solutions/client-landing-zone/client-folder/standard/applications-infrastructure/nonp/firewall-policy/rules/iap.yaml

# Copyright 2020 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#########
# Delegate to host project, ingress IAP traffic (firewall) from IP range 35.235.240.0/20 to VPC resources in shared VPC network
# AC-3(9), AC-4, AC-4(21), SC-7(5), SC-7(8), SC-7(9), SC-7(11) - All connections to or from virtual machine instances are allowed/denied via firewall rules configured in shared VPC network within host project or firewall policies in parent folders based on least-privilege principle. Each firewall rule applies to incoming(ingress) or outgoing(egress) connections, not both.
apiVersion: compute.cnrm.cloud.google.com/v1beta1
kind: ComputeFirewallPolicyRule
metadata:
  name: client-name-standard-app-infra-nonp-fwpol-goto-next-for-iap-fwr # kpt-set: ${client-name}-standard-app-infra-nonp-fwpol-goto-next-for-iap-fwr
  namespace: client-name-networking # kpt-set: ${client-name}-networking
  annotations:
    config.kubernetes.io/depends-on: compute.cnrm.cloud.google.com/namespaces/client-name-networking/ComputeFirewallPolicy/client-name-standard-app-infra-nonp-fwpol # kpt-set: compute.cnrm.cloud.google.com/namespaces/${client-name}-networking/ComputeFirewallPolicy/${client-name}-standard-app-infra-nonp-fwpol
spec:
  action: "goto_next"
  description: "Delegate to host project, ingress IAP traffic (firewall) from IP range 35.235.240.0/20 to VPC resources in shared VPC network"
  direction: "INGRESS"
  disabled: false
  # logging not supported for goto_next rules
  enableLogging: false
  # AC-3(9), AC-4, AC-4(21), SC-7(5), SC-7(8), SC-7(9), SC-7(11)
  firewallPolicyRef:
    name: client-name-standard-app-infra-nonp-fwpol # kpt-set: ${client-name}-standard-app-infra-nonp-fwpol
  match:
    layer4Configs:
      - ipProtocol: "all"
    srcIPRanges:
      - "35.235.240.0/20"
  priority: 1000000