アクセスレベルの YAML の例

次の例には、アクセスレベルの .yaml ファイルを作成するときに指定できるすべての属性が含まれています。.yaml ファイルは、gcloud コマンドラインツールを使用してアクセスレベルを作成または変更する場合にのみ必要です。

members 属性には ID を含めることができますが、おすすめしません。境界が相互に通信する方法については、上り（内向き）ルールと下り（外向き）ルールの identities をご覧ください。

# Attributes can be included in any order in the condition
- devicePolicy:
  # Must include at least one of the following:
    allowedEncryptionStatuses:
    # Must include at least one of the following:
      - ENCRYPTION_UNSUPPORTED
      - ENCRYPTED
      - UNENCRYPTED
    osConstraints:
    # Must include at least one of the following:
      - osType: DESKTOP_CHROME_OS
        minimumVersion: 11316.165.0
        # minimumVersion must be formatted as x.x.x
        requireVerifiedChromeOs: true
      - osType: DESKTOP_MAC
      - osType: DESKTOP_WINDOWS
        # minimumVersion is not required
    requireScreenlock: true
    # requireScreenlock defaults to false if not included
    requireAdminApproval: true
    # requireAdminApproval defaults to false if not included
    requireCorpOwned: true
    # requireCorpOwned defaults to false if not included
  ipSubnetworks:
  # Must include one or more IPv4 and IPv6 CIDRs
    - 252.0.2.0/24
    - 2001:db8::/32
  regions:
  # Must include one or more regions as ISO 3166-1 alpha-2 codes
    - US
    - CH
    - SG
  requiredAccessLevels:
  # Must include one or more existing access levels
  # Must be formatted as accessPolicies/policy-name/accessLevels/level-name
    - accessPolicies/247332951433/accessLevels/Device_Trust
  members:
  # Must include one or more valid IAM users or service accounts
    - user:exampleuser@example.com
    - serviceAccount:exampleaccount@example.iam.gserviceaccount.com
  negate: true
  # negate is not required and can only be included with other attributes
  # If negate is included, none of the attributes included in the condition
  # can be true for the condition to be met.

# You can include more than one condition in the .yaml file
- ipSubnetworks:
    - 176.0.2.0/24