region_network_firewall_policies_rule

Creates, updates, deletes, gets or lists a region_network_firewall_policies_rule resource.

Overview

Name	region_network_firewall_policies_rule
Type	Resource
Id	google.compute.region_network_firewall_policies_rule

Fields

Name	Datatype	Description
description	string	An optional description for this resource.
action	string	The Action to perform when the client connection triggers the rule. Valid actions for firewall rules are: "allow", "deny", "apply_security_profile_group" and "goto_next". Valid actions for packet mirroring rules are: "mirror", "do_not_mirror" and "goto_next".
direction	string	The direction in which this rule applies.
disabled	boolean	Denotes whether the firewall policy rule is disabled. When set to true, the firewall policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the firewall policy rule will be enabled.
enableLogging	boolean	Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
kind	string	[Output only] Type of the resource. Returns compute#firewallPolicyRule for firewall rules and compute#packetMirroringRule for packet mirroring rules.
match	object	Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified.
priority	integer	An integer indicating the priority of a rule in the list. The priority must be a positive value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
ruleName	string	An optional name for the rule. This field is not a unique identifier and can be updated.
ruleTupleCount	integer	[Output Only] Calculation of the complexity of a single firewall policy rule.
securityProfileGroup	string	A fully-qualified URL of a SecurityProfile resource instance. Example: https://networksecurity.googleapis.com/v1/projects/{project}/locations/{location}/securityProfileGroups/my-security-profile-group Must be specified if action is one of 'apply_security_profile_group' or 'mirror'. Cannot be specified for other actions.
targetResources	array	A list of network resource URLs to which this rule applies. This field allows you to control which network's VMs get this rule. If this field is left blank, all VMs within the organization will receive the rule.
targetSecureTags	array	A list of secure tags that controls which instances the firewall rule applies to. If targetSecureTag are specified, then the firewall rule applies only to instances in the VPC network that have one of those EFFECTIVE secure tags, if all the target_secure_tag are in INEFFECTIVE state, then this rule will be ignored. targetSecureTag may not be set at the same time as targetServiceAccounts. If neither targetServiceAccounts nor targetSecureTag are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label tags allowed is 256.
targetServiceAccounts	array	A list of service accounts indicating the sets of instances that are applied with this rule.
tlsInspect	boolean	Boolean flag indicating if the traffic should be TLS decrypted. Can be set only if action = 'apply_security_profile_group' and cannot be set for other actions.

Methods

Name	Accessible by	Required Params	Description
get_rule	SELECT	firewallPolicy, project, region	Gets a rule of the specified priority.
add_rule	INSERT	firewallPolicy, project, region	Inserts a rule into a network firewall policy.
remove_rule	DELETE	firewallPolicy, project, region	Deletes a rule of the specified priority.

SELECT examples

Gets a rule of the specified priority.

SELECT
description,
action,
direction,
disabled,
enableLogging,
kind,
match,
priority,
ruleName,
ruleTupleCount,
securityProfileGroup,
targetResources,
targetSecureTags,
targetServiceAccounts,
tlsInspect
FROM google.compute.region_network_firewall_policies_rule
WHERE firewallPolicy = '{{ firewallPolicy }}'
AND project = '{{ project }}'
AND region = '{{ region }}';

INSERT example

Use the following StackQL query and manifest file to create a new region_network_firewall_policies_rule resource.

All Properties

/*+ create */
INSERT INTO google.compute.region_network_firewall_policies_rule (
firewallPolicy,
project,
region,
ruleName,
description,
priority,
match,
action,
securityProfileGroup,
tlsInspect,
direction,
targetResources,
enableLogging,
ruleTupleCount,
targetServiceAccounts,
targetSecureTags,
disabled
)
SELECT 
'{{ firewallPolicy }}',
'{{ project }}',
'{{ region }}',
'{{ ruleName }}',
'{{ description }}',
'{{ priority }}',
'{{ match }}',
'{{ action }}',
'{{ securityProfileGroup }}',
{{ tlsInspect }},
'{{ direction }}',
'{{ targetResources }}',
{{ enableLogging }},
'{{ ruleTupleCount }}',
'{{ targetServiceAccounts }}',
'{{ targetSecureTags }}',
{{ disabled }}
;

Manifest

- name: your_resource_model_name
  props:
    - name: kind
      value: string
    - name: ruleName
      value: string
    - name: description
      value: string
    - name: priority
      value: integer
    - name: match
      value:
        - name: srcIpRanges
          value:
            - string
        - name: destIpRanges
          value:
            - string
        - name: layer4Configs
          value:
            - - name: ipProtocol
                value: string
              - name: ports
                value:
                  - string
        - name: srcSecureTags
          value:
            - - name: name
                value: string
              - name: state
                value: string
        - name: destAddressGroups
          value:
            - string
        - name: srcAddressGroups
          value:
            - string
        - name: srcFqdns
          value:
            - string
        - name: destFqdns
          value:
            - string
        - name: srcRegionCodes
          value:
            - string
        - name: destRegionCodes
          value:
            - string
        - name: destThreatIntelligences
          value:
            - string
        - name: srcThreatIntelligences
          value:
            - string
    - name: action
      value: string
    - name: securityProfileGroup
      value: string
    - name: tlsInspect
      value: boolean
    - name: direction
      value: string
    - name: targetResources
      value:
        - string
    - name: enableLogging
      value: boolean
    - name: ruleTupleCount
      value: integer
    - name: targetServiceAccounts
      value:
        - string
    - name: targetSecureTags
      value:
        - - name: name
            value: string
          - name: state
            value: string
    - name: disabled
      value: boolean

DELETE example

Deletes the specified region_network_firewall_policies_rule resource.

/*+ delete */
DELETE FROM google.compute.region_network_firewall_policies_rule
WHERE firewallPolicy = '{{ firewallPolicy }}'
AND project = '{{ project }}'
AND region = '{{ region }}';