Le modifiche alle risorse vengono applicate solo se tutte le parti dell'operazione collettiva si completano correttamente. Ad esempio, se l'operazione collettiva tenta di rimuovere un livello di accesso in uso da un perimetro di servizio, viene generato un errore. Poiché viene rilevato un errore, l'intera operazione non va a buon fine e nessuna risorsa viene aggiornata.
Poiché le operazioni collettive interessano tutti i livelli di accesso della tua organizzazione, ti consigliamo di ottenere un elenco completo dei livelli di accesso. L'elenco può essere formattato come YAML, il che può anche semplificare le modifiche collettive ai livelli di accesso.
Per ulteriori esempi della struttura YAML delle condizioni, consulta il file YAML di esempio.
ETAG (facoltativo) è una stringa che rappresenta la versione di destinazione del criterio di accesso della tua organizzazione. Se non includi un tag, l'operazione collettiva ha come target la versione più recente del criterio di accesso della tua organizzazione.
POLICY_NAME è il nome del criterio di accesso della tua organizzazione.
Questo valore è obbligatorio solo se non hai impostato un
criterio di accesso predefinito.
API
Per sostituire collettivamente tutti i livelli di accesso,
chiamate accessLevels.replaceAll.
POST https://accesscontextmanager.googleapis.com/v1/accessPolicies/POLICY_NAME/accessLevels.replaceAll?alt=json
Dove:
POLICY_NAME è il nome del criterio di accesso della tua organizzazione.
Corpo della richiesta
Il corpo della richiesta deve includere un elenco di oggetti AccessLevel
che specificano le modifiche da apportare.
Facoltativamente, per scegliere come target una versione specifica del criterio di accesso della tua organizzazione, puoi includere un etag. Se non includi un etag, l'operazione collettiva ha come target la versione più recente del criterio di accesso della tua organizzazione.
In caso di esito positivo, il corpo della risposta della chiamata contiene una risorsa Operation che fornisce dettagli sull'operazione di post.
Risposta di esempio:
{"name":"operations/accessPolicies/11271009391/replaceLevels/1583523446234255","done":true,"response":{"@type":"type.googleapis.com/google.identity.accesscontextmanager.v1.ReplaceAccessLevelsResponse","accessLevels":[{"name":"accessPolicies/11271009391/accessLevels/corpnet_access","title":"Corpnet access","description":"Permit access to corpnet.","basic":{"conditions":[{"ipSubnetworks":["252.0.2.0/24"]}]}},{"name":"accessPolicies/11271009391/accessLevels/prodnet_access","title":"Prodnet access","description":"Permit access to prodnet.","basic":{"conditions":[{"ipSubnetworks":["176.0.2.0/24"]}]}}]}}
[[["Facile da capire","easyToUnderstand","thumb-up"],["Il problema è stato risolto","solvedMyProblem","thumb-up"],["Altra","otherUp","thumb-up"]],[["Difficile da capire","hardToUnderstand","thumb-down"],["Informazioni o codice di esempio errati","incorrectInformationOrSampleCode","thumb-down"],["Mancano le informazioni o gli esempi di cui ho bisogno","missingTheInformationSamplesINeed","thumb-down"],["Problema di traduzione","translationIssue","thumb-down"],["Altra","otherDown","thumb-down"]],["Ultimo aggiornamento 2025-09-04 UTC."],[[["\u003cp\u003eBulk updates to access levels and service perimeters can be made to resources within an organization's access policy.\u003c/p\u003e\n"],["\u003cp\u003eBulk operations will only be applied if all parts of the operation are successful, and any error encountered will fail the entire operation, leaving resources unchanged.\u003c/p\u003e\n"],["\u003cp\u003eBulk replacement of access levels will affect all existing access levels; any not included in the operation will be deleted.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003egcloud access-context-manager levels replace-all\u003c/code\u003e command or the \u003ccode\u003eaccessLevels.replaceAll\u003c/code\u003e API can be used for bulk replacement, but the Google Cloud console is not supported for bulk operations.\u003c/p\u003e\n"],["\u003cp\u003eWhen using \u003ccode\u003egcloud\u003c/code\u003e, a .yaml file defining new conditions is needed, while the API requires a list of \u003ccode\u003eAccessLevel\u003c/code\u003e objects in the request body.\u003c/p\u003e\n"]]],[],null,["# Making bulk changes to access levels\n\nUsing Access Context Manager, you can make bulk updates to resources that belong to\nyour organization's [access policy](/access-context-manager/docs/overview#access-policies), such as\n[access levels](/access-context-manager/docs/overview#access-levels) and [service perimeters](/vpc-service-controls/docs/service-perimeters).\n\nChanges to your resources are applied only if all parts of the bulk operation\nare successful. For example, if your bulk operation attempts to remove an access\nlevel that is in use by a service perimeter, an error is raised. Because an\nerror is encountered, the entire operation fails and no resources are updated.\n\nThis topic describes only bulk replacement of access levels. For more\ninformation about bulk replacement of service perimeters,\n[refer to the VPC Service Controls documentation](/vpc-service-controls/docs/bulk-operations).\n| **Note:** The Google Cloud console cannot be used for bulk operations.\n\nBefore you begin\n----------------\n\nBecause bulk operations affect *all* access levels for your organization, you\nmay want to obtain a complete list of your access levels. The list can be\nformatted as YAML, which may also make bulk changes to your access levels\neasier.\n\nTo get a formatted list of access levels, refer to\n[List access levels (formatted)](/access-context-manager/docs/manage-access-levels#formatted_access_levels).\n\nBulk replace access levels\n--------------------------\n\nThe following section details how to bulk replace your access levels.\n**Warning:** Bulk replace operations will affect *all* of your access levels. If existing access levels aren't included in the operation, those access levels are deleted. \n\n### gcloud\n\nTo bulk replace all access levels, use the\n`replace-all` command. \n\n```bash\ngcloud access-context-manager levels replace-all \\\n --source-file=FILE \\\n --etag=ETAG \\\n [--policy=POLICY_NAME]\n```\n\nWhere:\n\n- \u003cvar translate=\"no\"\u003eFILE\u003c/var\u003e is the name of a .yaml file that defines\n the new conditions for your existing access levels.\n\n For example: \n\n - name: accessPolicies/11271009391/accessLevels/corpnet_access\n title: Corpnet Access\n description: Permit access to corpnet.\n basic:\n combiningFunction: AND\n conditions:\n - ipSubnetworks:\n - 252.0.2.0/24\n - 2001:db8::/32\n - name: accessPolicies/11271009391/accessLevels/prodnet_access\n title: Prodnet Access\n description: Permit access to prodnet.\n basic:\n combiningFunction: OR\n conditions:\n - members:\n - user:exampleuser@example.com\n - serviceAccount:exampleaccount@example.iam.gserviceaccount.com\n - ipSubnetworks:\n - 176.0.2.0/24\n\n For further examples of the YAML structure of conditions, refer to\n the [example YAML file](/access-context-manager/docs/example-yaml-file).\n- \u003cvar translate=\"no\"\u003eETAG\u003c/var\u003e (optional) is a string that represents the target\n version of your organization's access policy. If you do not include an\n etag, the bulk operation targets the latest version of the your\n organization's access policy.\n\n To obtain the latest etag of your access policy,\n [`list` your access policies](/access-context-manager/docs/manage-access-policy#get_the_name_of_an_access_policy).\n- \u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e is the name of your organization's access policy.\n This value is required only if you haven't set a\n [default access policy](/access-context-manager/docs/manage-access-policy#set-default).\n\n### API\n\nTo bulk replace all access levels,\ncall [`accessLevels.replaceAll`](/access-context-manager/docs/reference/rest/v1/accessPolicies.accessLevels/replaceAll). \n\n```\nPOST https://accesscontextmanager.googleapis.com/v1/accessPolicies/POLICY_NAME/accessLevels.replaceAll?alt=json\n```\n\nWhere:\n\n- \u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e is the name of your organization's access policy.\n\n### Request body\n\nThe request body must include a list of [`AccessLevel`](/access-context-manager/docs/reference/rest/v1/accessPolicies.accessLevels#AccessLevel)\nobjects that specify the changes you want to make.\n\nOptionally, to target a specific version of your organization's access\npolicy, you can include an etag. If you do not include an etag, the bulk\noperation targets the latest version of your organization's access policy.\n\nFor example: \n\n```json\n{\n \"accessLevels\": [\n object (AccessLevel),\n object (AccessLevel),\n ...\n ]\n \"etag\": string\n}\n```\n\n### Response body\n\nIf successful, the response body for the call contains an\n[`Operation`](/access-context-manager/docs/reference/rest/Shared.Types/Operation) resource that provides details about the\npost operation.\n\nExample response: \n\n {\n \"name\": \"operations/accessPolicies/11271009391/replaceLevels/1583523446234255\",\n \"done\": true,\n \"response\": {\n \"@type\": \"type.googleapis.com/google.identity.accesscontextmanager.v1.ReplaceAccessLevelsResponse\",\n \"accessLevels\": [\n {\n \"name\": \"accessPolicies/11271009391/accessLevels/corpnet_access\",\n \"title\": \"Corpnet access\",\n \"description\": \"Permit access to corpnet.\",\n \"basic\": {\n \"conditions\": [\n {\n \"ipSubnetworks\": [\n \"252.0.2.0/24\"\n ]\n }\n ]\n }\n },\n {\n \"name\": \"accessPolicies/11271009391/accessLevels/prodnet_access\",\n \"title\": \"Prodnet access\",\n \"description\": \"Permit access to prodnet.\",\n \"basic\": {\n \"conditions\": [\n {\n \"ipSubnetworks\": [\n \"176.0.2.0/24\"\n ]\n }\n ]\n }\n }\n ]\n }\n }"]]
