mmv1/products/accesscontextmanager/AccessLevelCondition.yaml

# Copyright 2024 Google Inc.
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

---
name: 'AccessLevelCondition'
api_resource_type_kind: AccessLevel
description: |
  Allows configuring a single access level condition to be appended to an access level's conditions.
  This resource is intended to be used in cases where it is not possible to compile a full list
  of conditions to include in a `google_access_context_manager_access_level` resource,
  to enable them to be added separately.

  ~> **Note:** If this resource is used alongside a `google_access_context_manager_access_level` resource,
  the access level resource must have a `lifecycle` block with `ignore_changes = [basic[0].conditions]` so
  they don't fight over which service accounts should be included.
references:
  guides:
    'Access Policy Quickstart': 'https://cloud.google.com/access-context-manager/docs/quickstart'
  api: 'https://cloud.google.com/access-context-manager/docs/reference/rest/v1/accessPolicies.accessLevels'
docs:
  warning: |
    If you are using User ADCs (Application Default Credentials) with this resource,
    you must specify a `billing_project` and set `user_project_override` to true
    in the provider configuration. Otherwise the ACM API will return a 403 error.
    Your account must have the `serviceusage.services.use` permission on the
    `billing_project` you defined.
id_format: '{{access_level}}'
base_url: ''
self_link: '{{access_level}}'
# This is an unusual API, so we need to use a few fields to map the methods
# to the right URL.
# create_url is the Create URL
# base_url is the Get and Delete and Patch URL. It is empty on purpose.
# List won't work yet. It should share a URL with Create.
create_url: '{{access_level}}'
create_verb: 'PATCH'
update_mask: true
delete_verb: 'PATCH'
immutable: true
mutex: '{{access_policy_id}}'
import_format:
  - '{{access_level}}'
 # no unique way to specify
exclude_import: true
timeouts:
  insert_minutes: 20
  update_minutes: 20
  delete_minutes: 20
autogen_async: true
async:
  type: 'PollAsync'
  check_response_func_existence: 'transport_tpg.PollCheckForExistence'
  check_response_func_absence: 'transport_tpg.PollCheckForAbsence'
  suppress_error: false
  target_occurrences: 1
  actions: ['create']
identity:
  - ipSubnetworks
  - requiredAccessLevels
  - members
  - negate
  - devicePolicy
  - regions
nested_query:
  keys:
    - basic
    - conditions
  is_list_of_ids: false
  modify_by_patch: true
custom_code:
  encoder: 'templates/terraform/encoders/access_context_manager_access_level_condition.go.tmpl'
exclude_tgc: true
# Skipping the sweeper due to the non-standard base_url and because this is fine-grained under AccessLevel
exclude_sweeper: true
examples:
  - name: 'access_context_manager_access_level_condition_basic'
    primary_resource_id: 'access-level-condition'
    vars:
      access_level_name: 'chromeos_no_lock'
      account_id: 'my-account-id'
    exclude_test: true
parameters:
  - name: 'accessLevel'
    type: ResourceRef
    description: |
      The name of the Access Level to add this condition to.
    url_param_only: true
    required: true
    immutable: true
    resource: 'AccessLevel'
    imports: 'name'
properties:
  - name: 'ipSubnetworks'
    type: Array
    description: |
      A list of CIDR block IP subnetwork specification. May be IPv4
      or IPv6.
      Note that for a CIDR IP address block, the specified IP address
      portion must be properly truncated (i.e. all the host bits must
      be zero) or the input is considered malformed. For example,
      "192.0.2.0/24" is accepted but "192.0.2.1/24" is not. Similarly,
      for IPv6, "2001:db8::/32" is accepted whereas "2001:db8::1/32"
      is not. The originating IP of a request must be in one of the
      listed subnets in order for this Condition to be true.
      If empty, all IP addresses are allowed.
    item_type:
      type: String
  - name: 'requiredAccessLevels'
    type: Array
    description: |
      A list of other access levels defined in the same Policy,
      referenced by resource name. Referencing an AccessLevel which
      does not exist is an error. All access levels listed must be
      granted for the Condition to be true.
      Format: accessPolicies/{policy_id}/accessLevels/{short_name}
    item_type:
      type: String
  - name: 'members'
    type: Array
    description: |
      An allowed list of members (users, service accounts).
      Using groups is not supported yet.

      The signed-in user originating the request must be a part of one
      of the provided members. If not specified, a request may come
      from any user (logged in/not logged in, not present in any
      groups, etc.).
      Formats: `user:{emailid}`, `serviceAccount:{emailid}`
    item_type:
      type: String
  - name: 'negate'
    type: Boolean
    description: |
      Whether to negate the Condition. If true, the Condition becomes
      a NAND over its non-empty fields, each field must be false for
      the Condition overall to be satisfied. Defaults to false.
  - name: 'devicePolicy'
    type: NestedObject
    description: |
      Device specific restrictions, all restrictions must hold for
      the Condition to be true. If not specified, all devices are
      allowed.
    properties:
      - name: 'requireScreenLock'
        type: Boolean
        description: |
          Whether or not screenlock is required for the DevicePolicy
          to be true. Defaults to false.
        api_name: requireScreenlock
      - name: 'allowedEncryptionStatuses'
        type: Array
        description: |
          A list of allowed encryptions statuses.
          An empty list allows all statuses.
        item_type:
          type: Enum
          description: |
            This field only has a name and description because of MM
            limitations. It should not appear in downstreams.
          enum_values:
            - 'ENCRYPTION_UNSPECIFIED'
            - 'ENCRYPTION_UNSUPPORTED'
            - 'UNENCRYPTED'
            - 'ENCRYPTED'
      - name: 'allowedDeviceManagementLevels'
        type: Array
        description: |
          A list of allowed device management levels.
          An empty list allows all management levels.
        item_type:
          type: Enum
          description: |
            This field only has a name and description because of MM
            limitations. It should not appear in downstreams.
          enum_values:
            - 'MANAGEMENT_UNSPECIFIED'
            - 'NONE'
            - 'BASIC'
            - 'COMPLETE'
      - name: 'osConstraints'
        type: Array
        description: |
          A list of allowed OS versions.
          An empty list allows all types and all versions.
        item_type:
          type: NestedObject
          properties:
            - name: 'minimumVersion'
              type: String
              description: |
                The minimum allowed OS version. If not set, any version
                of this OS satisfies the constraint.
                Format: "major.minor.patch" such as "10.5.301", "9.2.1".
            - name: 'osType'
              type: Enum
              description: |
                The operating system type of the device.
              required: true
              enum_values:
                - 'OS_UNSPECIFIED'
                - 'DESKTOP_MAC'
                - 'DESKTOP_WINDOWS'
                - 'DESKTOP_LINUX'
                - 'DESKTOP_CHROME_OS'
                - 'ANDROID'
                - 'IOS'
      - name: 'requireAdminApproval'
        type: Boolean
        description: |
          Whether the device needs to be approved by the customer admin.
      - name: 'requireCorpOwned'
        type: Boolean
        description: |
          Whether the device needs to be corp owned.
  - name: 'regions'
    type: Array
    description: |
      The request must originate from one of the provided
      countries/regions.
      Format: A valid ISO 3166-1 alpha-2 code.
    item_type:
      type: String
  - name: 'vpcNetworkSources'
    type: Array
    description: 'The request must originate from one of the provided VPC networks in Google Cloud. Cannot specify this field together with `ip_subnetworks`.'
    item_type:
      type: NestedObject
      properties:
        - name: 'vpcSubnetwork'
          type: NestedObject
          description: 'Sub networks within a VPC network.'
          properties:
            - name: 'network'
              type: String
              description: 'Required. Network name to be allowed by this Access Level. Networks of foreign organizations requires `compute.network.get` permission to be granted to caller.'
              required: true
            - name: 'vpcIpSubnetworks'
              type: Array
              description: 'CIDR block IP subnetwork specification. Must be IPv4.'
              item_type:
                type: String
  - name: 'accessPolicyId'
    type: String
    description: |
      The name of the Access Policy this resource belongs to.
    ignore_read: true
    output: true