Mantenha tudo organizado com as coleções
Salve e categorize o conteúdo com base nas suas preferências.
O exemplo a seguir inclui todos os atributos que podem ser especificados ao criar um arquivo .yaml para um nível de acesso. Um arquivo .yaml é necessário apenas se você estiver criando ou modificando um nível de acesso usando a ferramenta de linha de comando gcloud.
Embora seja possível incluir identidades no atributo members, o Google
recomenda não fazer isso. Consulte identities em Regras de entrada e saída para saber como permitir que
os perímetros se comuniquem entre si.
# Attributes can be included in any order in the condition-devicePolicy:# Must include at least one of the following:allowedEncryptionStatuses:# Must include at least one of the following:-ENCRYPTION_UNSUPPORTED-ENCRYPTED-UNENCRYPTEDosConstraints:# Must include at least one of the following:-osType:DESKTOP_CHROME_OSminimumVersion:11316.165.0# minimumVersion must be formatted as x.x.xrequireVerifiedChromeOs:true-osType:DESKTOP_MAC-osType:DESKTOP_WINDOWS# minimumVersion is not requiredrequireScreenlock:true# requireScreenlock defaults to false if not includedrequireAdminApproval:true# requireAdminApproval defaults to false if not includedrequireCorpOwned:true# requireCorpOwned defaults to false if not includedipSubnetworks:# Must include one or more IPv4 and IPv6 CIDRs-252.0.2.0/24-2001:db8::/32regions:# Must include one or more regions as ISO 3166-1 alpha-2 codes-US-CH-SGrequiredAccessLevels:# Must include one or more existing access levels# Must be formatted as accessPolicies/policy-name/accessLevels/level-name-accessPolicies/247332951433/accessLevels/Device_Trustmembers:# Must include one or more valid IAM users or service accounts-user:exampleuser@example.com-serviceAccount:exampleaccount@example.iam.gserviceaccount.com
negate:true# negate is not required and can only be included with other attributes# If negate is included, none of the attributes included in the condition# can be true for the condition to be met.# You can include more than one condition in the .yaml file-ipSubnetworks:-176.0.2.0/24
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-09-04 UTC."],[[["\u003cp\u003eA \u003ccode\u003e.yaml\u003c/code\u003e file is required when creating or modifying access levels using the \u003ccode\u003egcloud\u003c/code\u003e command-line tool.\u003c/p\u003e\n"],["\u003cp\u003eConditions within the \u003ccode\u003e.yaml\u003c/code\u003e file must include at least one attribute, which can be combined with others using AND or NAND operations.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003edevicePolicy\u003c/code\u003e attribute requires at least one allowed encryption status and one os constraint, and can optionally include requirements such as screen lock, admin approval, and corporate ownership.\u003c/p\u003e\n"],["\u003cp\u003eOther attributes that can be specified include \u003ccode\u003eipSubnetworks\u003c/code\u003e, \u003ccode\u003eregions\u003c/code\u003e, and \u003ccode\u003erequiredAccessLevels\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eWhile \u003ccode\u003emembers\u003c/code\u003e can include identities, it is recommended to refer to ingress and egress rules for perimeter communication; you can use the \u003ccode\u003enegate\u003c/code\u003e attribute to invert the condition's requirement.\u003c/p\u003e\n"]]],[],null,["# Example YAML for an access level\n\nThe following example includes all attributes that can be specified when\nyou create a .yaml file for an access level. A .yaml file is only necessary\nif you are creating or modifying an access level using the `gcloud` command-line tool.\n| **Note:** Conditions must include at least one attribute. If they contain more than one attribute, the attributes can be combined as an **AND** operation (all must be true) or as a **NAND** operation (none can be true) to determine whether the condition is met. You can use any combination of attributes required for your use case. The comments provided for these attributes apply only if you include the attribute in your .yaml file.\n\nAlthough you can include identities in the `members` attribute, Google\nrecommends against doing so. See `identities` in [Ingress and egress\nrules](/vpc-service-controls/docs/ingress-egress-rules) for how to allow\nperimeters to communicate with each other. \n\n # Attributes can be included in any order in the condition\n - devicePolicy:\n # Must include at least one of the following:\n allowedEncryptionStatuses:\n # Must include at least one of the following:\n - ENCRYPTION_UNSUPPORTED\n - ENCRYPTED\n - UNENCRYPTED\n osConstraints:\n # Must include at least one of the following:\n - osType: DESKTOP_CHROME_OS\n minimumVersion: 11316.165.0\n # minimumVersion must be formatted as x.x.x\n requireVerifiedChromeOs: true\n - osType: DESKTOP_MAC\n - osType: DESKTOP_WINDOWS\n # minimumVersion is not required\n requireScreenlock: true\n # requireScreenlock defaults to false if not included\n requireAdminApproval: true\n # requireAdminApproval defaults to false if not included\n requireCorpOwned: true\n # requireCorpOwned defaults to false if not included\n ipSubnetworks:\n # Must include one or more IPv4 and IPv6 CIDRs\n - 252.0.2.0/24\n - 2001:db8::/32\n regions:\n # Must include one or more regions as ISO 3166-1 alpha-2 codes\n - US\n - CH\n - SG\n requiredAccessLevels:\n # Must include one or more existing access levels\n # Must be formatted as accessPolicies/policy-name/accessLevels/level-name\n - accessPolicies/247332951433/accessLevels/Device_Trust\n members:\n # Must include one or more valid IAM users or service accounts\n - user:exampleuser@example.com\n - serviceAccount:exampleaccount@example.iam.gserviceaccount.com\n negate: true\n # negate is not required and can only be included with other attributes\n # If negate is included, none of the attributes included in the condition\n # can be true for the condition to be met.\n\n # You can include more than one condition in the .yaml file\n - ipSubnetworks:\n - 176.0.2.0/24"]]
