replace-all 명령어로 모든 서비스 경계 구성을 재정의하는 경우 경계 내에 etag 필드를 설정하면 안 됩니다. 경계를 가져오고 업데이트하는 사이에 etag가 변경될 수 있으므로 replace-all 명령어에서 etag 불일치 오류가 반환될 수 있습니다. 그러나 etag 확인을 적용하려면 최상위 --etag 매개변수를 사용하여 전체 replace-all 요청에 대해 etag를 설정할 수 있습니다.
경계 내의 각 etag 속성을 수동으로 삭제하는 대신 etag를 제외한 모든 필드가 포함된 --format을 지정하여 etag 속성 없이 경계를 가져올 수 있습니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[],[],null,["# Making bulk changes to service perimeters\n\nUsing Access Context Manager, you can make bulk updates to resources that belong to\nyour organization's [access policy](/access-context-manager/docs/overview#access-policies), such as\n[access levels](/access-context-manager/docs/overview#access-levels) and [service perimeters](/vpc-service-controls/docs/service-perimeters). Changes to your resources are applied only if all parts of the bulk operation are successful.\n\nThis topic describes only bulk replacement of service perimeters. For more\ninformation about bulk replacement of access levels,\n[refer to the Access Context Manager documentation](/access-context-manager/docs/bulk-operations).\n| **Note:** The Google Cloud console cannot be used for bulk operations.\n\nGet a list of service perimeters\n--------------------------------\n\nBecause bulk operations affect *all* service perimeters for your organization,\nyou can obtain a complete list of your perimeters. Also, you can format this list\nas YAML and use it to make bulk changes to your perimeters.\n\nTo get a formatted list of service perimeters, refer to\n[List service perimeters (formatted)](/vpc-service-controls/docs/manage-service-perimeters#formatted-list).\n\nWhen overriding all service perimeter configurations with the `replace-all`\ncommand, you must not set the `etag` fields within perimeters. Etags are likely\nto change between fetching and updating the perimeters, causing the\n`replace-all` command to return an etag mismatch error. However, you can\nset an `etag` for the entire `replace-all` request with the top-level `--etag`\nparameter if you want to enforce the etag check.\n\nInstead of manually removing each of the `etag` properties within the\nperimeters, you can fetch the perimeters without `etag` properties by specifying\na `--format` with all fields except `etag`. \n\n```bash\ngcloud access-context-manager perimeters list \\\n --policy=POLICY_NAME \\\n --format=\"json(name,title,description,perimeterType,status,spec,useExplicitDryRunSpec)\"\n```\n\nBulk replace service perimeters\n-------------------------------\n\nThe following section details how to bulk replace your service perimeters.\n**Warning:** Bulk replace operations affect *all* your service perimeters. If existing service perimeters aren't included in the operation, those service perimeters are deleted. \n\n### gcloud\n\nTo bulk replace all service perimeters, use the\n`replace-all` command. \n\n```bash\ngcloud access-context-manager perimeters replace-all POLICY_NAME \\\n --source-file=FILE \\\n --etag=ETAG \\\n```\n\nWhere:\n\n- \u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e is the name of your organization's access policy.\n This value is required only if you haven't set a\n [default access policy](/access-context-manager/docs/manage-access-policy#set-default).\n\n- \u003cvar translate=\"no\"\u003eFILE\u003c/var\u003e is the name of a .yaml file that defines\n the new settings for your existing service perimeters.\n\n For example: \n\n - name: accessPolicies/11271009391/servicePerimeters/storage_perimeter\n title: Storage Perimeter\n description: Perimeter to protect Storage resources.\n perimeterType: PERIMETER_TYPE_REGULAR\n status:\n restrictedServices:\n - storage.googleapis.com\n - name: accessPolicies/11271009391/servicePerimeters/bigquery_perimeter\n title: BigQuery Perimeter\n description: Perimeter to protect BigQuery resources.\n perimeterType: PERIMETER_TYPE_REGULAR\n status:\n restrictedServices:\n - bigquery.googleapis.com\n\n For more information about formatting the YAML file, refer to the\n JSON structure of Access Context Manager's\n [`ServicePerimeterConfig` object](/access-context-manager/docs/reference/rest/v1/accessPolicies.servicePerimeters#ServicePerimeterConfig).\n- \u003cvar translate=\"no\"\u003eETAG\u003c/var\u003e (optional) is a string that represents the target\n version of your organization's access policy. If you do not include an\n etag, the bulk operation targets the latest version of the your\n organization's access policy.\n\n To obtain the latest etag of your access policy,\n [`list` your access policies](/access-context-manager/docs/manage-access-policy#get_the_name_of_an_access_policy).\n\n### API\n\nTo bulk replace all service perimeters,\ncall [`servicePerimeters.replaceAll`](/access-context-manager/docs/reference/rest/v1/accessPolicies.servicePerimeters/replaceAll). \n\n```\nPOST https://accesscontextmanager.googleapis.com/v1/accessPolicies/POLICY_NAME/servicePerimeters.replaceAll?alt=json\n```\n\nWhere:\n\n- \u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e is the name of your organization's access policy.\n\n### Request body\n\nThe request body must include a list of\n[`ServicePerimeterConfig`](/access-context-manager/docs/reference/rest/v1/accessPolicies.servicePerimeters#ServicePerimeterConfig) objects that specify the\nchanges you want to make.\n\nOptionally, to target a specific version of your organization's access\npolicy, you can include an etag. If you do not include an etag, the bulk\noperation targets the latest version of your organization's access policy.\n\nFor example: \n\n```json\n{\n \"servicePerimeters\": [\n object (ServicePerimeterConfig),\n object (ServicePerimeterConfig),\n ...\n ]\n \"etag\": string\n}\n```\n\n### Response body\n\nIf successful, the response body for the call contains an\n[`Operation`](/access-context-manager/docs/reference/rest/Shared.Types/Operation) resource that provides details about the\npost operation.\n\nExample response: \n\n {\n \"name\": \"operations/accessPolicies/11271009391/replacePerimeters/1583523447707087\",\n \"done\": true,\n \"response\": {\n \"@type\": \"type.googleapis.com/google.identity.accesscontextmanager.v1.ReplaceServicePerimetersResponse\",\n \"servicePerimeters\": [\n {\n \"name\": \"accessPolicies/11271009391/servicePerimeters/storage_perimeter\",\n \"title\": \"Storage Perimeter\",\n \"description\": \"Perimeter to protect Storage resources.\",\n \"status\": {\n \"accessLevels\": [\n \"accessPolicies/11271009391/accessLevels/corpnet_access\"\n ],\n \"restrictedServices\": [\n \"bigtable.googleapis.com\"\n ]\n }\n },\n {\n \"name\": \"accessPolicies/11271009391/servicePerimeters/storage_perimeter\",\n \"title\": \"BigQuery Perimeter\",\n \"description\": \"Perimeter to protect BigQuery resources.\",\n \"status\": {\n \"accessLevels\": [\n \"accessPolicies/11271009391/accessLevels/prodnet_access\"\n ],\n \"restrictedServices\": [\n \"bigtable.googleapis.com\"\n ]\n }\n }\n ]\n }\n }"]]
