次の例には、アクセスレベルの .yaml ファイルを作成するときに指定できるすべての属性が含まれています。.yaml ファイルは、gcloud コマンドライン ツールを使用してアクセスレベルを作成または変更する場合にのみ必要です。
members 属性には ID を含めることができますが、おすすめしません。境界が相互に通信する方法については、上り（内向き）ルールと下り（外向き）ルールの identities をご覧ください。
# Attributes can be included in any order in the condition
- devicePolicy:
# Must include at least one of the following:
allowedEncryptionStatuses:
# Must include at least one of the following:
- ENCRYPTION_UNSUPPORTED
- ENCRYPTED
- UNENCRYPTED
osConstraints:
# Must include at least one of the following:
- osType: DESKTOP_CHROME_OS
minimumVersion: 11316.165.0
# minimumVersion must be formatted as x.x.x
requireVerifiedChromeOs: true
- osType: DESKTOP_MAC
- osType: DESKTOP_WINDOWS
# minimumVersion is not required
requireScreenlock: true
# requireScreenlock defaults to false if not included
requireAdminApproval: true
# requireAdminApproval defaults to false if not included
requireCorpOwned: true
# requireCorpOwned defaults to false if not included
ipSubnetworks:
# Must include one or more IPv4 and IPv6 CIDRs
# Cannot include private IP ranges (e.g., 192.168.0.0/16, 172.16.0.0/12)
- 252.0.2.0/24
- 2001:db8::/32
regions:
# Must include one or more regions as ISO 3166-1 alpha-2 codes
- US
- CH
- SG
requiredAccessLevels:
# Must include one or more existing access levels
# Must be formatted as accessPolicies/policy-name/accessLevels/level-name
- accessPolicies/247332951433/accessLevels/Device_Trust
members:
# Must include one or more valid IAM users or service accounts
- user:exampleuser@example.com
- serviceAccount:exampleaccount@example.iam.gserviceaccount.com
negate: true
# negate is not required and can only be included with other attributes
# If negate is included, none of the attributes included in the condition
# can be true for the condition to be met.
# You can include more than one condition in the .yaml file
- ipSubnetworks:
- 176.0.2.0/24