkFirewallPolicyWithRulesRuleMatch
, NetworkFirewallPolicyWithRulesRuleMatchArgs

NetworkFirewallPolicyWithRulesRuleMatchLayer4Config
, NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArgs

NetworkFirewallPolicyWithRulesRuleMatchSrcSecureTag
, NetworkFirewallPolicyWithRulesRuleMatchSrcSecureTagArgs

NetworkFirewallPolicyWithRulesRuleTargetSecureTag
, NetworkFirewallPolicyWithRulesRuleTargetSecureTagArgs

Import

Package Details

On this page

On this page

gcp.compute.NetworkFirewallPolicyWithRules

On this page

On this page

Example Usage

Compute Network Firewall Policy With Rules Full

Create NetworkFirewallPolicyWithRules Resource

Constructor syntax

Parameters

Constructor example

NetworkFirewallPolicyWithRules Resource Properties

Inputs

Outputs

Look up Existing NetworkFirewallPolicyWithRules Resource

Supporting Types

NetworkFirewallPolicyWithRulesPredefinedRule, NetworkFirewallPolicyWithRulesPredefinedRuleArgs

NetworkFirewallPolicyWithRulesPredefinedRuleMatch, NetworkFirewallPolicyWithRulesPredefinedRuleMatchArgs

NetworkFirewallPolicyWithRulesPredefinedRuleMatchLayer4Config, NetworkFirewallPolicyWithRulesPredefinedRuleMatchLayer4ConfigArgs

NetworkFirewallPolicyWithRulesPredefinedRuleMatchSrcSecureTag, NetworkFirewallPolicyWithRulesPredefinedRuleMatchSrcSecureTagArgs

NetworkFirewallPolicyWithRulesPredefinedRuleTargetSecureTag, NetworkFirewallPolicyWithRulesPredefinedRuleTargetSecureTagArgs

NetworkFirewallPolicyWithRulesRule, NetworkFirewallPolicyWithRulesRuleArgs

NetworkFirewallPolicyWithRulesRuleMatch, NetworkFirewallPolicyWithRulesRuleMatchArgs

NetworkFirewallPolicyWithRulesRuleMatchLayer4Config, NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArgs

NetworkFirewallPolicyWithRulesRuleMatchSrcSecureTag, NetworkFirewallPolicyWithRulesRuleMatchSrcSecureTagArgs

NetworkFirewallPolicyWithRulesRuleTargetSecureTag, NetworkFirewallPolicyWithRulesRuleTargetSecureTagArgs

Import

Package Details

On this page

On this page

NetworkFirewallPolicyWithRulesPredefinedRule
, NetworkFirewallPolicyWithRulesPredefinedRuleArgs

NetworkFirewallPolicyWithRulesPredefinedRuleMatch
, NetworkFirewallPolicyWithRulesPredefinedRuleMatchArgs

NetworkFirewallPolicyWithRulesPredefinedRuleMatchLayer4Config
, NetworkFirewallPolicyWithRulesPredefinedRuleMatchLayer4ConfigArgs

NetworkFirewallPolicyWithRulesPredefinedRuleMatchSrcSecureTag
, NetworkFirewallPolicyWithRulesPredefinedRuleMatchSrcSecureTagArgs

NetworkFirewallPolicyWithRulesPredefinedRuleTargetSecureTag
, NetworkFirewallPolicyWithRulesPredefinedRuleTargetSecureTagArgs

NetworkFirewallPolicyWithRulesRule
, NetworkFirewallPolicyWithRulesRuleArgs

NetworkFirewallPolicyWithRulesRuleMatch
, NetworkFirewallPolicyWithRulesRuleMatchArgs

NetworkFirewallPolicyWithRulesRuleMatchLayer4Config
, NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArgs

NetworkFirewallPolicyWithRulesRuleMatchSrcSecureTag
, NetworkFirewallPolicyWithRulesRuleMatchSrcSecureTagArgs

NetworkFirewallPolicyWithRulesRuleTargetSecureTag
, NetworkFirewallPolicyWithRulesRuleTargetSecureTagArgs