REST Resource: accessPolicies.accessLevels

Resource: AccessLevel

An AccessLevel is a label that can be applied to requests to Google Cloud services, along with a list of requirements necessary for the label to be applied.

JSON representation 
{
  "name": string,
  "title": string,
  "description": string,

  // Union field level can be only one of the following:
  "basic": {
    object (BasicLevel)
  },
  "custom": {
    object (CustomLevel)
  }
  // End of list of possible types for union field level.
}
Fields
name

string

Identifier. Resource name for the AccessLevel. Format: accessPolicies/{access_policy}/accessLevels/{accessLevel}.

The accessLevel component must begin with a letter, followed by alphanumeric characters or _. Its maximum length is 50 characters.

After you create an AccessLevel, you cannot change its name.
title

string

Human readable title. Must be unique within the Policy.
description

string

Description of the AccessLevel and its use. Does not affect behavior.
Union field level. Required. Describes the necessary conditions for the level to apply. level can be only one of the following:
basic

object (BasicLevel)

A BasicLevel composed of Conditions.
custom

object (CustomLevel)

A CustomLevel written in the Common Expression Language.

BasicLevel

BasicLevel is an AccessLevel using a set of recommended features.

JSON representation 
{
  "conditions": [
    {
      object (Condition)
    }
  ],
  "combiningFunction": enum (ConditionCombiningFunction)
}
Fields
conditions[]

object (Condition)

Required. A list of requirements for the AccessLevel to be granted.
combiningFunction

enum (ConditionCombiningFunction)

How the conditions list should be combined to determine if a request is granted this AccessLevel. If AND is used, each Condition in conditions must be satisfied for the AccessLevel to be applied. If OR is used, at least one Condition in conditions must be satisfied for the AccessLevel to be applied. Default behavior is AND.

Condition

A condition necessary for an AccessLevel to be granted. The Condition is an AND over its fields. So a Condition is true if: 1) the request IP is from one of the listed subnetworks AND 2) the originating device complies with the listed device policy AND 3) all listed access levels are granted AND 4) the request was sent at a time allowed by the DateTimeRestriction AND 5) the request was sent from one of the specified vpcNetworkSources.

JSON representation 
{
  "ipSubnetworks": [
    string
  ],
  "devicePolicy": {
    object (DevicePolicy)
  },
  "requiredAccessLevels": [
    string
  ],
  "negate": boolean,
  "members": [
    string
  ],
  "regions": [
    string
  ],
  "vpcNetworkSources": [
    {
      object (VpcNetworkSource)
    }
  ]
}
Fields
ipSubnetworks[]

string

CIDR block IP subnetwork specification. May be IPv4 or IPv6. Note that for a CIDR IP address block, the specified IP address portion must be properly truncated (i.e. all the host bits must be zero) or the input is considered malformed. For example, "192.0.2.0/24" is accepted but "192.0.2.1/24" is not. Similarly, for IPv6, "2001:db8::/32" is accepted whereas "2001:db8::1/32" is not. The originating IP of a request must be in one of the listed subnets in order for this Condition to be true. If this field is empty, all IP addresses are allowed.
devicePolicy

object (DevicePolicy)

Device specific restrictions, all restrictions must hold for the Condition to be true. If not specified, all devices are allowed.
requiredAccessLevels[]

string

A list of other access levels defined in the same Policy, referenced by resource name. Referencing an AccessLevel which does not exist is an error. All access levels listed must be granted for the Condition to be true. Example: "accessPolicies/MY_POLICY/accessLevels/LEVEL_NAME"
negate

boolean

Whether to negate the Condition. If true, the Condition becomes a NAND over its non-empty fields. Any non-empty field criteria evaluating to false will result in the Condition to be satisfied. Defaults to false.
members[]

string

The request must be made by one of the provided user or service accounts. Groups are not supported. Syntax: user:{emailid} serviceAccount:{emailid} If not specified, a request may come from any user.
regions[]

string

The request must originate from one of the provided countries/regions. Must be valid ISO 3166-1 alpha-2 codes.
vpcNetworkSources[]

object (VpcNetworkSource)

The request must originate from one of the provided VPC networks in Google Cloud. Cannot specify this field together with ipSubnetworks.

DevicePolicy

DevicePolicy specifies device specific restrictions necessary to acquire a given access level. A DevicePolicy specifies requirements for requests from devices to be granted access levels, it does not do any enforcement on the device. DevicePolicy acts as an AND over all specified fields, and each repeated field is an OR over its elements. Any unset fields are ignored. For example, if the proto is { osType : DESKTOP_WINDOWS, osType : DESKTOP_LINUX, encryption_status: ENCRYPTED}, then the DevicePolicy will be true for requests originating from encrypted Linux desktops and encrypted Windows desktops.

JSON representation 
{
  "requireScreenlock": boolean,
  "allowedEncryptionStatuses": [
    enum (DeviceEncryptionStatus)
  ],
  "osConstraints": [
    {
      object (OsConstraint)
    }
  ],
  "allowedDeviceManagementLevels": [
    enum (DeviceManagementLevel)
  ],
  "requireAdminApproval": boolean,
  "requireCorpOwned": boolean
}
Fields
requireScreenlock

boolean

Whether or not screenlock is required for the DevicePolicy to be true. Defaults to false.
allowedEncryptionStatuses[]

enum (DeviceEncryptionStatus)

Allowed encryptions statuses, an empty list allows all statuses.
osConstraints[]

object (OsConstraint)

Allowed OS versions, an empty list allows all types and all versions.
allowedDeviceManagementLevels[]

enum (DeviceManagementLevel)

Allowed device management levels, an empty list allows all management levels.
requireAdminApproval

boolean

Whether the device needs to be approved by the customer admin.
requireCorpOwned

boolean

Whether the device needs to be corp owned.

OsConstraint

A restriction on the OS type and version of devices making requests.

JSON representation 
{
  "osType": enum (OsType),
  "minimumVersion": string,
  "requireVerifiedChromeOs": boolean
}
Fields
osType

enum (OsType)

Required. The allowed OS type.
minimumVersion

string

The minimum allowed OS version. If not set, any version of this OS satisfies the constraint. Format: "major.minor.patch". Examples: "10.5.301", "9.2.1".
requireVerifiedChromeOs

boolean

Only allows requests from devices with a verified Chrome OS. Verifications includes requirements that the device is enterprise-managed, conformant to domain policies, and the caller has permission to call the API targeted by the request.

VpcNetworkSource

The originating network source in Google Cloud.

JSON representation 
{

  // Union field kind can be only one of the following:
  "vpcSubnetwork": {
    object (VpcSubNetwork)
  }
  // End of list of possible types for union field kind.
}
Fields
Union field kind. The type of the originating network source of the request. kind can be only one of the following:
vpcSubnetwork

object (VpcSubNetwork)

Sub-segment ranges of a VPC network.

VpcSubNetwork

Sub-segment ranges inside of a VPC Network.

JSON representation 
{
  "network": string,
  "vpcIpSubnetworks": [
    string
  ]
}
Fields
network

string

Required. Network name. If the network is not part of the organization, the compute.network.get permission must be granted to the caller. Format: //compute.googleapis.com/projects/{PROJECT_ID}/global/networks/{NETWORK_NAME} Example: //compute.googleapis.com/projects/my-project/global/networks/network-1
vpcIpSubnetworks[]

string

CIDR block IP subnetwork specification. The IP address must be an IPv4 address and can be a public or private IP address. Note that for a CIDR IP address block, the specified IP address portion must be properly truncated (i.e. all the host bits must be zero) or the input is considered malformed. For example, "192.0.2.0/24" is accepted but "192.0.2.1/24" is not. If empty, all IP addresses are allowed.

ConditionCombiningFunction

Options for how the conditions list should be combined to determine if this AccessLevel is applied. Default is AND.

Enums
AND All Conditions must be true for the BasicLevel to be true.
OR If at least one Condition is true, then the BasicLevel is true.

CustomLevel

CustomLevel is an AccessLevel using the Cloud Common Expression Language to represent the necessary conditions for the level to apply to a request. See CEL spec at: https://github.com/google/cel-spec

JSON representation 
{
  "expr": {
    object (Expr)
  }
}
Fields
expr

object (Expr)

Required. A Cloud CEL expression evaluating to a boolean.

Methods

create

 Creates an access level.

delete

 Deletes an access level based on the resource name.

get

 Gets an access level based on the resource name.

list

 Lists all access levels for an access policy.

patch

 Updates an access level.

replaceAll

 Replaces all existing access levels in an access policy with the access levels provided.

testIamPermissions

 Returns the IAM permissions that the caller has on the specified Access Context Manager resource.