Access Context Manager V1 Client - Class EgressTo (0.5.5)

Reference documentation and code samples for the Access Context Manager V1 Client class EgressTo.

Defines the conditions under which an EgressPolicy matches a request. Conditions are based on information about the ApiOperation intended to be performed on the resources specified. Note that if the destination of the request is also protected by a ServicePerimeter, then that ServicePerimeter must have an IngressPolicy which allows access in order for this request to succeed. The request must match operations AND resources fields in order to be allowed egress out of the perimeter.

Generated from protobuf message google.identity.accesscontextmanager.v1.ServicePerimeterConfig.EgressTo

Namespace

Google \ Identity \ AccessContextManager \ V1 \ ServicePerimeterConfig

Methods

__construct

Constructor.

Parameters
Name Description
data array

Optional. Data for populating the Message object.

↳ resources array

A list of resources, currently only projects in the form projects/<projectnumber>, that are allowed to be accessed by sources defined in the corresponding [EgressFrom] [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.EgressFrom]. A request matches if it contains a resource in this list. If * is specified for resources, then this [EgressTo] [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.EgressTo] rule will authorize access to all resources outside the perimeter.

↳ operations array<Google\Identity\AccessContextManager\V1\ServicePerimeterConfig\ApiOperation>

A list of [ApiOperations] [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.ApiOperation] allowed to be performed by the sources specified in the corresponding [EgressFrom] [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.EgressFrom]. A request matches if it uses an operation/service in this list.

↳ external_resources array

A list of external resources that are allowed to be accessed. Only AWS and Azure resources are supported. For Amazon S3, the supported format is s3://BUCKET_NAME. For Azure Storage, the supported format is azure://myaccount.blob.core.windows.net/CONTAINER_NAME. A request matches if it contains an external resource in this list (Example: s3://bucket/path). Currently '*' is not allowed.

getResources

A list of resources, currently only projects in the form projects/<projectnumber>, that are allowed to be accessed by sources defined in the corresponding EgressFrom.

A request matches if it contains a resource in this list. If * is specified for resources, then this EgressTo rule will authorize access to all resources outside the perimeter.

Returns
Type Description
Google\Protobuf\Internal\RepeatedField

setResources

A list of resources, currently only projects in the form projects/<projectnumber>, that are allowed to be accessed by sources defined in the corresponding EgressFrom.

A request matches if it contains a resource in this list. If * is specified for resources, then this EgressTo rule will authorize access to all resources outside the perimeter.

Parameter
Name Description
var string[]
Returns
Type Description
$this

getOperations

A list of ApiOperations allowed to be performed by the sources specified in the corresponding EgressFrom.

A request matches if it uses an operation/service in this list.

Returns
Type Description
Google\Protobuf\Internal\RepeatedField

setOperations

A list of ApiOperations allowed to be performed by the sources specified in the corresponding EgressFrom.

A request matches if it uses an operation/service in this list.

Parameter
Name Description
var array<Google\Identity\AccessContextManager\V1\ServicePerimeterConfig\ApiOperation>
Returns
Type Description
$this

getExternalResources

A list of external resources that are allowed to be accessed. Only AWS and Azure resources are supported. For Amazon S3, the supported format is s3://BUCKET_NAME. For Azure Storage, the supported format is azure://myaccount.blob.core.windows.net/CONTAINER_NAME. A request matches if it contains an external resource in this list (Example: s3://bucket/path). Currently '*' is not allowed.

Returns
Type Description
Google\Protobuf\Internal\RepeatedField

setExternalResources

A list of external resources that are allowed to be accessed. Only AWS and Azure resources are supported. For Amazon S3, the supported format is s3://BUCKET_NAME. For Azure Storage, the supported format is azure://myaccount.blob.core.windows.net/CONTAINER_NAME. A request matches if it contains an external resource in this list (Example: s3://bucket/path). Currently '*' is not allowed.

Parameter
Name Description
var string[]
Returns
Type Description
$this