mmv1/products/accesscontextmanager/ServicePerimeterEgressPolicy.yaml

# Copyright 2024 Google Inc.
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

---
name: 'ServicePerimeterEgressPolicy'
api_resource_type_kind: ServicePerimeter
description: |
  Manage a single EgressPolicy in the status (enforced) configuration for a service perimeter.
  EgressPolicies match requests based on egressFrom and egressTo stanzas.
  For an EgressPolicy to match, both egressFrom and egressTo stanzas must be matched.
  If an EgressPolicy matches a request, the request is allowed to span the ServicePerimeter
  boundary. For example, an EgressPolicy can be used to allow VMs on networks
  within the ServicePerimeter to access a defined set of projects outside the
  perimeter in certain contexts (e.g. to read data from a Cloud Storage bucket
  or query against a BigQuery dataset).

  ~> **Note:** By default, updates to this resource will remove the EgressPolicy from the
  from the perimeter and add it back in a non-atomic manner. To ensure that the new EgressPolicy
  is added before the old one is removed, add a `lifecycle` block with `create_before_destroy = true` to this resource.
  ~> **Note:** If this resource is used alongside a `google_access_context_manager_service_perimeter` resource,
  the service perimeter resource must have a `lifecycle` block with `ignore_changes = [status[0].egress_policies]` so
  they don't fight over which egress rules should be in the policy.
references:
  guides:
    'Guide to Ingress and Egress Rules': 'https://cloud.google.com/vpc-service-controls/docs/ingress-egress-rules'
  api: 'https://cloud.google.com/access-context-manager/docs/reference/rest/v1/accessPolicies.servicePerimeters#egresspolicy'
docs:
id_format: '{{perimeter}}'
base_url: ''
self_link: '{{perimeter}}'
create_url: '{{perimeter}}'
create_verb: 'PATCH'
update_mask: true
delete_verb: 'PATCH'
immutable: true
mutex: '{{access_policy_id}}'
import_format:
  - '{{perimeter}}'
exclude_import: true
timeouts:
  insert_minutes: 20
  update_minutes: 20
  delete_minutes: 20
autogen_async: true
async:
  actions: ['create', 'delete', 'update']
  type: 'OpAsync'
  operation:
    base_url: '{{op_id}}'
  result:
    resource_inside_response: true
identity:
  - egressFrom
  - egressTo
  - title
nested_query:
  keys:
    - status
    - egressPolicies
  is_list_of_ids: false
  modify_by_patch: true
custom_code:
  constants: 'templates/terraform/constants/access_context_manager.go.tmpl'
  custom_import: 'templates/terraform/custom_import/access_context_manager_service_perimeter_egress_policy.go.tmpl'
  encoder: 'templates/terraform/encoders/access_context_manager_service_perimeter_egress_policy.go.tmpl'
  post_read: 'templates/terraform/post_read/access_context_manager_service_perimeter_resource.go.tmpl'
  pre_create: 'templates/terraform/pre_create/access_context_manager_service_perimeter_egress_policy.go.tmpl'
  pre_delete: 'templates/terraform/pre_delete/access_context_manager_service_perimeter_egress_policy.go.tmpl'
exclude_tgc: true
# Skipping the sweeper due to the non-standard base_url and because this is fine-grained under ServicePerimeter
exclude_sweeper: true
examples:
  - name: 'access_context_manager_service_perimeter_egress_policy'
    vars:
      egress_policy_title: 'egress policy title'
    exclude_test: true
  - name: 'access_context_manager_service_perimeter_egress_policy_granular_controls'
    vars:
      egress_policy_title: 'granular controls egress policy title'
    exclude_test: true
parameters:
  - name: 'perimeter'
    type: ResourceRef
    description: |
      The name of the Service Perimeter to add this resource to.
    url_param_only: true
    required: true
    resource: 'ServicePerimeter'
    imports: 'name'
properties:
  - name: 'egressFrom'
    type: NestedObject
    description: |
      Defines conditions on the source of a request causing this `EgressPolicy` to apply.
    properties:
      - name: 'identityType'
        type: Enum
        description: |
          Specifies the type of identities that are allowed access to outside the
          perimeter. If left unspecified, then members of `identities` field will
          be allowed access.
        enum_values:
          - 'ANY_IDENTITY'
          - 'ANY_USER_ACCOUNT'
          - 'ANY_SERVICE_ACCOUNT'
        diff_suppress_func: AccessContextManagerServicePerimeterIdentityTypeDiffSuppressFunc
      - name: 'identities'
        type: Array
        description: |
          Identities can be an individual user, service account, Google group,
          or third-party identity. For third-party identity, only single identities
          are supported and other identity types are not supported.The v1 identities
          that have the prefix user, group and serviceAccount in
          https://cloud.google.com/iam/docs/principal-identifiers#v1 are supported.
        item_type:
          type: String
        diff_suppress_func: AccessContextManagerServicePerimeterEgressPolicyEgressFromIdentitiesDiffSuppressFunc
        custom_flatten: templates/terraform/custom_flatten/accesscontextmanager_egress_policy_from_identities_custom_flatten.go.tmpl
      - name: 'sources'
        type: Array
        description: 'Sources that this EgressPolicy authorizes access from.'
        item_type:
          type: NestedObject
          properties:
            - name: 'accessLevel'
              type: String
              description: 'An AccessLevel resource name that allows resources outside the ServicePerimeter to be accessed from the inside.'
            - name: 'resource'
              type: String
              description: |
                A Google Cloud resource that is allowed to egress the perimeter.
                Requests from these resources are allowed to access data outside the perimeter.
                Currently only projects are allowed. Project format: `projects/{project_number}`.
                The resource may be in any Google Cloud organization, not just the
                organization that the perimeter is defined in. `*` is not allowed, the
                case of allowing all Google Cloud resources only is not supported.
      - name: 'sourceRestriction'
        type: Enum
        description: 'Whether to enforce traffic restrictions based on `sources` field. If the `sources` field is non-empty, then this field must be set to `SOURCE_RESTRICTION_ENABLED`.'
        enum_values:
          - 'SOURCE_RESTRICTION_UNSPECIFIED'
          - 'SOURCE_RESTRICTION_ENABLED'
          - 'SOURCE_RESTRICTION_DISABLED'
  - name: 'egressTo'
    type: NestedObject
    description: |
      Defines the conditions on the `ApiOperation` and destination resources that
      cause this `EgressPolicy` to apply.
    properties:
      - name: 'resources'
        type: Array
        description: |
          A list of resources, currently only projects in the form
          `projects/<projectnumber>`, that match this to stanza. A request matches
          if it contains a resource in this list. If * is specified for resources,
          then this `EgressTo` rule will authorize access to all resources outside
          the perimeter.
        custom_flatten: templates/terraform/custom_flatten/accesscontextmanager_egress_policy_resources_custom_flatten.go.tmpl
        diff_suppress_func: AccessContextManagerServicePerimeterEgressPolicyEgressToResourcesDiffSuppressFunc
        item_type:
          type: String
      - name: 'externalResources'
        type: Array
        description: |
          A list of external resources that are allowed to be accessed. A request
          matches if it contains an external resource in this list (Example:
          s3://bucket/path). Currently '*' is not allowed.
        item_type:
          type: String
      - name: 'roles'
        type: Array
        item_type:
          type: String
        description: |
          A list of IAM roles that represent the set of operations that the sources
          specified in the corresponding `EgressFrom`
          are allowed to perform.
      - name: 'operations'
        type: Array
        description: |
          A list of `ApiOperations` that this egress rule applies to. A request matches
          if it contains an operation/service in this list.
        item_type:
          type: NestedObject
          properties:
            - name: 'serviceName'
              type: String
              description: |
                The name of the API whose methods or permissions the `IngressPolicy` or
                `EgressPolicy` want to allow. A single `ApiOperation` with serviceName
                field set to `*` will allow all methods AND permissions for all services.
            - name: 'methodSelectors'
              type: Array
              description: |
                API methods or permissions to allow. Method or permission must belong
                to the service specified by `serviceName` field. A single MethodSelector
                entry with `*` specified for the `method` field will allow all methods
                AND permissions for the service specified in `serviceName`.
              item_type:
                type: NestedObject
                properties:
                  - name: 'method'
                    type: String
                    description: |
                      Value for `method` should be a valid method name for the corresponding
                      `serviceName` in `ApiOperation`. If `*` used as value for method,
                      then ALL methods and permissions are allowed.
                  - name: 'permission'
                    type: String
                    description: |
                      Value for permission should be a valid Cloud IAM permission for the
                      corresponding `serviceName` in `ApiOperation`.
  - name: 'title'
    type: 'string'
    description: |
      Human readable title. Must be unique within the perimeter. Does not affect behavior.
  - name: 'accessPolicyId'
    type: String
    description: |
      The name of the Access Policy this resource belongs to.
    ignore_read: true
    output: true
  - name: 'etag'
    type: String
    output: true
    description: |
      The perimeter etag is internally used to prevent overwriting the list of policies on PATCH calls. It is retrieved from the same GET perimeter API call that's used to get the current list of policies. The policy defined in this resource is added or removed from that list, and then this etag is sent with the PATCH call along with the updated policies.