tls_inspection_policies

Creates, updates, deletes, gets or lists a tls_inspection_policies resource.

Overview

Name	tls_inspection_policies
Type	Resource
Id	google.networksecurity.tls_inspection_policies

Fields

Name	Datatype	Description
name	string	Required. Name of the resource. Name is of the form projects/{project}/locations/{location}/tlsInspectionPolicies/{tls_inspection_policy} tls_inspection_policy should match the pattern:(^a-z?$).
description	string	Optional. Free-text description of the resource.
caPool	string	Required. A CA pool resource used to issue interception certificates. The CA pool string has a relative resource path following the form "projects/{project}/locations/{location}/caPools/{ca_pool}".
createTime	string	Output only. The timestamp when the resource was created.
customTlsFeatures	array	Optional. List of custom TLS cipher suites selected. This field is valid only if the selected tls_feature_profile is CUSTOM. The compute.SslPoliciesService.ListAvailableFeatures method returns the set of features that can be specified in this list. Note that Secure Web Proxy does not yet honor this field.
excludePublicCaSet	boolean	Optional. If FALSE (the default), use our default set of public CAs in addition to any CAs specified in trust_config. These public CAs are currently based on the Mozilla Root Program and are subject to change over time. If TRUE, do not accept our default set of public CAs. Only CAs specified in trust_config will be accepted. This defaults to FALSE (use public CAs in addition to trust_config) for backwards compatibility, but trusting public root CAs is not recommended unless the traffic in question is outbound to public web servers. When possible, prefer setting this to "false" and explicitly specifying trusted CAs and certificates in a TrustConfig. Note that Secure Web Proxy does not yet honor this field.
minTlsVersion	string	Optional. Minimum TLS version that the firewall should use when negotiating connections with both clients and servers. If this is not set, then the default value is to allow the broadest set of clients and servers (TLS 1.0 or higher). Setting this to more restrictive values may improve security, but may also prevent the firewall from connecting to some clients or servers. Note that Secure Web Proxy does not yet honor this field.
tlsFeatureProfile	string	Optional. The selected Profile. If this is not set, then the default value is to allow the broadest set of clients and servers ("PROFILE_COMPATIBLE"). Setting this to more restrictive values may improve security, but may also prevent the TLS inspection proxy from connecting to some clients or servers. Note that Secure Web Proxy does not yet honor this field.
trustConfig	string	Optional. A TrustConfig resource used when making a connection to the TLS server. This is a relative resource path following the form "projects/{project}/locations/{location}/trustConfigs/{trust_config}". This is necessary to intercept TLS connections to servers with certificates signed by a private CA or self-signed certificates. Note that Secure Web Proxy does not yet honor this field.
updateTime	string	Output only. The timestamp when the resource was updated.

Methods

Name	Accessible by	Required Params	Description
projects_locations_tls_inspection_policies_get	SELECT	locationsId, projectsId, tlsInspectionPoliciesId	Gets details of a single TlsInspectionPolicy.
projects_locations_tls_inspection_policies_list	SELECT	locationsId, projectsId	Lists TlsInspectionPolicies in a given project and location.
projects_locations_tls_inspection_policies_create	INSERT	locationsId, projectsId	Creates a new TlsInspectionPolicy in a given project and location.
projects_locations_tls_inspection_policies_delete	DELETE	locationsId, projectsId, tlsInspectionPoliciesId	Deletes a single TlsInspectionPolicy.
projects_locations_tls_inspection_policies_patch	UPDATE	locationsId, projectsId, tlsInspectionPoliciesId	Updates the parameters of a single TlsInspectionPolicy.

SELECT examples

Lists TlsInspectionPolicies in a given project and location.

SELECT
name,
description,
caPool,
createTime,
customTlsFeatures,
excludePublicCaSet,
minTlsVersion,
tlsFeatureProfile,
trustConfig,
updateTime
FROM google.networksecurity.tls_inspection_policies
WHERE locationsId = '{{ locationsId }}'
AND projectsId = '{{ projectsId }}';

INSERT example

Use the following StackQL query and manifest file to create a new tls_inspection_policies resource.

All Properties

/*+ create */
INSERT INTO google.networksecurity.tls_inspection_policies (
locationsId,
projectsId,
name,
description,
caPool,
trustConfig,
excludePublicCaSet,
minTlsVersion,
tlsFeatureProfile,
customTlsFeatures
)
SELECT 
'{{ locationsId }}',
'{{ projectsId }}',
'{{ name }}',
'{{ description }}',
'{{ caPool }}',
'{{ trustConfig }}',
{{ excludePublicCaSet }},
'{{ minTlsVersion }}',
'{{ tlsFeatureProfile }}',
'{{ customTlsFeatures }}'
;

Manifest

- name: your_resource_model_name
  props:
    - name: name
      value: string
    - name: description
      value: string
    - name: createTime
      value: string
    - name: updateTime
      value: string
    - name: caPool
      value: string
    - name: trustConfig
      value: string
    - name: excludePublicCaSet
      value: boolean
    - name: minTlsVersion
      value: string
    - name: tlsFeatureProfile
      value: string
    - name: customTlsFeatures
      value:
        - string

UPDATE example

Updates a tls_inspection_policies resource.

/*+ update */
UPDATE google.networksecurity.tls_inspection_policies
SET 
name = '{{ name }}',
description = '{{ description }}',
caPool = '{{ caPool }}',
trustConfig = '{{ trustConfig }}',
excludePublicCaSet = true|false,
minTlsVersion = '{{ minTlsVersion }}',
tlsFeatureProfile = '{{ tlsFeatureProfile }}',
customTlsFeatures = '{{ customTlsFeatures }}'
WHERE 
locationsId = '{{ locationsId }}'
AND projectsId = '{{ projectsId }}'
AND tlsInspectionPoliciesId = '{{ tlsInspectionPoliciesId }}';

DELETE example

Deletes the specified tls_inspection_policies resource.

/*+ delete */
DELETE FROM google.networksecurity.tls_inspection_policies
WHERE locationsId = '{{ locationsId }}'
AND projectsId = '{{ projectsId }}'
AND tlsInspectionPoliciesId = '{{ tlsInspectionPoliciesId }}';