mmv1/products/accesscontextmanager/ServicePerimeter.yaml [299:423]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                          The project may be in any Google Cloud organization, not just the
                          organization that the perimeter is defined in. `*` is not allowed, the case
                          of allowing all Google Cloud resources only is not supported.
            - name: 'ingressTo'
              type: NestedObject
              description: |
                Defines the conditions on the `ApiOperation` and request destination that cause
                this `IngressPolicy` to apply.
              properties:
                - name: 'resources'
                  type: Array
                  description: |
                    A list of resources, currently only projects in the form
                    `projects/<projectnumber>`, protected by this `ServicePerimeter`
                    that are allowed to be accessed by sources defined in the
                    corresponding `IngressFrom`. A request matches if it contains
                    a resource in this list. If `*` is specified for resources,
                    then this `IngressTo` rule will authorize access to all
                    resources inside the perimeter, provided that the request
                    also matches the `operations` field.
                  is_set: true
                  item_type:
                    type: String
                - name: 'roles'
                  type: Array
                  item_type:
                    type: String
                  description: |
                    A list of IAM roles that represent the set of operations that the sources
                    specified in the corresponding `IngressFrom`
                    are allowed to perform.
                - name: 'operations'
                  type: Array
                  description: |
                    A list of `ApiOperations` the sources specified in corresponding `IngressFrom`
                    are allowed to perform in this `ServicePerimeter`.
                  item_type:
                    type: NestedObject
                    properties:
                      - name: 'serviceName'
                        type: String
                        description: |
                          The name of the API whose methods or permissions the `IngressPolicy` or
                          `EgressPolicy` want to allow. A single `ApiOperation` with `serviceName`
                          field set to `*` will allow all methods AND permissions for all services.
                      - name: 'methodSelectors'
                        type: Array
                        description: |
                          API methods or permissions to allow. Method or permission must belong to
                          the service specified by serviceName field. A single `MethodSelector` entry
                          with `*` specified for the method field will allow all methods AND
                          permissions for the service specified in `serviceName`.
                        item_type:
                          type: NestedObject
                          properties:
                            - name: 'method'
                              type: String
                              description: |
                                Value for method should be a valid method name for the corresponding
                                serviceName in `ApiOperation`. If `*` used as value for `method`, then
                                ALL methods and permissions are allowed.
                            - name: 'permission'
                              type: String
                              description: |
                                Value for permission should be a valid Cloud IAM permission for the
                                corresponding `serviceName` in `ApiOperation`.
            - name: 'title'
              type: 'string'
              description: |
                Human readable title. Must be unique within the perimeter. Does not affect behavior.
      - name: 'egressPolicies'
        type: Array
        description: |
          List of EgressPolicies to apply to the perimeter. A perimeter may
          have multiple EgressPolicies, each of which is evaluated separately.
          Access is granted if any EgressPolicy grants it. Must be empty for
          a perimeter bridge.
        item_type:
          type: NestedObject
          properties:
            - name: 'egressFrom'
              type: NestedObject
              description: |
                Defines conditions on the source of a request causing this `EgressPolicy` to apply.
              properties:
                - name: 'identityType'
                  type: Enum
                  description: |
                    Specifies the type of identities that are allowed access to outside the
                    perimeter. If left unspecified, then members of `identities` field will
                    be allowed access.
                  enum_values:
                    - 'IDENTITY_TYPE_UNSPECIFIED'
                    - 'ANY_IDENTITY'
                    - 'ANY_USER_ACCOUNT'
                    - 'ANY_SERVICE_ACCOUNT'
                  diff_suppress_func: AccessContextManagerServicePerimeterIdentityTypeDiffSuppressFunc
                - name: 'sources'
                  type: Array
                  description: 'Sources that this EgressPolicy authorizes access from.'
                  item_type:
                    type: NestedObject
                    properties:
                      - name: 'accessLevel'
                        type: String
                        description: 'An AccessLevel resource name that allows resources outside the ServicePerimeter to be accessed from the inside.'
                      - name: 'resource'
                        type: String
                        description: |
                          A Google Cloud resource that is allowed to egress the perimeter.
                          Requests from these resources are allowed to access data outside the perimeter.
                          Currently only projects are allowed. Project format: `projects/{project_number}`.
                          The resource may be in any Google Cloud organization, not just the
                          organization that the perimeter is defined in. `*` is not allowed, the
                          case of allowing all Google Cloud resources only is not supported.
                - name: 'sourceRestriction'
                  type: Enum
                  description: 'Whether to enforce traffic restrictions based on `sources` field. If the `sources` field is non-empty, then this field must be set to `SOURCE_RESTRICTION_ENABLED`.'
                  enum_values:
                    - 'SOURCE_RESTRICTION_UNSPECIFIED'
                    - 'SOURCE_RESTRICTION_ENABLED'
                    - 'SOURCE_RESTRICTION_DISABLED'
                - name: 'identities'
                  type: Array
                  description: |
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



mmv1/products/accesscontextmanager/ServicePerimeter.yaml [641:765]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                          The project may be in any Google Cloud organization, not just the
                          organization that the perimeter is defined in. `*` is not allowed, the case
                          of allowing all Google Cloud resources only is not supported.
            - name: 'ingressTo'
              type: NestedObject
              description: |
                Defines the conditions on the `ApiOperation` and request destination that cause
                this `IngressPolicy` to apply.
              properties:
                - name: 'resources'
                  type: Array
                  description: |
                    A list of resources, currently only projects in the form
                    `projects/<projectnumber>`, protected by this `ServicePerimeter`
                    that are allowed to be accessed by sources defined in the
                    corresponding `IngressFrom`. A request matches if it contains
                    a resource in this list. If `*` is specified for resources,
                    then this `IngressTo` rule will authorize access to all
                    resources inside the perimeter, provided that the request
                    also matches the `operations` field.
                  is_set: true
                  item_type:
                    type: String
                - name: 'roles'
                  type: Array
                  item_type:
                    type: String
                  description: |
                    A list of IAM roles that represent the set of operations that the sources
                    specified in the corresponding `IngressFrom`
                    are allowed to perform.
                - name: 'operations'
                  type: Array
                  description: |
                    A list of `ApiOperations` the sources specified in corresponding `IngressFrom`
                    are allowed to perform in this `ServicePerimeter`.
                  item_type:
                    type: NestedObject
                    properties:
                      - name: 'serviceName'
                        type: String
                        description: |
                          The name of the API whose methods or permissions the `IngressPolicy` or
                          `EgressPolicy` want to allow. A single `ApiOperation` with `serviceName`
                          field set to `*` will allow all methods AND permissions for all services.
                      - name: 'methodSelectors'
                        type: Array
                        description: |
                          API methods or permissions to allow. Method or permission must belong to
                          the service specified by serviceName field. A single `MethodSelector` entry
                          with `*` specified for the method field will allow all methods AND
                          permissions for the service specified in `serviceName`.
                        item_type:
                          type: NestedObject
                          properties:
                            - name: 'method'
                              type: String
                              description: |
                                Value for method should be a valid method name for the corresponding
                                serviceName in `ApiOperation`. If `*` used as value for `method`, then
                                ALL methods and permissions are allowed.
                            - name: 'permission'
                              type: String
                              description: |
                                Value for permission should be a valid Cloud IAM permission for the
                                corresponding `serviceName` in `ApiOperation`.
            - name: 'title'
              type: 'string'
              description: |
                Human readable title. Must be unique within the perimeter. Does not affect behavior.
      - name: 'egressPolicies'
        type: Array
        description: |
          List of EgressPolicies to apply to the perimeter. A perimeter may
          have multiple EgressPolicies, each of which is evaluated separately.
          Access is granted if any EgressPolicy grants it. Must be empty for
          a perimeter bridge.
        item_type:
          type: NestedObject
          properties:
            - name: 'egressFrom'
              type: NestedObject
              description: |
                Defines conditions on the source of a request causing this `EgressPolicy` to apply.
              properties:
                - name: 'identityType'
                  type: Enum
                  description: |
                    Specifies the type of identities that are allowed access to outside the
                    perimeter. If left unspecified, then members of `identities` field will
                    be allowed access.
                  enum_values:
                    - 'IDENTITY_TYPE_UNSPECIFIED'
                    - 'ANY_IDENTITY'
                    - 'ANY_USER_ACCOUNT'
                    - 'ANY_SERVICE_ACCOUNT'
                  diff_suppress_func: AccessContextManagerServicePerimeterIdentityTypeDiffSuppressFunc
                - name: 'sources'
                  type: Array
                  description: 'Sources that this EgressPolicy authorizes access from.'
                  item_type:
                    type: NestedObject
                    properties:
                      - name: 'accessLevel'
                        type: String
                        description: 'An AccessLevel resource name that allows resources outside the ServicePerimeter to be accessed from the inside.'
                      - name: 'resource'
                        type: String
                        description: |
                          A Google Cloud resource that is allowed to egress the perimeter.
                          Requests from these resources are allowed to access data outside the perimeter.
                          Currently only projects are allowed. Project format: `projects/{project_number}`.
                          The resource may be in any Google Cloud organization, not just the
                          organization that the perimeter is defined in. `*` is not allowed, the
                          case of allowing all Google Cloud resources only is not supported.
                - name: 'sourceRestriction'
                  type: Enum
                  description: 'Whether to enforce traffic restrictions based on `sources` field. If the `sources` field is non-empty, then this field must be set to `SOURCE_RESTRICTION_ENABLED`.'
                  enum_values:
                    - 'SOURCE_RESTRICTION_UNSPECIFIED'
                    - 'SOURCE_RESTRICTION_ENABLED'
                    - 'SOURCE_RESTRICTION_DISABLED'
                - name: 'identities'
                  type: Array
                  description: |
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



