Docs Home Pulumi IaC Pulumi ESC Pulumi Cloud Packages Tutorials
  1. Packages
  2. Google Cloud (GCP) Classic
  3. API Docs
  4. compute
  5. NetworkFirewallPolicyWithRules
Google Cloud v8.21.0 published on Wednesday, Mar 5, 2025 by Pulumi
pulumi/pulumi-gcp

gcp.compute.NetworkFirewallPolicyWithRules

Explore with Pulumi AI

gcp logo
Google Cloud v8.21.0 published on Wednesday, Mar 5, 2025 by Pulumi
pulumi/pulumi-gcp

    Example Usage

    Compute Network Firewall Policy With Rules Full

    import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const project = gcp.organizations.getProject({});
const addressGroup1 = new gcp.networksecurity.AddressGroup("address_group_1", {
    name: "address-group",
    parent: project.then(project => project.id),
    description: "Global address group",
    location: "global",
    items: ["208.80.154.224/32"],
    type: "IPV4",
    capacity: 100,
});
const secureTagKey1 = new gcp.tags.TagKey("secure_tag_key_1", {
    description: "Tag key",
    parent: project.then(project => project.id),
    purpose: "GCE_FIREWALL",
    shortName: "tag-key",
    purposeData: {
        network: project.then(project => `${project.name}/default`),
    },
});
const secureTagValue1 = new gcp.tags.TagValue("secure_tag_value_1", {
    description: "Tag value",
    parent: secureTagKey1.id,
    shortName: "tag-value",
});
const securityProfile1 = new gcp.networksecurity.SecurityProfile("security_profile_1", {
    name: "sp",
    type: "THREAT_PREVENTION",
    parent: "organizations/123456789",
    location: "global",
});
const securityProfileGroup1 = new gcp.networksecurity.SecurityProfileGroup("security_profile_group_1", {
    name: "spg",
    parent: "organizations/123456789",
    description: "my description",
    threatPreventionProfile: securityProfile1.id,
});
const network = new gcp.compute.Network("network", {
    name: "network",
    autoCreateSubnetworks: false,
});
const primary = new gcp.compute.NetworkFirewallPolicyWithRules("primary", {
    name: "fw-policy",
    description: "Terraform test",
    rules: [
        {
            description: "tcp rule",
            priority: 1000,
            enableLogging: true,
            action: "allow",
            direction: "EGRESS",
            match: {
                destIpRanges: ["11.100.0.1/32"],
                destFqdns: [
                    "www.yyy.com",
                    "www.zzz.com",
                ],
                destRegionCodes: [
                    "HK",
                    "IN",
                ],
                destThreatIntelligences: [
                    "iplist-search-engines-crawlers",
                    "iplist-tor-exit-nodes",
                ],
                destAddressGroups: [addressGroup1.id],
                layer4Configs: [{
                    ipProtocol: "tcp",
                    ports: [
                        "8080",
                        "7070",
                    ],
                }],
            },
            targetSecureTags: [{
                name: secureTagValue1.id,
            }],
        },
        {
            description: "udp rule",
            priority: 2000,
            enableLogging: false,
            action: "deny",
            direction: "INGRESS",
            disabled: true,
            match: {
                srcIpRanges: ["0.0.0.0/0"],
                srcFqdns: [
                    "www.abc.com",
                    "www.def.com",
                ],
                srcRegionCodes: [
                    "US",
                    "CA",
                ],
                srcThreatIntelligences: [
                    "iplist-known-malicious-ips",
                    "iplist-public-clouds",
                ],
                srcAddressGroups: [addressGroup1.id],
                srcSecureTags: [{
                    name: secureTagValue1.id,
                }],
                layer4Configs: [{
                    ipProtocol: "udp",
                }],
            },
        },
        {
            description: "security profile group rule",
            ruleName: "tcp rule",
            priority: 3000,
            enableLogging: false,
            action: "apply_security_profile_group",
            direction: "INGRESS",
            targetServiceAccounts: ["test@google.com"],
            securityProfileGroup: pulumi.interpolate`//networksecurity.googleapis.com/${securityProfileGroup1.id}`,
            tlsInspect: true,
            match: {
                srcIpRanges: ["0.0.0.0/0"],
                layer4Configs: [{
                    ipProtocol: "tcp",
                }],
            },
        },
        {
            description: "network scope rule 1",
            ruleName: "network scope 1",
            priority: 4000,
            enableLogging: false,
            action: "allow",
            direction: "INGRESS",
            match: {
                srcIpRanges: ["11.100.0.1/32"],
                srcNetworkScope: "VPC_NETWORKS",
                srcNetworks: [network.id],
                layer4Configs: [{
                    ipProtocol: "tcp",
                    ports: ["8080"],
                }],
            },
        },
        {
            description: "network scope rule 2",
            ruleName: "network scope 2",
            priority: 5000,
            enableLogging: false,
            action: "allow",
            direction: "EGRESS",
            match: {
                destIpRanges: ["0.0.0.0/0"],
                destNetworkScope: "INTERNET",
                layer4Configs: [{
                    ipProtocol: "tcp",
                    ports: ["8080"],
                }],
            },
        },
    ],
});

    import pulumi
import pulumi_gcp as gcp

project = gcp.organizations.get_project()
address_group1 = gcp.networksecurity.AddressGroup("address_group_1",
    name="address-group",
    parent=project.id,
    description="Global address group",
    location="global",
    items=["208.80.154.224/32"],
    type="IPV4",
    capacity=100)
secure_tag_key1 = gcp.tags.TagKey("secure_tag_key_1",
    description="Tag key",
    parent=project.id,
    purpose="GCE_FIREWALL",
    short_name="tag-key",
    purpose_data={
        "network": f"{project.name}/default",
    })
secure_tag_value1 = gcp.tags.TagValue("secure_tag_value_1",
    description="Tag value",
    parent=secure_tag_key1.id,
    short_name="tag-value")
security_profile1 = gcp.networksecurity.SecurityProfile("security_profile_1",
    name="sp",
    type="THREAT_PREVENTION",
    parent="organizations/123456789",
    location="global")
security_profile_group1 = gcp.networksecurity.SecurityProfileGroup("security_profile_group_1",
    name="spg",
    parent="organizations/123456789",
    description="my description",
    threat_prevention_profile=security_profile1.id)
network = gcp.compute.Network("network",
    name="network",
    auto_create_subnetworks=False)
primary = gcp.compute.NetworkFirewallPolicyWithRules("primary",
    name="fw-policy",
    description="Terraform test",
    rules=[
        {
            "description": "tcp rule",
            "priority": 1000,
            "enable_logging": True,
            "action": "allow",
            "direction": "EGRESS",
            "match": {
                "dest_ip_ranges": ["11.100.0.1/32"],
                "dest_fqdns": [
                    "www.yyy.com",
                    "www.zzz.com",
                ],
                "dest_region_codes": [
                    "HK",
                    "IN",
                ],
                "dest_threat_intelligences": [
                    "iplist-search-engines-crawlers",
                    "iplist-tor-exit-nodes",
                ],
                "dest_address_groups": [address_group1.id],
                "layer4_configs": [{
                    "ip_protocol": "tcp",
                    "ports": [
                        "8080",
                        "7070",
                    ],
                }],
            },
            "target_secure_tags": [{
                "name": secure_tag_value1.id,
            }],
        },
        {
            "description": "udp rule",
            "priority": 2000,
            "enable_logging": False,
            "action": "deny",
            "direction": "INGRESS",
            "disabled": True,
            "match": {
                "src_ip_ranges": ["0.0.0.0/0"],
                "src_fqdns": [
                    "www.abc.com",
                    "www.def.com",
                ],
                "src_region_codes": [
                    "US",
                    "CA",
                ],
                "src_threat_intelligences": [
                    "iplist-known-malicious-ips",
                    "iplist-public-clouds",
                ],
                "src_address_groups": [address_group1.id],
                "src_secure_tags": [{
                    "name": secure_tag_value1.id,
                }],
                "layer4_configs": [{
                    "ip_protocol": "udp",
                }],
            },
        },
        {
            "description": "security profile group rule",
            "rule_name": "tcp rule",
            "priority": 3000,
            "enable_logging": False,
            "action": "apply_security_profile_group",
            "direction": "INGRESS",
            "target_service_accounts": ["test@google.com"],
            "security_profile_group": security_profile_group1.id.apply(lambda id: f"//networksecurity.googleapis.com/{id}"),
            "tls_inspect": True,
            "match": {
                "src_ip_ranges": ["0.0.0.0/0"],
                "layer4_configs": [{
                    "ip_protocol": "tcp",
                }],
            },
        },
        {
            "description": "network scope rule 1",
            "rule_name": "network scope 1",
            "priority": 4000,
            "enable_logging": False,
            "action": "allow",
            "direction": "INGRESS",
            "match": {
                "src_ip_ranges": ["11.100.0.1/32"],
                "src_network_scope": "VPC_NETWORKS",
                "src_networks": [network.id],
                "layer4_configs": [{
                    "ip_protocol": "tcp",
                    "ports": ["8080"],
                }],
            },
        },
        {
            "description": "network scope rule 2",
            "rule_name": "network scope 2",
            "priority": 5000,
            "enable_logging": False,
            "action": "allow",
            "direction": "EGRESS",
            "match": {
                "dest_ip_ranges": ["0.0.0.0/0"],
                "dest_network_scope": "INTERNET",
                "layer4_configs": [{
                    "ip_protocol": "tcp",
                    "ports": ["8080"],
                }],
            },
        },
    ])

    package main

import (
	"fmt"

	"github.com/pulumi/pulumi-gcp/sdk/v8/go/gcp/compute"
	"github.com/pulumi/pulumi-gcp/sdk/v8/go/gcp/networksecurity"
	"github.com/pulumi/pulumi-gcp/sdk/v8/go/gcp/organizations"
	"github.com/pulumi/pulumi-gcp/sdk/v8/go/gcp/tags"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		project, err := organizations.LookupProject(ctx, &organizations.LookupProjectArgs{}, nil)
		if err != nil {
			return err
		}
		addressGroup1, err := networksecurity.NewAddressGroup(ctx, "address_group_1", &networksecurity.AddressGroupArgs{
			Name:        pulumi.String("address-group"),
			Parent:      pulumi.String(project.Id),
			Description: pulumi.String("Global address group"),
			Location:    pulumi.String("global"),
			Items: pulumi.StringArray{
				pulumi.String("208.80.154.224/32"),
			},
			Type:     pulumi.String("IPV4"),
			Capacity: pulumi.Int(100),
		})
		if err != nil {
			return err
		}
		secureTagKey1, err := tags.NewTagKey(ctx, "secure_tag_key_1", &tags.TagKeyArgs{
			Description: pulumi.String("Tag key"),
			Parent:      pulumi.String(project.Id),
			Purpose:     pulumi.String("GCE_FIREWALL"),
			ShortName:   pulumi.String("tag-key"),
			PurposeData: pulumi.StringMap{
				"network": pulumi.Sprintf("%v/default", project.Name),
			},
		})
		if err != nil {
			return err
		}
		secureTagValue1, err := tags.NewTagValue(ctx, "secure_tag_value_1", &tags.TagValueArgs{
			Description: pulumi.String("Tag value"),
			Parent:      secureTagKey1.ID(),
			ShortName:   pulumi.String("tag-value"),
		})
		if err != nil {
			return err
		}
		securityProfile1, err := networksecurity.NewSecurityProfile(ctx, "security_profile_1", &networksecurity.SecurityProfileArgs{
			Name:     pulumi.String("sp"),
			Type:     pulumi.String("THREAT_PREVENTION"),
			Parent:   pulumi.String("organizations/123456789"),
			Location: pulumi.String("global"),
		})
		if err != nil {
			return err
		}
		securityProfileGroup1, err := networksecurity.NewSecurityProfileGroup(ctx, "security_profile_group_1", &networksecurity.SecurityProfileGroupArgs{
			Name:                    pulumi.String("spg"),
			Parent:                  pulumi.String("organizations/123456789"),
			Description:             pulumi.String("my description"),
			ThreatPreventionProfile: securityProfile1.ID(),
		})
		if err != nil {
			return err
		}
		network, err := compute.NewNetwork(ctx, "network", &compute.NetworkArgs{
			Name:                  pulumi.String("network"),
			AutoCreateSubnetworks: pulumi.Bool(false),
		})
		if err != nil {
			return err
		}
		_, err = compute.NewNetworkFirewallPolicyWithRules(ctx, "primary", &compute.NetworkFirewallPolicyWithRulesArgs{
			Name:        pulumi.String("fw-policy"),
			Description: pulumi.String("Terraform test"),
			Rules: compute.NetworkFirewallPolicyWithRulesRuleArray{
				&compute.NetworkFirewallPolicyWithRulesRuleArgs{
					Description:   pulumi.String("tcp rule"),
					Priority:      pulumi.Int(1000),
					EnableLogging: pulumi.Bool(true),
					Action:        pulumi.String("allow"),
					Direction:     pulumi.String("EGRESS"),
					Match: &compute.NetworkFirewallPolicyWithRulesRuleMatchArgs{
						DestIpRanges: pulumi.StringArray{
							pulumi.String("11.100.0.1/32"),
						},
						DestFqdns: pulumi.StringArray{
							pulumi.String("www.yyy.com"),
							pulumi.String("www.zzz.com"),
						},
						DestRegionCodes: pulumi.StringArray{
							pulumi.String("HK"),
							pulumi.String("IN"),
						},
						DestThreatIntelligences: pulumi.StringArray{
							pulumi.String("iplist-search-engines-crawlers"),
							pulumi.String("iplist-tor-exit-nodes"),
						},
						DestAddressGroups: pulumi.StringArray{
							addressGroup1.ID(),
						},
						Layer4Configs: compute.NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArray{
							&compute.NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArgs{
								IpProtocol: pulumi.String("tcp"),
								Ports: pulumi.StringArray{
									pulumi.String("8080"),
									pulumi.String("7070"),
								},
							},
						},
					},
					TargetSecureTags: compute.NetworkFirewallPolicyWithRulesRuleTargetSecureTagArray{
						&compute.NetworkFirewallPolicyWithRulesRuleTargetSecureTagArgs{
							Name: secureTagValue1.ID(),
						},
					},
				},
				&compute.NetworkFirewallPolicyWithRulesRuleArgs{
					Description:   pulumi.String("udp rule"),
					Priority:      pulumi.Int(2000),
					EnableLogging: pulumi.Bool(false),
					Action:        pulumi.String("deny"),
					Direction:     pulumi.String("INGRESS"),
					Disabled:      pulumi.Bool(true),
					Match: &compute.NetworkFirewallPolicyWithRulesRuleMatchArgs{
						SrcIpRanges: pulumi.StringArray{
							pulumi.String("0.0.0.0/0"),
						},
						SrcFqdns: pulumi.StringArray{
							pulumi.String("www.abc.com"),
							pulumi.String("www.def.com"),
						},
						SrcRegionCodes: pulumi.StringArray{
							pulumi.String("US"),
							pulumi.String("CA"),
						},
						SrcThreatIntelligences: pulumi.StringArray{
							pulumi.String("iplist-known-malicious-ips"),
							pulumi.String("iplist-public-clouds"),
						},
						SrcAddressGroups: pulumi.StringArray{
							addressGroup1.ID(),
						},
						SrcSecureTags: compute.NetworkFirewallPolicyWithRulesRuleMatchSrcSecureTagArray{
							&compute.NetworkFirewallPolicyWithRulesRuleMatchSrcSecureTagArgs{
								Name: secureTagValue1.ID(),
							},
						},
						Layer4Configs: compute.NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArray{
							&compute.NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArgs{
								IpProtocol: pulumi.String("udp"),
							},
						},
					},
				},
				&compute.NetworkFirewallPolicyWithRulesRuleArgs{
					Description:   pulumi.String("security profile group rule"),
					RuleName:      pulumi.String("tcp rule"),
					Priority:      pulumi.Int(3000),
					EnableLogging: pulumi.Bool(false),
					Action:        pulumi.String("apply_security_profile_group"),
					Direction:     pulumi.String("INGRESS"),
					TargetServiceAccounts: pulumi.StringArray{
						pulumi.String("test@google.com"),
					},
					SecurityProfileGroup: securityProfileGroup1.ID().ApplyT(func(id string) (string, error) {
						return fmt.Sprintf("//networksecurity.googleapis.com/%v", id), nil
					}).(pulumi.StringOutput),
					TlsInspect: pulumi.Bool(true),
					Match: &compute.NetworkFirewallPolicyWithRulesRuleMatchArgs{
						SrcIpRanges: pulumi.StringArray{
							pulumi.String("0.0.0.0/0"),
						},
						Layer4Configs: compute.NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArray{
							&compute.NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArgs{
								IpProtocol: pulumi.String("tcp"),
							},
						},
					},
				},
				&compute.NetworkFirewallPolicyWithRulesRuleArgs{
					Description:   pulumi.String("network scope rule 1"),
					RuleName:      pulumi.String("network scope 1"),
					Priority:      pulumi.Int(4000),
					EnableLogging: pulumi.Bool(false),
					Action:        pulumi.String("allow"),
					Direction:     pulumi.String("INGRESS"),
					Match: &compute.NetworkFirewallPolicyWithRulesRuleMatchArgs{
						SrcIpRanges: pulumi.StringArray{
							pulumi.String("11.100.0.1/32"),
						},
						SrcNetworkScope: pulumi.String("VPC_NETWORKS"),
						SrcNetworks: pulumi.StringArray{
							network.ID(),
						},
						Layer4Configs: compute.NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArray{
							&compute.NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArgs{
								IpProtocol: pulumi.String("tcp"),
								Ports: pulumi.StringArray{
									pulumi.String("8080"),
								},
							},
						},
					},
				},
				&compute.NetworkFirewallPolicyWithRulesRuleArgs{
					Description:   pulumi.String("network scope rule 2"),
					RuleName:      pulumi.String("network scope 2"),
					Priority:      pulumi.Int(5000),
					EnableLogging: pulumi.Bool(false),
					Action:        pulumi.String("allow"),
					Direction:     pulumi.String("EGRESS"),
					Match: &compute.NetworkFirewallPolicyWithRulesRuleMatchArgs{
						DestIpRanges: pulumi.StringArray{
							pulumi.String("0.0.0.0/0"),
						},
						DestNetworkScope: pulumi.String("INTERNET"),
						Layer4Configs: compute.NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArray{
							&compute.NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArgs{
								IpProtocol: pulumi.String("tcp"),
								Ports: pulumi.StringArray{
									pulumi.String("8080"),
								},
							},
						},
					},
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var project = Gcp.Organizations.GetProject.Invoke();

    var addressGroup1 = new Gcp.NetworkSecurity.AddressGroup("address_group_1", new()
    {
        Name = "address-group",
        Parent = project.Apply(getProjectResult => getProjectResult.Id),
        Description = "Global address group",
        Location = "global",
        Items = new[]
        {
            "208.80.154.224/32",
        },
        Type = "IPV4",
        Capacity = 100,
    });

    var secureTagKey1 = new Gcp.Tags.TagKey("secure_tag_key_1", new()
    {
        Description = "Tag key",
        Parent = project.Apply(getProjectResult => getProjectResult.Id),
        Purpose = "GCE_FIREWALL",
        ShortName = "tag-key",
        PurposeData = 
        {
            { "network", $"{project.Apply(getProjectResult => getProjectResult.Name)}/default" },
        },
    });

    var secureTagValue1 = new Gcp.Tags.TagValue("secure_tag_value_1", new()
    {
        Description = "Tag value",
        Parent = secureTagKey1.Id,
        ShortName = "tag-value",
    });

    var securityProfile1 = new Gcp.NetworkSecurity.SecurityProfile("security_profile_1", new()
    {
        Name = "sp",
        Type = "THREAT_PREVENTION",
        Parent = "organizations/123456789",
        Location = "global",
    });

    var securityProfileGroup1 = new Gcp.NetworkSecurity.SecurityProfileGroup("security_profile_group_1", new()
    {
        Name = "spg",
        Parent = "organizations/123456789",
        Description = "my description",
        ThreatPreventionProfile = securityProfile1.Id,
    });

    var network = new Gcp.Compute.Network("network", new()
    {
        Name = "network",
        AutoCreateSubnetworks = false,
    });

    var primary = new Gcp.Compute.NetworkFirewallPolicyWithRules("primary", new()
    {
        Name = "fw-policy",
        Description = "Terraform test",
        Rules = new[]
        {
            new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleArgs
            {
                Description = "tcp rule",
                Priority = 1000,
                EnableLogging = true,
                Action = "allow",
                Direction = "EGRESS",
                Match = new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleMatchArgs
                {
                    DestIpRanges = new[]
                    {
                        "11.100.0.1/32",
                    },
                    DestFqdns = new[]
                    {
                        "www.yyy.com",
                        "www.zzz.com",
                    },
                    DestRegionCodes = new[]
                    {
                        "HK",
                        "IN",
                    },
                    DestThreatIntelligences = new[]
                    {
                        "iplist-search-engines-crawlers",
                        "iplist-tor-exit-nodes",
                    },
                    DestAddressGroups = new[]
                    {
                        addressGroup1.Id,
                    },
                    Layer4Configs = new[]
                    {
                        new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArgs
                        {
                            IpProtocol = "tcp",
                            Ports = new[]
                            {
                                "8080",
                                "7070",
                            },
                        },
                    },
                },
                TargetSecureTags = new[]
                {
                    new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleTargetSecureTagArgs
                    {
                        Name = secureTagValue1.Id,
                    },
                },
            },
            new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleArgs
            {
                Description = "udp rule",
                Priority = 2000,
                EnableLogging = false,
                Action = "deny",
                Direction = "INGRESS",
                Disabled = true,
                Match = new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleMatchArgs
                {
                    SrcIpRanges = new[]
                    {
                        "0.0.0.0/0",
                    },
                    SrcFqdns = new[]
                    {
                        "www.abc.com",
                        "www.def.com",
                    },
                    SrcRegionCodes = new[]
                    {
                        "US",
                        "CA",
                    },
                    SrcThreatIntelligences = new[]
                    {
                        "iplist-known-malicious-ips",
                        "iplist-public-clouds",
                    },
                    SrcAddressGroups = new[]
                    {
                        addressGroup1.Id,
                    },
                    SrcSecureTags = new[]
                    {
                        new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleMatchSrcSecureTagArgs
                        {
                            Name = secureTagValue1.Id,
                        },
                    },
                    Layer4Configs = new[]
                    {
                        new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArgs
                        {
                            IpProtocol = "udp",
                        },
                    },
                },
            },
            new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleArgs
            {
                Description = "security profile group rule",
                RuleName = "tcp rule",
                Priority = 3000,
                EnableLogging = false,
                Action = "apply_security_profile_group",
                Direction = "INGRESS",
                TargetServiceAccounts = new[]
                {
                    "test@google.com",
                },
                SecurityProfileGroup = securityProfileGroup1.Id.Apply(id => $"//networksecurity.googleapis.com/{id}"),
                TlsInspect = true,
                Match = new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleMatchArgs
                {
                    SrcIpRanges = new[]
                    {
                        "0.0.0.0/0",
                    },
                    Layer4Configs = new[]
                    {
                        new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArgs
                        {
                            IpProtocol = "tcp",
                        },
                    },
                },
            },
            new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleArgs
            {
                Description = "network scope rule 1",
                RuleName = "network scope 1",
                Priority = 4000,
                EnableLogging = false,
                Action = "allow",
                Direction = "INGRESS",
                Match = new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleMatchArgs
                {
                    SrcIpRanges = new[]
                    {
                        "11.100.0.1/32",
                    },
                    SrcNetworkScope = "VPC_NETWORKS",
                    SrcNetworks = new[]
                    {
                        network.Id,
                    },
                    Layer4Configs = new[]
                    {
                        new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArgs
                        {
                            IpProtocol = "tcp",
                            Ports = new[]
                            {
                                "8080",
                            },
                        },
                    },
                },
            },
            new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleArgs
            {
                Description = "network scope rule 2",
                RuleName = "network scope 2",
                Priority = 5000,
                EnableLogging = false,
                Action = "allow",
                Direction = "EGRESS",
                Match = new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleMatchArgs
                {
                    DestIpRanges = new[]
                    {
                        "0.0.0.0/0",
                    },
                    DestNetworkScope = "INTERNET",
                    Layer4Configs = new[]
                    {
                        new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArgs
                        {
                            IpProtocol = "tcp",
                            Ports = new[]
                            {
                                "8080",
                            },
                        },
                    },
                },
            },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetProjectArgs;
import com.pulumi.gcp.networksecurity.AddressGroup;
import com.pulumi.gcp.networksecurity.AddressGroupArgs;
import com.pulumi.gcp.tags.TagKey;
import com.pulumi.gcp.tags.TagKeyArgs;
import com.pulumi.gcp.tags.TagValue;
import com.pulumi.gcp.tags.TagValueArgs;
import com.pulumi.gcp.networksecurity.SecurityProfile;
import com.pulumi.gcp.networksecurity.SecurityProfileArgs;
import com.pulumi.gcp.networksecurity.SecurityProfileGroup;
import com.pulumi.gcp.networksecurity.SecurityProfileGroupArgs;
import com.pulumi.gcp.compute.Network;
import com.pulumi.gcp.compute.NetworkArgs;
import com.pulumi.gcp.compute.NetworkFirewallPolicyWithRules;
import com.pulumi.gcp.compute.NetworkFirewallPolicyWithRulesArgs;
import com.pulumi.gcp.compute.inputs.NetworkFirewallPolicyWithRulesRuleArgs;
import com.pulumi.gcp.compute.inputs.NetworkFirewallPolicyWithRulesRuleMatchArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var project = OrganizationsFunctions.getProject();

        var addressGroup1 = new AddressGroup("addressGroup1", AddressGroupArgs.builder()
            .name("address-group")
            .parent(project.applyValue(getProjectResult -> getProjectResult.id()))
            .description("Global address group")
            .location("global")
            .items("208.80.154.224/32")
            .type("IPV4")
            .capacity(100)
            .build());

        var secureTagKey1 = new TagKey("secureTagKey1", TagKeyArgs.builder()
            .description("Tag key")
            .parent(project.applyValue(getProjectResult -> getProjectResult.id()))
            .purpose("GCE_FIREWALL")
            .shortName("tag-key")
            .purposeData(Map.of("network", String.format("%s/default", project.applyValue(getProjectResult -> getProjectResult.name()))))
            .build());

        var secureTagValue1 = new TagValue("secureTagValue1", TagValueArgs.builder()
            .description("Tag value")
            .parent(secureTagKey1.id())
            .shortName("tag-value")
            .build());

        var securityProfile1 = new SecurityProfile("securityProfile1", SecurityProfileArgs.builder()
            .name("sp")
            .type("THREAT_PREVENTION")
            .parent("organizations/123456789")
            .location("global")
            .build());

        var securityProfileGroup1 = new SecurityProfileGroup("securityProfileGroup1", SecurityProfileGroupArgs.builder()
            .name("spg")
            .parent("organizations/123456789")
            .description("my description")
            .threatPreventionProfile(securityProfile1.id())
            .build());

        var network = new Network("network", NetworkArgs.builder()
            .name("network")
            .autoCreateSubnetworks(false)
            .build());

        var primary = new NetworkFirewallPolicyWithRules("primary", NetworkFirewallPolicyWithRulesArgs.builder()
            .name("fw-policy")
            .description("Terraform test")
            .rules(            
                NetworkFirewallPolicyWithRulesRuleArgs.builder()
                    .description("tcp rule")
                    .priority(1000)
                    .enableLogging(true)
                    .action("allow")
                    .direction("EGRESS")
                    .match(NetworkFirewallPolicyWithRulesRuleMatchArgs.builder()
                        .destIpRanges("11.100.0.1/32")
                        .destFqdns(                        
                            "www.yyy.com",
                            "www.zzz.com")
                        .destRegionCodes(                        
                            "HK",
                            "IN")
                        .destThreatIntelligences(                        
                            "iplist-search-engines-crawlers",
                            "iplist-tor-exit-nodes")
                        .destAddressGroups(addressGroup1.id())
                        .layer4Configs(NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArgs.builder()
                            .ipProtocol("tcp")
                            .ports(                            
                                8080,
                                7070)
                            .build())
                        .build())
                    .targetSecureTags(NetworkFirewallPolicyWithRulesRuleTargetSecureTagArgs.builder()
                        .name(secureTagValue1.id())
                        .build())
                    .build(),
                NetworkFirewallPolicyWithRulesRuleArgs.builder()
                    .description("udp rule")
                    .priority(2000)
                    .enableLogging(false)
                    .action("deny")
                    .direction("INGRESS")
                    .disabled(true)
                    .match(NetworkFirewallPolicyWithRulesRuleMatchArgs.builder()
                        .srcIpRanges("0.0.0.0/0")
                        .srcFqdns(                        
                            "www.abc.com",
                            "www.def.com")
                        .srcRegionCodes(                        
                            "US",
                            "CA")
                        .srcThreatIntelligences(                        
                            "iplist-known-malicious-ips",
                            "iplist-public-clouds")
                        .srcAddressGroups(addressGroup1.id())
                        .srcSecureTags(NetworkFirewallPolicyWithRulesRuleMatchSrcSecureTagArgs.builder()
                            .name(secureTagValue1.id())
                            .build())
                        .layer4Configs(NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArgs.builder()
                            .ipProtocol("udp")
                            .build())
                        .build())
                    .build(),
                NetworkFirewallPolicyWithRulesRuleArgs.builder()
                    .description("security profile group rule")
                    .ruleName("tcp rule")
                    .priority(3000)
                    .enableLogging(false)
                    .action("apply_security_profile_group")
                    .direction("INGRESS")
                    .targetServiceAccounts("test@google.com")
                    .securityProfileGroup(securityProfileGroup1.id().applyValue(id -> String.format("//networksecurity.googleapis.com/%s", id)))
                    .tlsInspect(true)
                    .match(NetworkFirewallPolicyWithRulesRuleMatchArgs.builder()
                        .srcIpRanges("0.0.0.0/0")
                        .layer4Configs(NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArgs.builder()
                            .ipProtocol("tcp")
                            .build())
                        .build())
                    .build(),
                NetworkFirewallPolicyWithRulesRuleArgs.builder()
                    .description("network scope rule 1")
                    .ruleName("network scope 1")
                    .priority(4000)
                    .enableLogging(false)
                    .action("allow")
                    .direction("INGRESS")
                    .match(NetworkFirewallPolicyWithRulesRuleMatchArgs.builder()
                        .srcIpRanges("11.100.0.1/32")
                        .srcNetworkScope("VPC_NETWORKS")
                        .srcNetworks(network.id())
                        .layer4Configs(NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArgs.builder()
                            .ipProtocol("tcp")
                            .ports(8080)
                            .build())
                        .build())
                    .build(),
                NetworkFirewallPolicyWithRulesRuleArgs.builder()
                    .description("network scope rule 2")
                    .ruleName("network scope 2")
                    .priority(5000)
                    .enableLogging(false)
                    .action("allow")
                    .direction("EGRESS")
                    .match(NetworkFirewallPolicyWithRulesRuleMatchArgs.builder()
                        .destIpRanges("0.0.0.0/0")
                        .destNetworkScope("INTERNET")
                        .layer4Configs(NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArgs.builder()
                            .ipProtocol("tcp")
                            .ports(8080)
                            .build())
                        .build())
                    .build())
            .build());

    }
}

    resources:
  primary:
    type: gcp:compute:NetworkFirewallPolicyWithRules
    properties:
      name: fw-policy
      description: Terraform test
      rules:
        - description: tcp rule
          priority: 1000
          enableLogging: true
          action: allow
          direction: EGRESS
          match:
            destIpRanges:
              - 11.100.0.1/32
            destFqdns:
              - www.yyy.com
              - www.zzz.com
            destRegionCodes:
              - HK
              - IN
            destThreatIntelligences:
              - iplist-search-engines-crawlers
              - iplist-tor-exit-nodes
            destAddressGroups:
              - ${addressGroup1.id}
            layer4Configs:
              - ipProtocol: tcp
                ports:
                  - 8080
                  - 7070
          targetSecureTags:
            - name: ${secureTagValue1.id}
        - description: udp rule
          priority: 2000
          enableLogging: false
          action: deny
          direction: INGRESS
          disabled: true
          match:
            srcIpRanges:
              - 0.0.0.0/0
            srcFqdns:
              - www.abc.com
              - www.def.com
            srcRegionCodes:
              - US
              - CA
            srcThreatIntelligences:
              - iplist-known-malicious-ips
              - iplist-public-clouds
            srcAddressGroups:
              - ${addressGroup1.id}
            srcSecureTags:
              - name: ${secureTagValue1.id}
            layer4Configs:
              - ipProtocol: udp
        - description: security profile group rule
          ruleName: tcp rule
          priority: 3000
          enableLogging: false
          action: apply_security_profile_group
          direction: INGRESS
          targetServiceAccounts:
            - test@google.com
          securityProfileGroup: //networksecurity.googleapis.com/${securityProfileGroup1.id}
          tlsInspect: true
          match:
            srcIpRanges:
              - 0.0.0.0/0
            layer4Configs:
              - ipProtocol: tcp
        - description: network scope rule 1
          ruleName: network scope 1
          priority: 4000
          enableLogging: false
          action: allow
          direction: INGRESS
          match:
            srcIpRanges:
              - 11.100.0.1/32
            srcNetworkScope: VPC_NETWORKS
            srcNetworks:
              - ${network.id}
            layer4Configs:
              - ipProtocol: tcp
                ports:
                  - 8080
        - description: network scope rule 2
          ruleName: network scope 2
          priority: 5000
          enableLogging: false
          action: allow
          direction: EGRESS
          match:
            destIpRanges:
              - 0.0.0.0/0
            destNetworkScope: INTERNET
            layer4Configs:
              - ipProtocol: tcp
                ports:
                  - 8080
  addressGroup1:
    type: gcp:networksecurity:AddressGroup
    name: address_group_1
    properties:
      name: address-group
      parent: ${project.id}
      description: Global address group
      location: global
      items:
        - 208.80.154.224/32
      type: IPV4
      capacity: 100
  secureTagKey1:
    type: gcp:tags:TagKey
    name: secure_tag_key_1
    properties:
      description: Tag key
      parent: ${project.id}
      purpose: GCE_FIREWALL
      shortName: tag-key
      purposeData:
        network: ${project.name}/default
  secureTagValue1:
    type: gcp:tags:TagValue
    name: secure_tag_value_1
    properties:
      description: Tag value
      parent: ${secureTagKey1.id}
      shortName: tag-value
  securityProfileGroup1:
    type: gcp:networksecurity:SecurityProfileGroup
    name: security_profile_group_1
    properties:
      name: spg
      parent: organizations/123456789
      description: my description
      threatPreventionProfile: ${securityProfile1.id}
  securityProfile1:
    type: gcp:networksecurity:SecurityProfile
    name: security_profile_1
    properties:
      name: sp
      type: THREAT_PREVENTION
      parent: organizations/123456789
      location: global
  network:
    type: gcp:compute:Network
    properties:
      name: network
      autoCreateSubnetworks: false
variables:
  project:
    fn::invoke:
      function: gcp:organizations:getProject
      arguments: {}

    Create NetworkFirewallPolicyWithRules Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new NetworkFirewallPolicyWithRules(name: string, args: NetworkFirewallPolicyWithRulesArgs, opts?: CustomResourceOptions);
    @overload
def NetworkFirewallPolicyWithRules(resource_name: str,
                                   args: NetworkFirewallPolicyWithRulesArgs,
                                   opts: Optional[ResourceOptions] = None)

@overload
def NetworkFirewallPolicyWithRules(resource_name: str,
                                   opts: Optional[ResourceOptions] = None,
                                   rules: Optional[Sequence[NetworkFirewallPolicyWithRulesRuleArgs]] = None,
                                   description: Optional[str] = None,
                                   name: Optional[str] = None,
                                   project: Optional[str] = None)
    func NewNetworkFirewallPolicyWithRules(ctx *Context, name string, args NetworkFirewallPolicyWithRulesArgs, opts ...ResourceOption) (*NetworkFirewallPolicyWithRules, error)
    public NetworkFirewallPolicyWithRules(string name, NetworkFirewallPolicyWithRulesArgs args, CustomResourceOptions? opts = null)
    public NetworkFirewallPolicyWithRules(String name, NetworkFirewallPolicyWithRulesArgs args)
public NetworkFirewallPolicyWithRules(String name, NetworkFirewallPolicyWithRulesArgs args, CustomResourceOptions options)

    type: gcp:compute:NetworkFirewallPolicyWithRules
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args NetworkFirewallPolicyWithRulesArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args NetworkFirewallPolicyWithRulesArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args NetworkFirewallPolicyWithRulesArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args NetworkFirewallPolicyWithRulesArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args NetworkFirewallPolicyWithRulesArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var networkFirewallPolicyWithRulesResource = new Gcp.Compute.NetworkFirewallPolicyWithRules("networkFirewallPolicyWithRulesResource", new()
{
    Rules = new[]
    {
        new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleArgs
        {
            Action = "string",
            Match = new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleMatchArgs
            {
                Layer4Configs = new[]
                {
                    new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArgs
                    {
                        IpProtocol = "string",
                        Ports = new[]
                        {
                            "string",
                        },
                    },
                },
                DestNetworkScope = "string",
                SrcFqdns = new[]
                {
                    "string",
                },
                DestAddressGroups = new[]
                {
                    "string",
                },
                DestRegionCodes = new[]
                {
                    "string",
                },
                DestThreatIntelligences = new[]
                {
                    "string",
                },
                DestFqdns = new[]
                {
                    "string",
                },
                SrcAddressGroups = new[]
                {
                    "string",
                },
                DestIpRanges = new[]
                {
                    "string",
                },
                SrcIpRanges = new[]
                {
                    "string",
                },
                SrcNetworkScope = "string",
                SrcNetworks = new[]
                {
                    "string",
                },
                SrcRegionCodes = new[]
                {
                    "string",
                },
                SrcSecureTags = new[]
                {
                    new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleMatchSrcSecureTagArgs
                    {
                        Name = "string",
                        State = "string",
                    },
                },
                SrcThreatIntelligences = new[]
                {
                    "string",
                },
            },
            Priority = 0,
            Description = "string",
            Direction = "string",
            Disabled = false,
            EnableLogging = false,
            RuleName = "string",
            SecurityProfileGroup = "string",
            TargetSecureTags = new[]
            {
                new Gcp.Compute.Inputs.NetworkFirewallPolicyWithRulesRuleTargetSecureTagArgs
                {
                    Name = "string",
                    State = "string",
                },
            },
            TargetServiceAccounts = new[]
            {
                "string",
            },
            TlsInspect = false,
        },
    },
    Description = "string",
    Name = "string",
    Project = "string",
});

    example, err := compute.NewNetworkFirewallPolicyWithRules(ctx, "networkFirewallPolicyWithRulesResource", &compute.NetworkFirewallPolicyWithRulesArgs{
	Rules: compute.NetworkFirewallPolicyWithRulesRuleArray{
		&compute.NetworkFirewallPolicyWithRulesRuleArgs{
			Action: pulumi.String("string"),
			Match: &compute.NetworkFirewallPolicyWithRulesRuleMatchArgs{
				Layer4Configs: compute.NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArray{
					&compute.NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArgs{
						IpProtocol: pulumi.String("string"),
						Ports: pulumi.StringArray{
							pulumi.String("string"),
						},
					},
				},
				DestNetworkScope: pulumi.String("string"),
				SrcFqdns: pulumi.StringArray{
					pulumi.String("string"),
				},
				DestAddressGroups: pulumi.StringArray{
					pulumi.String("string"),
				},
				DestRegionCodes: pulumi.StringArray{
					pulumi.String("string"),
				},
				DestThreatIntelligences: pulumi.StringArray{
					pulumi.String("string"),
				},
				DestFqdns: pulumi.StringArray{
					pulumi.String("string"),
				},
				SrcAddressGroups: pulumi.StringArray{
					pulumi.String("string"),
				},
				DestIpRanges: pulumi.StringArray{
					pulumi.String("string"),
				},
				SrcIpRanges: pulumi.StringArray{
					pulumi.String("string"),
				},
				SrcNetworkScope: pulumi.String("string"),
				SrcNetworks: pulumi.StringArray{
					pulumi.String("string"),
				},
				SrcRegionCodes: pulumi.StringArray{
					pulumi.String("string"),
				},
				SrcSecureTags: compute.NetworkFirewallPolicyWithRulesRuleMatchSrcSecureTagArray{
					&compute.NetworkFirewallPolicyWithRulesRuleMatchSrcSecureTagArgs{
						Name:  pulumi.String("string"),
						State: pulumi.String("string"),
					},
				},
				SrcThreatIntelligences: pulumi.StringArray{
					pulumi.String("string"),
				},
			},
			Priority:             pulumi.Int(0),
			Description:          pulumi.String("string"),
			Direction:            pulumi.String("string"),
			Disabled:             pulumi.Bool(false),
			EnableLogging:        pulumi.Bool(false),
			RuleName:             pulumi.String("string"),
			SecurityProfileGroup: pulumi.String("string"),
			TargetSecureTags: compute.NetworkFirewallPolicyWithRulesRuleTargetSecureTagArray{
				&compute.NetworkFirewallPolicyWithRulesRuleTargetSecureTagArgs{
					Name:  pulumi.String("string"),
					State: pulumi.String("string"),
				},
			},
			TargetServiceAccounts: pulumi.StringArray{
				pulumi.String("string"),
			},
			TlsInspect: pulumi.Bool(false),
		},
	},
	Description: pulumi.String("string"),
	Name:        pulumi.String("string"),
	Project:     pulumi.String("string"),
})

    var networkFirewallPolicyWithRulesResource = new NetworkFirewallPolicyWithRules("networkFirewallPolicyWithRulesResource", NetworkFirewallPolicyWithRulesArgs.builder()
    .rules(NetworkFirewallPolicyWithRulesRuleArgs.builder()
        .action("string")
        .match(NetworkFirewallPolicyWithRulesRuleMatchArgs.builder()
            .layer4Configs(NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArgs.builder()
                .ipProtocol("string")
                .ports("string")
                .build())
            .destNetworkScope("string")
            .srcFqdns("string")
            .destAddressGroups("string")
            .destRegionCodes("string")
            .destThreatIntelligences("string")
            .destFqdns("string")
            .srcAddressGroups("string")
            .destIpRanges("string")
            .srcIpRanges("string")
            .srcNetworkScope("string")
            .srcNetworks("string")
            .srcRegionCodes("string")
            .srcSecureTags(NetworkFirewallPolicyWithRulesRuleMatchSrcSecureTagArgs.builder()
                .name("string")
                .state("string")
                .build())
            .srcThreatIntelligences("string")
            .build())
        .priority(0)
        .description("string")
        .direction("string")
        .disabled(false)
        .enableLogging(false)
        .ruleName("string")
        .securityProfileGroup("string")
        .targetSecureTags(NetworkFirewallPolicyWithRulesRuleTargetSecureTagArgs.builder()
            .name("string")
            .state("string")
            .build())
        .targetServiceAccounts("string")
        .tlsInspect(false)
        .build())
    .description("string")
    .name("string")
    .project("string")
    .build());

    network_firewall_policy_with_rules_resource = gcp.compute.NetworkFirewallPolicyWithRules("networkFirewallPolicyWithRulesResource",
    rules=[{
        "action": "string",
        "match": {
            "layer4_configs": [{
                "ip_protocol": "string",
                "ports": ["string"],
            }],
            "dest_network_scope": "string",
            "src_fqdns": ["string"],
            "dest_address_groups": ["string"],
            "dest_region_codes": ["string"],
            "dest_threat_intelligences": ["string"],
            "dest_fqdns": ["string"],
            "src_address_groups": ["string"],
            "dest_ip_ranges": ["string"],
            "src_ip_ranges": ["string"],
            "src_network_scope": "string",
            "src_networks": ["string"],
            "src_region_codes": ["string"],
            "src_secure_tags": [{
                "name": "string",
                "state": "string",
            }],
            "src_threat_intelligences": ["string"],
        },
        "priority": 0,
        "description": "string",
        "direction": "string",
        "disabled": False,
        "enable_logging": False,
        "rule_name": "string",
        "security_profile_group": "string",
        "target_secure_tags": [{
            "name": "string",
            "state": "string",
        }],
        "target_service_accounts": ["string"],
        "tls_inspect": False,
    }],
    description="string",
    name="string",
    project="string")

    const networkFirewallPolicyWithRulesResource = new gcp.compute.NetworkFirewallPolicyWithRules("networkFirewallPolicyWithRulesResource", {
    rules: [{
        action: "string",
        match: {
            layer4Configs: [{
                ipProtocol: "string",
                ports: ["string"],
            }],
            destNetworkScope: "string",
            srcFqdns: ["string"],
            destAddressGroups: ["string"],
            destRegionCodes: ["string"],
            destThreatIntelligences: ["string"],
            destFqdns: ["string"],
            srcAddressGroups: ["string"],
            destIpRanges: ["string"],
            srcIpRanges: ["string"],
            srcNetworkScope: "string",
            srcNetworks: ["string"],
            srcRegionCodes: ["string"],
            srcSecureTags: [{
                name: "string",
                state: "string",
            }],
            srcThreatIntelligences: ["string"],
        },
        priority: 0,
        description: "string",
        direction: "string",
        disabled: false,
        enableLogging: false,
        ruleName: "string",
        securityProfileGroup: "string",
        targetSecureTags: [{
            name: "string",
            state: "string",
        }],
        targetServiceAccounts: ["string"],
        tlsInspect: false,
    }],
    description: "string",
    name: "string",
    project: "string",
});

    type: gcp:compute:NetworkFirewallPolicyWithRules
properties:
    description: string
    name: string
    project: string
    rules:
        - action: string
          description: string
          direction: string
          disabled: false
          enableLogging: false
          match:
            destAddressGroups:
                - string
            destFqdns:
                - string
            destIpRanges:
                - string
            destNetworkScope: string
            destRegionCodes:
                - string
            destThreatIntelligences:
                - string
            layer4Configs:
                - ipProtocol: string
                  ports:
                    - string
            srcAddressGroups:
                - string
            srcFqdns:
                - string
            srcIpRanges:
                - string
            srcNetworkScope: string
            srcNetworks:
                - string
            srcRegionCodes:
                - string
            srcSecureTags:
                - name: string
                  state: string
            srcThreatIntelligences:
                - string
          priority: 0
          ruleName: string
          securityProfileGroup: string
          targetSecureTags:
            - name: string
              state: string
          targetServiceAccounts:
            - string
          tlsInspect: false

    NetworkFirewallPolicyWithRules Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The NetworkFirewallPolicyWithRules resource accepts the following input properties:

    Rules List<NetworkFirewallPolicyWithRulesRule>
    A list of firewall policy rules. Structure is documented below.
    Description string
    (Output) A description of the rule.
    Name string
    User-provided name of the Network firewall policy. The name should be unique in the project in which the firewall policy is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression a-z? which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
    Project string
    Rules []NetworkFirewallPolicyWithRulesRuleArgs
    A list of firewall policy rules. Structure is documented below.
    Description string
    (Output) A description of the rule.
    Name string
    User-provided name of the Network firewall policy. The name should be unique in the project in which the firewall policy is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression a-z? which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
    Project string
    rules List<NetworkFirewallPolicyWithRulesRule>
    A list of firewall policy rules. Structure is documented below.
    description String
    (Output) A description of the rule.
    name String
    User-provided name of the Network firewall policy. The name should be unique in the project in which the firewall policy is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression a-z? which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
    project String
    rules NetworkFirewallPolicyWithRulesRule[]
    A list of firewall policy rules. Structure is documented below.
    description string
    (Output) A description of the rule.
    name string
    User-provided name of the Network firewall policy. The name should be unique in the project in which the firewall policy is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression a-z? which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
    project string
    rules Sequence[NetworkFirewallPolicyWithRulesRuleArgs]
    A list of firewall policy rules. Structure is documented below.
    description str
    (Output) A description of the rule.
    name str
    User-provided name of the Network firewall policy. The name should be unique in the project in which the firewall policy is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression a-z? which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
    project str
    rules List<Property Map>
    A list of firewall policy rules. Structure is documented below.
    description String
    (Output) A description of the rule.
    name String
    User-provided name of the Network firewall policy. The name should be unique in the project in which the firewall policy is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression a-z? which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
    project String

    Outputs

    All input properties are implicitly available as output properties. Additionally, the NetworkFirewallPolicyWithRules resource produces the following output properties:

    CreationTimestamp string
    Creation timestamp in RFC3339 text format.
    Fingerprint string
    Fingerprint of the resource. This field is used internally during updates of this resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    NetworkFirewallPolicyId string
    The unique identifier for the resource. This identifier is defined by the server.
    PredefinedRules List<NetworkFirewallPolicyWithRulesPredefinedRule>
    A list of firewall policy pre-defined rules. Structure is documented below.
    RuleTupleCount int
    Total count of all firewall policy rule tuples. A firewall policy can not exceed a set number of tuples.
    SelfLink string
    Server-defined URL for the resource.
    SelfLinkWithId string
    Server-defined URL for this resource with the resource id.
    CreationTimestamp string
    Creation timestamp in RFC3339 text format.
    Fingerprint string
    Fingerprint of the resource. This field is used internally during updates of this resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    NetworkFirewallPolicyId string
    The unique identifier for the resource. This identifier is defined by the server.
    PredefinedRules []NetworkFirewallPolicyWithRulesPredefinedRule
    A list of firewall policy pre-defined rules. Structure is documented below.
    RuleTupleCount int
    Total count of all firewall policy rule tuples. A firewall policy can not exceed a set number of tuples.
    SelfLink string
    Server-defined URL for the resource.
    SelfLinkWithId string
    Server-defined URL for this resource with the resource id.
    creationTimestamp String
    Creation timestamp in RFC3339 text format.
    fingerprint String
    Fingerprint of the resource. This field is used internally during updates of this resource.
    id String
    The provider-assigned unique ID for this managed resource.
    networkFirewallPolicyId String
    The unique identifier for the resource. This identifier is defined by the server.
    predefinedRules List<NetworkFirewallPolicyWithRulesPredefinedRule>
    A list of firewall policy pre-defined rules. Structure is documented below.
    ruleTupleCount Integer
    Total count of all firewall policy rule tuples. A firewall policy can not exceed a set number of tuples.
    selfLink String
    Server-defined URL for the resource.
    selfLinkWithId String
    Server-defined URL for this resource with the resource id.
    creationTimestamp string
    Creation timestamp in RFC3339 text format.
    fingerprint string
    Fingerprint of the resource. This field is used internally during updates of this resource.
    id string
    The provider-assigned unique ID for this managed resource.
    networkFirewallPolicyId string
    The unique identifier for the resource. This identifier is defined by the server.
    predefinedRules NetworkFirewallPolicyWithRulesPredefinedRule[]
    A list of firewall policy pre-defined rules. Structure is documented below.
    ruleTupleCount number
    Total count of all firewall policy rule tuples. A firewall policy can not exceed a set number of tuples.
    selfLink string
    Server-defined URL for the resource.
    selfLinkWithId string
    Server-defined URL for this resource with the resource id.
    creation_timestamp str
    Creation timestamp in RFC3339 text format.
    fingerprint str
    Fingerprint of the resource. This field is used internally during updates of this resource.
    id str
    The provider-assigned unique ID for this managed resource.
    network_firewall_policy_id str
    The unique identifier for the resource. This identifier is defined by the server.
    predefined_rules Sequence[NetworkFirewallPolicyWithRulesPredefinedRule]
    A list of firewall policy pre-defined rules. Structure is documented below.
    rule_tuple_count int
    Total count of all firewall policy rule tuples. A firewall policy can not exceed a set number of tuples.
    self_link str
    Server-defined URL for the resource.
    self_link_with_id str
    Server-defined URL for this resource with the resource id.
    creationTimestamp String
    Creation timestamp in RFC3339 text format.
    fingerprint String
    Fingerprint of the resource. This field is used internally during updates of this resource.
    id String
    The provider-assigned unique ID for this managed resource.
    networkFirewallPolicyId String
    The unique identifier for the resource. This identifier is defined by the server.
    predefinedRules List<Property Map>
    A list of firewall policy pre-defined rules. Structure is documented below.
    ruleTupleCount Number
    Total count of all firewall policy rule tuples. A firewall policy can not exceed a set number of tuples.
    selfLink String
    Server-defined URL for the resource.
    selfLinkWithId String
    Server-defined URL for this resource with the resource id.

    Look up Existing NetworkFirewallPolicyWithRules Resource

    Get an existing NetworkFirewallPolicyWithRules resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: NetworkFirewallPolicyWithRulesState, opts?: CustomResourceOptions): NetworkFirewallPolicyWithRules
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        creation_timestamp: Optional[str] = None,
        description: Optional[str] = None,
        fingerprint: Optional[str] = None,
        name: Optional[str] = None,
        network_firewall_policy_id: Optional[str] = None,
        predefined_rules: Optional[Sequence[NetworkFirewallPolicyWithRulesPredefinedRuleArgs]] = None,
        project: Optional[str] = None,
        rule_tuple_count: Optional[int] = None,
        rules: Optional[Sequence[NetworkFirewallPolicyWithRulesRuleArgs]] = None,
        self_link: Optional[str] = None,
        self_link_with_id: Optional[str] = None) -> NetworkFirewallPolicyWithRules
    func GetNetworkFirewallPolicyWithRules(ctx *Context, name string, id IDInput, state *NetworkFirewallPolicyWithRulesState, opts ...ResourceOption) (*NetworkFirewallPolicyWithRules, error)
    public static NetworkFirewallPolicyWithRules Get(string name, Input<string> id, NetworkFirewallPolicyWithRulesState? state, CustomResourceOptions? opts = null)
    public static NetworkFirewallPolicyWithRules get(String name, Output<String> id, NetworkFirewallPolicyWithRulesState state, CustomResourceOptions options)
    resources:  _:    type: gcp:compute:NetworkFirewallPolicyWithRules    get:      id: ${id}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    CreationTimestamp string
    Creation timestamp in RFC3339 text format.
    Description string
    (Output) A description of the rule.
    Fingerprint string
    Fingerprint of the resource. This field is used internally during updates of this resource.
    Name string
    User-provided name of the Network firewall policy. The name should be unique in the project in which the firewall policy is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression a-z? which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
    NetworkFirewallPolicyId string
    The unique identifier for the resource. This identifier is defined by the server.
    PredefinedRules List<NetworkFirewallPolicyWithRulesPredefinedRule>
    A list of firewall policy pre-defined rules. Structure is documented below.
    Project string
    RuleTupleCount int
    Total count of all firewall policy rule tuples. A firewall policy can not exceed a set number of tuples.
    Rules List<NetworkFirewallPolicyWithRulesRule>
    A list of firewall policy rules. Structure is documented below.
    SelfLink string
    Server-defined URL for the resource.
    SelfLinkWithId string
    Server-defined URL for this resource with the resource id.
    CreationTimestamp string
    Creation timestamp in RFC3339 text format.
    Description string
    (Output) A description of the rule.
    Fingerprint string
    Fingerprint of the resource. This field is used internally during updates of this resource.
    Name string
    User-provided name of the Network firewall policy. The name should be unique in the project in which the firewall policy is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression a-z? which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
    NetworkFirewallPolicyId string
    The unique identifier for the resource. This identifier is defined by the server.
    PredefinedRules []NetworkFirewallPolicyWithRulesPredefinedRuleArgs
    A list of firewall policy pre-defined rules. Structure is documented below.
    Project string
    RuleTupleCount int
    Total count of all firewall policy rule tuples. A firewall policy can not exceed a set number of tuples.
    Rules []NetworkFirewallPolicyWithRulesRuleArgs
    A list of firewall policy rules. Structure is documented below.
    SelfLink string
    Server-defined URL for the resource.
    SelfLinkWithId string
    Server-defined URL for this resource with the resource id.
    creationTimestamp String
    Creation timestamp in RFC3339 text format.
    description String
    (Output) A description of the rule.
    fingerprint String
    Fingerprint of the resource. This field is used internally during updates of this resource.
    name String
    User-provided name of the Network firewall policy. The name should be unique in the project in which the firewall policy is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression a-z? which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
    networkFirewallPolicyId String
    The unique identifier for the resource. This identifier is defined by the server.
    predefinedRules List<NetworkFirewallPolicyWithRulesPredefinedRule>
    A list of firewall policy pre-defined rules. Structure is documented below.
    project String
    ruleTupleCount Integer
    Total count of all firewall policy rule tuples. A firewall policy can not exceed a set number of tuples.
    rules List<NetworkFirewallPolicyWithRulesRule>
    A list of firewall policy rules. Structure is documented below.
    selfLink String
    Server-defined URL for the resource.
    selfLinkWithId String
    Server-defined URL for this resource with the resource id.
    creationTimestamp string
    Creation timestamp in RFC3339 text format.
    description string
    (Output) A description of the rule.
    fingerprint string
    Fingerprint of the resource. This field is used internally during updates of this resource.
    name string
    User-provided name of the Network firewall policy. The name should be unique in the project in which the firewall policy is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression a-z? which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
    networkFirewallPolicyId string
    The unique identifier for the resource. This identifier is defined by the server.
    predefinedRules NetworkFirewallPolicyWithRulesPredefinedRule[]
    A list of firewall policy pre-defined rules. Structure is documented below.
    project string
    ruleTupleCount number
    Total count of all firewall policy rule tuples. A firewall policy can not exceed a set number of tuples.
    rules NetworkFirewallPolicyWithRulesRule[]
    A list of firewall policy rules. Structure is documented below.
    selfLink string
    Server-defined URL for the resource.
    selfLinkWithId string
    Server-defined URL for this resource with the resource id.
    creation_timestamp str
    Creation timestamp in RFC3339 text format.
    description str
    (Output) A description of the rule.
    fingerprint str
    Fingerprint of the resource. This field is used internally during updates of this resource.
    name str
    User-provided name of the Network firewall policy. The name should be unique in the project in which the firewall policy is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression a-z? which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
    network_firewall_policy_id str
    The unique identifier for the resource. This identifier is defined by the server.
    predefined_rules Sequence[NetworkFirewallPolicyWithRulesPredefinedRuleArgs]
    A list of firewall policy pre-defined rules. Structure is documented below.
    project str
    rule_tuple_count int
    Total count of all firewall policy rule tuples. A firewall policy can not exceed a set number of tuples.
    rules Sequence[NetworkFirewallPolicyWithRulesRuleArgs]
    A list of firewall policy rules. Structure is documented below.
    self_link str
    Server-defined URL for the resource.
    self_link_with_id str
    Server-defined URL for this resource with the resource id.
    creationTimestamp String
    Creation timestamp in RFC3339 text format.
    description String
    (Output) A description of the rule.
    fingerprint String
    Fingerprint of the resource. This field is used internally during updates of this resource.
    name String
    User-provided name of the Network firewall policy. The name should be unique in the project in which the firewall policy is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression a-z? which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
    networkFirewallPolicyId String
    The unique identifier for the resource. This identifier is defined by the server.
    predefinedRules List<Property Map>
    A list of firewall policy pre-defined rules. Structure is documented below.
    project String
    ruleTupleCount Number
    Total count of all firewall policy rule tuples. A firewall policy can not exceed a set number of tuples.
    rules List<Property Map>
    A list of firewall policy rules. Structure is documented below.
    selfLink String
    Server-defined URL for the resource.
    selfLinkWithId String
    Server-defined URL for this resource with the resource id.

    Supporting Types

    NetworkFirewallPolicyWithRulesPredefinedRule, NetworkFirewallPolicyWithRulesPredefinedRuleArgs

    Action string
    (Output) The Action to perform when the client connection triggers the rule. Can currently be either "allow", "deny", "apply_security_profile_group" or "goto_next".
    Description string
    (Output) A description of the rule.
    Direction string
    (Output) The direction in which this rule applies. If unspecified an INGRESS rule is created.
    Disabled bool
    (Output) Denotes whether the firewall policy rule is disabled. When set to true, the firewall policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the firewall policy rule will be enabled.
    EnableLogging bool
    (Output) Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver.
    Matches List<NetworkFirewallPolicyWithRulesPredefinedRuleMatch>
    (Output) A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
    Priority int
    (Output) An integer indicating the priority of a rule in the list. The priority must be a value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
    RuleName string
    (Output) An optional name for the rule. This field is not a unique identifier and can be updated.
    SecurityProfileGroup string
    (Output) A fully-qualified URL of a SecurityProfile resource instance. Example: https://networksecurity.googleapis.com/v1/projects/{project}/locations/{location}/securityProfileGroups/my-security-profile-group Must be specified if action is 'apply_security_profile_group'.
    TargetSecureTags List<NetworkFirewallPolicyWithRulesPredefinedRuleTargetSecureTag>
    (Output) A list of secure tags that controls which instances the firewall rule applies to. If targetSecureTag are specified, then the firewall rule applies only to instances in the VPC network that have one of those EFFECTIVE secure tags, if all the target_secure_tag are in INEFFECTIVE state, then this rule will be ignored. targetSecureTag may not be set at the same time as targetServiceAccounts. If neither targetServiceAccounts nor targetSecureTag are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label tags allowed is 256. Structure is documented below.
    TargetServiceAccounts List<string>
    (Output) A list of service accounts indicating the sets of instances that are applied with this rule.
    TlsInspect bool
    (Output) Boolean flag indicating if the traffic should be TLS decrypted. It can be set only if action = 'apply_security_profile_group' and cannot be set for other actions.
    Action string
    (Output) The Action to perform when the client connection triggers the rule. Can currently be either "allow", "deny", "apply_security_profile_group" or "goto_next".
    Description string
    (Output) A description of the rule.
    Direction string
    (Output) The direction in which this rule applies. If unspecified an INGRESS rule is created.
    Disabled bool
    (Output) Denotes whether the firewall policy rule is disabled. When set to true, the firewall policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the firewall policy rule will be enabled.
    EnableLogging bool
    (Output) Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver.
    Matches []NetworkFirewallPolicyWithRulesPredefinedRuleMatch
    (Output) A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
    Priority int
    (Output) An integer indicating the priority of a rule in the list. The priority must be a value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
    RuleName string
    (Output) An optional name for the rule. This field is not a unique identifier and can be updated.
    SecurityProfileGroup string
    (Output) A fully-qualified URL of a SecurityProfile resource instance. Example: https://networksecurity.googleapis.com/v1/projects/{project}/locations/{location}/securityProfileGroups/my-security-profile-group Must be specified if action is 'apply_security_profile_group'.
    TargetSecureTags []NetworkFirewallPolicyWithRulesPredefinedRuleTargetSecureTag
    (Output) A list of secure tags that controls which instances the firewall rule applies to. If targetSecureTag are specified, then the firewall rule applies only to instances in the VPC network that have one of those EFFECTIVE secure tags, if all the target_secure_tag are in INEFFECTIVE state, then this rule will be ignored. targetSecureTag may not be set at the same time as targetServiceAccounts. If neither targetServiceAccounts nor targetSecureTag are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label tags allowed is 256. Structure is documented below.
    TargetServiceAccounts []string
    (Output) A list of service accounts indicating the sets of instances that are applied with this rule.
    TlsInspect bool
    (Output) Boolean flag indicating if the traffic should be TLS decrypted. It can be set only if action = 'apply_security_profile_group' and cannot be set for other actions.
    action String
    (Output) The Action to perform when the client connection triggers the rule. Can currently be either "allow", "deny", "apply_security_profile_group" or "goto_next".
    description String
    (Output) A description of the rule.
    direction String
    (Output) The direction in which this rule applies. If unspecified an INGRESS rule is created.
    disabled Boolean
    (Output) Denotes whether the firewall policy rule is disabled. When set to true, the firewall policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the firewall policy rule will be enabled.
    enableLogging Boolean
    (Output) Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver.
    matches List<NetworkFirewallPolicyWithRulesPredefinedRuleMatch>
    (Output) A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
    priority Integer
    (Output) An integer indicating the priority of a rule in the list. The priority must be a value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
    ruleName String
    (Output) An optional name for the rule. This field is not a unique identifier and can be updated.
    securityProfileGroup String
    (Output) A fully-qualified URL of a SecurityProfile resource instance. Example: https://networksecurity.googleapis.com/v1/projects/{project}/locations/{location}/securityProfileGroups/my-security-profile-group Must be specified if action is 'apply_security_profile_group'.
    targetSecureTags List<NetworkFirewallPolicyWithRulesPredefinedRuleTargetSecureTag>
    (Output) A list of secure tags that controls which instances the firewall rule applies to. If targetSecureTag are specified, then the firewall rule applies only to instances in the VPC network that have one of those EFFECTIVE secure tags, if all the target_secure_tag are in INEFFECTIVE state, then this rule will be ignored. targetSecureTag may not be set at the same time as targetServiceAccounts. If neither targetServiceAccounts nor targetSecureTag are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label tags allowed is 256. Structure is documented below.
    targetServiceAccounts List<String>
    (Output) A list of service accounts indicating the sets of instances that are applied with this rule.
    tlsInspect Boolean
    (Output) Boolean flag indicating if the traffic should be TLS decrypted. It can be set only if action = 'apply_security_profile_group' and cannot be set for other actions.
    action string
    (Output) The Action to perform when the client connection triggers the rule. Can currently be either "allow", "deny", "apply_security_profile_group" or "goto_next".
    description string
    (Output) A description of the rule.
    direction string
    (Output) The direction in which this rule applies. If unspecified an INGRESS rule is created.
    disabled boolean
    (Output) Denotes whether the firewall policy rule is disabled. When set to true, the firewall policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the firewall policy rule will be enabled.
    enableLogging boolean
    (Output) Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver.
    matches NetworkFirewallPolicyWithRulesPredefinedRuleMatch[]
    (Output) A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
    priority number
    (Output) An integer indicating the priority of a rule in the list. The priority must be a value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
    ruleName string
    (Output) An optional name for the rule. This field is not a unique identifier and can be updated.
    securityProfileGroup string
    (Output) A fully-qualified URL of a SecurityProfile resource instance. Example: https://networksecurity.googleapis.com/v1/projects/{project}/locations/{location}/securityProfileGroups/my-security-profile-group Must be specified if action is 'apply_security_profile_group'.
    targetSecureTags NetworkFirewallPolicyWithRulesPredefinedRuleTargetSecureTag[]
    (Output) A list of secure tags that controls which instances the firewall rule applies to. If targetSecureTag are specified, then the firewall rule applies only to instances in the VPC network that have one of those EFFECTIVE secure tags, if all the target_secure_tag are in INEFFECTIVE state, then this rule will be ignored. targetSecureTag may not be set at the same time as targetServiceAccounts. If neither targetServiceAccounts nor targetSecureTag are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label tags allowed is 256. Structure is documented below.
    targetServiceAccounts string[]
    (Output) A list of service accounts indicating the sets of instances that are applied with this rule.
    tlsInspect boolean
    (Output) Boolean flag indicating if the traffic should be TLS decrypted. It can be set only if action = 'apply_security_profile_group' and cannot be set for other actions.
    action str
    (Output) The Action to perform when the client connection triggers the rule. Can currently be either "allow", "deny", "apply_security_profile_group" or "goto_next".
    description str
    (Output) A description of the rule.
    direction str
    (Output) The direction in which this rule applies. If unspecified an INGRESS rule is created.
    disabled bool
    (Output) Denotes whether the firewall policy rule is disabled. When set to true, the firewall policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the firewall policy rule will be enabled.
    enable_logging bool
    (Output) Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver.
    matches Sequence[NetworkFirewallPolicyWithRulesPredefinedRuleMatch]
    (Output) A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
    priority int
    (Output) An integer indicating the priority of a rule in the list. The priority must be a value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
    rule_name str
    (Output) An optional name for the rule. This field is not a unique identifier and can be updated.
    security_profile_group str
    (Output) A fully-qualified URL of a SecurityProfile resource instance. Example: https://networksecurity.googleapis.com/v1/projects/{project}/locations/{location}/securityProfileGroups/my-security-profile-group Must be specified if action is 'apply_security_profile_group'.
    target_secure_tags Sequence[NetworkFirewallPolicyWithRulesPredefinedRuleTargetSecureTag]
    (Output) A list of secure tags that controls which instances the firewall rule applies to. If targetSecureTag are specified, then the firewall rule applies only to instances in the VPC network that have one of those EFFECTIVE secure tags, if all the target_secure_tag are in INEFFECTIVE state, then this rule will be ignored. targetSecureTag may not be set at the same time as targetServiceAccounts. If neither targetServiceAccounts nor targetSecureTag are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label tags allowed is 256. Structure is documented below.
    target_service_accounts Sequence[str]
    (Output) A list of service accounts indicating the sets of instances that are applied with this rule.
    tls_inspect bool
    (Output) Boolean flag indicating if the traffic should be TLS decrypted. It can be set only if action = 'apply_security_profile_group' and cannot be set for other actions.
    action String
    (Output) The Action to perform when the client connection triggers the rule. Can currently be either "allow", "deny", "apply_security_profile_group" or "goto_next".
    description String
    (Output) A description of the rule.
    direction String
    (Output) The direction in which this rule applies. If unspecified an INGRESS rule is created.
    disabled Boolean
    (Output) Denotes whether the firewall policy rule is disabled. When set to true, the firewall policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the firewall policy rule will be enabled.
    enableLogging Boolean
    (Output) Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver.
    matches List<Property Map>
    (Output) A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
    priority Number
    (Output) An integer indicating the priority of a rule in the list. The priority must be a value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
    ruleName String
    (Output) An optional name for the rule. This field is not a unique identifier and can be updated.
    securityProfileGroup String
    (Output) A fully-qualified URL of a SecurityProfile resource instance. Example: https://networksecurity.googleapis.com/v1/projects/{project}/locations/{location}/securityProfileGroups/my-security-profile-group Must be specified if action is 'apply_security_profile_group'.
    targetSecureTags List<Property Map>
    (Output) A list of secure tags that controls which instances the firewall rule applies to. If targetSecureTag are specified, then the firewall rule applies only to instances in the VPC network that have one of those EFFECTIVE secure tags, if all the target_secure_tag are in INEFFECTIVE state, then this rule will be ignored. targetSecureTag may not be set at the same time as targetServiceAccounts. If neither targetServiceAccounts nor targetSecureTag are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label tags allowed is 256. Structure is documented below.
    targetServiceAccounts List<String>
    (Output) A list of service accounts indicating the sets of instances that are applied with this rule.
    tlsInspect Boolean
    (Output) Boolean flag indicating if the traffic should be TLS decrypted. It can be set only if action = 'apply_security_profile_group' and cannot be set for other actions.

    NetworkFirewallPolicyWithRulesPredefinedRuleMatch, NetworkFirewallPolicyWithRulesPredefinedRuleMatchArgs

    DestAddressGroups List<string>
    Address groups which should be matched against the traffic destination. Maximum number of destination address groups is 10.
    DestFqdns List<string>
    Fully Qualified Domain Name (FQDN) which should be matched against traffic destination. Maximum number of destination fqdn allowed is 100.
    DestIpRanges List<string>
    Destination IP address range in CIDR format. Required for EGRESS rules.
    DestRegionCodes List<string>
    Region codes whose IP addresses will be used to match for destination of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of destination region codes allowed is 5000.
    DestThreatIntelligences List<string>
    Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic destination.
    Layer4Configs List<NetworkFirewallPolicyWithRulesPredefinedRuleMatchLayer4Config>
    Pairs of IP protocols and ports that the rule should match. Structure is documented below.
    SrcAddressGroups List<string>
    Address groups which should be matched against the traffic source. Maximum number of source address groups is 10.
    SrcFqdns List<string>
    Fully Qualified Domain Name (FQDN) which should be matched against traffic source. Maximum number of source fqdn allowed is 100.
    SrcIpRanges List<string>
    Source IP address range in CIDR format. Required for INGRESS rules.
    SrcRegionCodes List<string>
    Region codes whose IP addresses will be used to match for source of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of source region codes allowed is 5000.
    SrcSecureTags List<NetworkFirewallPolicyWithRulesPredefinedRuleMatchSrcSecureTag>

    List of secure tag values, which should be matched at the source of the traffic. For INGRESS rule, if all the srcSecureTag are INEFFECTIVE, and there is no srcIpRange, this rule will be ignored. Maximum number of source tag values allowed is 256. Structure is documented below.

    The layer4_config block supports:

    SrcThreatIntelligences List<string>
    Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic source.
    DestAddressGroups []string
    Address groups which should be matched against the traffic destination. Maximum number of destination address groups is 10.
    DestFqdns []string
    Fully Qualified Domain Name (FQDN) which should be matched against traffic destination. Maximum number of destination fqdn allowed is 100.
    DestIpRanges []string
    Destination IP address range in CIDR format. Required for EGRESS rules.
    DestRegionCodes []string
    Region codes whose IP addresses will be used to match for destination of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of destination region codes allowed is 5000.
    DestThreatIntelligences []string
    Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic destination.
    Layer4Configs []NetworkFirewallPolicyWithRulesPredefinedRuleMatchLayer4Config
    Pairs of IP protocols and ports that the rule should match. Structure is documented below.
    SrcAddressGroups []string
    Address groups which should be matched against the traffic source. Maximum number of source address groups is 10.
    SrcFqdns []string
    Fully Qualified Domain Name (FQDN) which should be matched against traffic source. Maximum number of source fqdn allowed is 100.
    SrcIpRanges []string
    Source IP address range in CIDR format. Required for INGRESS rules.
    SrcRegionCodes []string
    Region codes whose IP addresses will be used to match for source of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of source region codes allowed is 5000.
    SrcSecureTags []NetworkFirewallPolicyWithRulesPredefinedRuleMatchSrcSecureTag

    List of secure tag values, which should be matched at the source of the traffic. For INGRESS rule, if all the srcSecureTag are INEFFECTIVE, and there is no srcIpRange, this rule will be ignored. Maximum number of source tag values allowed is 256. Structure is documented below.

    The layer4_config block supports:

    SrcThreatIntelligences []string
    Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic source.
    destAddressGroups List<String>
    Address groups which should be matched against the traffic destination. Maximum number of destination address groups is 10.
    destFqdns List<String>
    Fully Qualified Domain Name (FQDN) which should be matched against traffic destination. Maximum number of destination fqdn allowed is 100.
    destIpRanges List<String>
    Destination IP address range in CIDR format. Required for EGRESS rules.
    destRegionCodes List<String>
    Region codes whose IP addresses will be used to match for destination of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of destination region codes allowed is 5000.
    destThreatIntelligences List<String>
    Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic destination.
    layer4Configs List<NetworkFirewallPolicyWithRulesPredefinedRuleMatchLayer4Config>
    Pairs of IP protocols and ports that the rule should match. Structure is documented below.
    srcAddressGroups List<String>
    Address groups which should be matched against the traffic source. Maximum number of source address groups is 10.
    srcFqdns List<String>
    Fully Qualified Domain Name (FQDN) which should be matched against traffic source. Maximum number of source fqdn allowed is 100.
    srcIpRanges List<String>
    Source IP address range in CIDR format. Required for INGRESS rules.
    srcRegionCodes List<String>
    Region codes whose IP addresses will be used to match for source of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of source region codes allowed is 5000.
    srcSecureTags List<NetworkFirewallPolicyWithRulesPredefinedRuleMatchSrcSecureTag>

    List of secure tag values, which should be matched at the source of the traffic. For INGRESS rule, if all the srcSecureTag are INEFFECTIVE, and there is no srcIpRange, this rule will be ignored. Maximum number of source tag values allowed is 256. Structure is documented below.

    The layer4_config block supports:

    srcThreatIntelligences List<String>
    Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic source.
    destAddressGroups string[]
    Address groups which should be matched against the traffic destination. Maximum number of destination address groups is 10.
    destFqdns string[]
    Fully Qualified Domain Name (FQDN) which should be matched against traffic destination. Maximum number of destination fqdn allowed is 100.
    destIpRanges string[]
    Destination IP address range in CIDR format. Required for EGRESS rules.
    destRegionCodes string[]
    Region codes whose IP addresses will be used to match for destination of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of destination region codes allowed is 5000.
    destThreatIntelligences string[]
    Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic destination.
    layer4Configs NetworkFirewallPolicyWithRulesPredefinedRuleMatchLayer4Config[]
    Pairs of IP protocols and ports that the rule should match. Structure is documented below.
    srcAddressGroups string[]
    Address groups which should be matched against the traffic source. Maximum number of source address groups is 10.
    srcFqdns string[]
    Fully Qualified Domain Name (FQDN) which should be matched against traffic source. Maximum number of source fqdn allowed is 100.
    srcIpRanges string[]
    Source IP address range in CIDR format. Required for INGRESS rules.
    srcRegionCodes string[]
    Region codes whose IP addresses will be used to match for source of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of source region codes allowed is 5000.
    srcSecureTags NetworkFirewallPolicyWithRulesPredefinedRuleMatchSrcSecureTag[]

    List of secure tag values, which should be matched at the source of the traffic. For INGRESS rule, if all the srcSecureTag are INEFFECTIVE, and there is no srcIpRange, this rule will be ignored. Maximum number of source tag values allowed is 256. Structure is documented below.

    The layer4_config block supports:

    srcThreatIntelligences string[]
    Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic source.
    dest_address_groups Sequence[str]
    Address groups which should be matched against the traffic destination. Maximum number of destination address groups is 10.
    dest_fqdns Sequence[str]
    Fully Qualified Domain Name (FQDN) which should be matched against traffic destination. Maximum number of destination fqdn allowed is 100.
    dest_ip_ranges Sequence[str]
    Destination IP address range in CIDR format. Required for EGRESS rules.
    dest_region_codes Sequence[str]
    Region codes whose IP addresses will be used to match for destination of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of destination region codes allowed is 5000.
    dest_threat_intelligences Sequence[str]
    Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic destination.
    layer4_configs Sequence[NetworkFirewallPolicyWithRulesPredefinedRuleMatchLayer4Config]
    Pairs of IP protocols and ports that the rule should match. Structure is documented below.
    src_address_groups Sequence[str]
    Address groups which should be matched against the traffic source. Maximum number of source address groups is 10.
    src_fqdns Sequence[str]
    Fully Qualified Domain Name (FQDN) which should be matched against traffic source. Maximum number of source fqdn allowed is 100.
    src_ip_ranges Sequence[str]
    Source IP address range in CIDR format. Required for INGRESS rules.
    src_region_codes Sequence[str]
    Region codes whose IP addresses will be used to match for source of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of source region codes allowed is 5000.
    src_secure_tags Sequence[NetworkFirewallPolicyWithRulesPredefinedRuleMatchSrcSecureTag]

    List of secure tag values, which should be matched at the source of the traffic. For INGRESS rule, if all the srcSecureTag are INEFFECTIVE, and there is no srcIpRange, this rule will be ignored. Maximum number of source tag values allowed is 256. Structure is documented below.

    The layer4_config block supports:

    src_threat_intelligences Sequence[str]
    Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic source.
    destAddressGroups List<String>
    Address groups which should be matched against the traffic destination. Maximum number of destination address groups is 10.
    destFqdns List<String>
    Fully Qualified Domain Name (FQDN) which should be matched against traffic destination. Maximum number of destination fqdn allowed is 100.
    destIpRanges List<String>
    Destination IP address range in CIDR format. Required for EGRESS rules.
    destRegionCodes List<String>
    Region codes whose IP addresses will be used to match for destination of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of destination region codes allowed is 5000.
    destThreatIntelligences List<String>
    Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic destination.
    layer4Configs List<Property Map>
    Pairs of IP protocols and ports that the rule should match. Structure is documented below.
    srcAddressGroups List<String>
    Address groups which should be matched against the traffic source. Maximum number of source address groups is 10.
    srcFqdns List<String>
    Fully Qualified Domain Name (FQDN) which should be matched against traffic source. Maximum number of source fqdn allowed is 100.
    srcIpRanges List<String>
    Source IP address range in CIDR format. Required for INGRESS rules.
    srcRegionCodes List<String>
    Region codes whose IP addresses will be used to match for source of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of source region codes allowed is 5000.
    srcSecureTags List<Property Map>

    List of secure tag values, which should be matched at the source of the traffic. For INGRESS rule, if all the srcSecureTag are INEFFECTIVE, and there is no srcIpRange, this rule will be ignored. Maximum number of source tag values allowed is 256. Structure is documented below.

    The layer4_config block supports:

    srcThreatIntelligences List<String>
    Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic source.

    NetworkFirewallPolicyWithRulesPredefinedRuleMatchLayer4Config, NetworkFirewallPolicyWithRulesPredefinedRuleMatchLayer4ConfigArgs

    IpProtocol string
    (Output) The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
    Ports List<string>
    (Output) An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].
    IpProtocol string
    (Output) The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
    Ports []string
    (Output) An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].
    ipProtocol String
    (Output) The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
    ports List<String>
    (Output) An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].
    ipProtocol string
    (Output) The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
    ports string[]
    (Output) An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].
    ip_protocol str
    (Output) The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
    ports Sequence[str]
    (Output) An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].
    ipProtocol String
    (Output) The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
    ports List<String>
    (Output) An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].

    NetworkFirewallPolicyWithRulesPredefinedRuleMatchSrcSecureTag, NetworkFirewallPolicyWithRulesPredefinedRuleMatchSrcSecureTagArgs

    Name string
    Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
    State string
    (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.
    Name string
    Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
    State string
    (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.
    name String
    Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
    state String
    (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.
    name string
    Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
    state string
    (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.
    name str
    Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
    state str
    (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.
    name String
    Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
    state String
    (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.

    NetworkFirewallPolicyWithRulesPredefinedRuleTargetSecureTag, NetworkFirewallPolicyWithRulesPredefinedRuleTargetSecureTagArgs

    Name string
    Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
    State string
    (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.

    Name string
    Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
    State string
    (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.

    name String
    Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
    state String
    (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.

    name string
    Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
    state string
    (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.

    name str
    Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
    state str
    (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.

    name String
    Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
    state String
    (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.

    NetworkFirewallPolicyWithRulesRule, NetworkFirewallPolicyWithRulesRuleArgs

    Action string
    The Action to perform when the client connection triggers the rule. Can currently be either "allow", "deny", "apply_security_profile_group" or "goto_next".
    Match NetworkFirewallPolicyWithRulesRuleMatch
    A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
    Priority int
    An integer indicating the priority of a rule in the list. The priority must be a value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
    Description string
    A description of the rule.
    Direction string
    The direction in which this rule applies. If unspecified an INGRESS rule is created. Possible values are: INGRESS, EGRESS.
    Disabled bool
    Denotes whether the firewall policy rule is disabled. When set to true, the firewall policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the firewall policy rule will be enabled.
    EnableLogging bool
    Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver.
    RuleName string
    An optional name for the rule. This field is not a unique identifier and can be updated.
    SecurityProfileGroup string
    A fully-qualified URL of a SecurityProfile resource instance. Example: https://networksecurity.googleapis.com/v1/projects/{project}/locations/{location}/securityProfileGroups/my-security-profile-group Must be specified if action is 'apply_security_profile_group'.
    TargetSecureTags List<NetworkFirewallPolicyWithRulesRuleTargetSecureTag>
    A list of secure tags that controls which instances the firewall rule applies to. If targetSecureTag are specified, then the firewall rule applies only to instances in the VPC network that have one of those EFFECTIVE secure tags, if all the target_secure_tag are in INEFFECTIVE state, then this rule will be ignored. targetSecureTag may not be set at the same time as targetServiceAccounts. If neither targetServiceAccounts nor targetSecureTag are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label tags allowed is 256. Structure is documented below.
    TargetServiceAccounts List<string>
    A list of service accounts indicating the sets of instances that are applied with this rule.
    TlsInspect bool
    Boolean flag indicating if the traffic should be TLS decrypted. It can be set only if action = 'apply_security_profile_group' and cannot be set for other actions.
    Action string
    The Action to perform when the client connection triggers the rule. Can currently be either "allow", "deny", "apply_security_profile_group" or "goto_next".
    Match NetworkFirewallPolicyWithRulesRuleMatch
    A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
    Priority int
    An integer indicating the priority of a rule in the list. The priority must be a value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
    Description string
    A description of the rule.
    Direction string
    The direction in which this rule applies. If unspecified an INGRESS rule is created. Possible values are: INGRESS, EGRESS.
    Disabled bool
    Denotes whether the firewall policy rule is disabled. When set to true, the firewall policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the firewall policy rule will be enabled.
    EnableLogging bool
    Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver.
    RuleName string
    An optional name for the rule. This field is not a unique identifier and can be updated.
    SecurityProfileGroup string
    A fully-qualified URL of a SecurityProfile resource instance. Example: https://networksecurity.googleapis.com/v1/projects/{project}/locations/{location}/securityProfileGroups/my-security-profile-group Must be specified if action is 'apply_security_profile_group'.
    TargetSecureTags []NetworkFirewallPolicyWithRulesRuleTargetSecureTag
    A list of secure tags that controls which instances the firewall rule applies to. If targetSecureTag are specified, then the firewall rule applies only to instances in the VPC network that have one of those EFFECTIVE secure tags, if all the target_secure_tag are in INEFFECTIVE state, then this rule will be ignored. targetSecureTag may not be set at the same time as targetServiceAccounts. If neither targetServiceAccounts nor targetSecureTag are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label tags allowed is 256. Structure is documented below.
    TargetServiceAccounts []string
    A list of service accounts indicating the sets of instances that are applied with this rule.
    TlsInspect bool
    Boolean flag indicating if the traffic should be TLS decrypted. It can be set only if action = 'apply_security_profile_group' and cannot be set for other actions.
    action String
    The Action to perform when the client connection triggers the rule. Can currently be either "allow", "deny", "apply_security_profile_group" or "goto_next".
    match NetworkFirewallPolicyWithRulesRuleMatch
    A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
    priority Integer
    An integer indicating the priority of a rule in the list. The priority must be a value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
    description String
    A description of the rule.
    direction String
    The direction in which this rule applies. If unspecified an INGRESS rule is created. Possible values are: INGRESS, EGRESS.
    disabled Boolean
    Denotes whether the firewall policy rule is disabled. When set to true, the firewall policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the firewall policy rule will be enabled.
    enableLogging Boolean
    Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver.
    ruleName String
    An optional name for the rule. This field is not a unique identifier and can be updated.
    securityProfileGroup String
    A fully-qualified URL of a SecurityProfile resource instance. Example: https://networksecurity.googleapis.com/v1/projects/{project}/locations/{location}/securityProfileGroups/my-security-profile-group Must be specified if action is 'apply_security_profile_group'.
    targetSecureTags List<NetworkFirewallPolicyWithRulesRuleTargetSecureTag>
    A list of secure tags that controls which instances the firewall rule applies to. If targetSecureTag are specified, then the firewall rule applies only to instances in the VPC network that have one of those EFFECTIVE secure tags, if all the target_secure_tag are in INEFFECTIVE state, then this rule will be ignored. targetSecureTag may not be set at the same time as targetServiceAccounts. If neither targetServiceAccounts nor targetSecureTag are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label tags allowed is 256. Structure is documented below.
    targetServiceAccounts List<String>
    A list of service accounts indicating the sets of instances that are applied with this rule.
    tlsInspect Boolean
    Boolean flag indicating if the traffic should be TLS decrypted. It can be set only if action = 'apply_security_profile_group' and cannot be set for other actions.
    action string
    The Action to perform when the client connection triggers the rule. Can currently be either "allow", "deny", "apply_security_profile_group" or "goto_next".
    match NetworkFirewallPolicyWithRulesRuleMatch
    A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
    priority number
    An integer indicating the priority of a rule in the list. The priority must be a value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
    description string
    A description of the rule.
    direction string
    The direction in which this rule applies. If unspecified an INGRESS rule is created. Possible values are: INGRESS, EGRESS.
    disabled boolean
    Denotes whether the firewall policy rule is disabled. When set to true, the firewall policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the firewall policy rule will be enabled.
    enableLogging boolean
    Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver.
    ruleName string
    An optional name for the rule. This field is not a unique identifier and can be updated.
    securityProfileGroup string
    A fully-qualified URL of a SecurityProfile resource instance. Example: https://networksecurity.googleapis.com/v1/projects/{project}/locations/{location}/securityProfileGroups/my-security-profile-group Must be specified if action is 'apply_security_profile_group'.
    targetSecureTags NetworkFirewallPolicyWithRulesRuleTargetSecureTag[]
    A list of secure tags that controls which instances the firewall rule applies to. If targetSecureTag are specified, then the firewall rule applies only to instances in the VPC network that have one of those EFFECTIVE secure tags, if all the target_secure_tag are in INEFFECTIVE state, then this rule will be ignored. targetSecureTag may not be set at the same time as targetServiceAccounts. If neither targetServiceAccounts nor targetSecureTag are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label tags allowed is 256. Structure is documented below.
    targetServiceAccounts string[]
    A list of service accounts indicating the sets of instances that are applied with this rule.
    tlsInspect boolean
    Boolean flag indicating if the traffic should be TLS decrypted. It can be set only if action = 'apply_security_profile_group' and cannot be set for other actions.
    action str
    The Action to perform when the client connection triggers the rule. Can currently be either "allow", "deny", "apply_security_profile_group" or "goto_next".
    match NetworkFirewallPolicyWithRulesRuleMatch
    A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
    priority int
    An integer indicating the priority of a rule in the list. The priority must be a value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
    description str
    A description of the rule.
    direction str
    The direction in which this rule applies. If unspecified an INGRESS rule is created. Possible values are: INGRESS, EGRESS.
    disabled bool
    Denotes whether the firewall policy rule is disabled. When set to true, the firewall policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the firewall policy rule will be enabled.
    enable_logging bool
    Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver.
    rule_name str
    An optional name for the rule. This field is not a unique identifier and can be updated.
    security_profile_group str
    A fully-qualified URL of a SecurityProfile resource instance. Example: https://networksecurity.googleapis.com/v1/projects/{project}/locations/{location}/securityProfileGroups/my-security-profile-group Must be specified if action is 'apply_security_profile_group'.
    target_secure_tags Sequence[NetworkFirewallPolicyWithRulesRuleTargetSecureTag]
    A list of secure tags that controls which instances the firewall rule applies to. If targetSecureTag are specified, then the firewall rule applies only to instances in the VPC network that have one of those EFFECTIVE secure tags, if all the target_secure_tag are in INEFFECTIVE state, then this rule will be ignored. targetSecureTag may not be set at the same time as targetServiceAccounts. If neither targetServiceAccounts nor targetSecureTag are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label tags allowed is 256. Structure is documented below.
    target_service_accounts Sequence[str]
    A list of service accounts indicating the sets of instances that are applied with this rule.
    tls_inspect bool
    Boolean flag indicating if the traffic should be TLS decrypted. It can be set only if action = 'apply_security_profile_group' and cannot be set for other actions.
    action String
    The Action to perform when the client connection triggers the rule. Can currently be either "allow", "deny", "apply_security_profile_group" or "goto_next".
    match Property Map
    A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. Structure is documented below.
    priority Number
    An integer indicating the priority of a rule in the list. The priority must be a value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
    description String
    A description of the rule.
    direction String
    The direction in which this rule applies. If unspecified an INGRESS rule is created. Possible values are: INGRESS, EGRESS.
    disabled Boolean
    Denotes whether the firewall policy rule is disabled. When set to true, the firewall policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the firewall policy rule will be enabled.
    enableLogging Boolean
    Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver.
    ruleName String
    An optional name for the rule. This field is not a unique identifier and can be updated.
    securityProfileGroup String
    A fully-qualified URL of a SecurityProfile resource instance. Example: https://networksecurity.googleapis.com/v1/projects/{project}/locations/{location}/securityProfileGroups/my-security-profile-group Must be specified if action is 'apply_security_profile_group'.
    targetSecureTags List<Property Map>
    A list of secure tags that controls which instances the firewall rule applies to. If targetSecureTag are specified, then the firewall rule applies only to instances in the VPC network that have one of those EFFECTIVE secure tags, if all the target_secure_tag are in INEFFECTIVE state, then this rule will be ignored. targetSecureTag may not be set at the same time as targetServiceAccounts. If neither targetServiceAccounts nor targetSecureTag are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label tags allowed is 256. Structure is documented below.
    targetServiceAccounts List<String>
    A list of service accounts indicating the sets of instances that are applied with this rule.
    tlsInspect Boolean
    Boolean flag indicating if the traffic should be TLS decrypted. It can be set only if action = 'apply_security_profile_group' and cannot be set for other actions.

    NetworkFirewallPolicyWithRulesRuleMatch, NetworkFirewallPolicyWithRulesRuleMatchArgs

    Layer4Configs List<NetworkFirewallPolicyWithRulesRuleMatchLayer4Config>
    Pairs of IP protocols and ports that the rule should match. Structure is documented below.
    DestAddressGroups List<string>
    Address groups which should be matched against the traffic destination. Maximum number of destination address groups is 10.
    DestFqdns List<string>
    Fully Qualified Domain Name (FQDN) which should be matched against traffic destination. Maximum number of destination fqdn allowed is 100.
    DestIpRanges List<string>
    Destination IP address range in CIDR format. Required for EGRESS rules.
    DestNetworkScope string
    Network scope of the traffic destination. Possible values are: INTERNET, INTRA_VPC, NON_INTERNET, VPC_NETWORKS.
    DestRegionCodes List<string>
    Region codes whose IP addresses will be used to match for destination of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of destination region codes allowed is 5000.
    DestThreatIntelligences List<string>
    Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic destination.
    SrcAddressGroups List<string>
    Address groups which should be matched against the traffic source. Maximum number of source address groups is 10.
    SrcFqdns List<string>
    Fully Qualified Domain Name (FQDN) which should be matched against traffic source. Maximum number of source fqdn allowed is 100.
    SrcIpRanges List<string>
    Source IP address range in CIDR format. Required for INGRESS rules.
    SrcNetworkScope string
    Network scope of the traffic source. Possible values are: INTERNET, INTRA_VPC, NON_INTERNET, VPC_NETWORKS.
    SrcNetworks List<string>
    Networks of the traffic source. It can be either a full or partial url.
    SrcRegionCodes List<string>
    Region codes whose IP addresses will be used to match for source of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of source region codes allowed is 5000.
    SrcSecureTags List<NetworkFirewallPolicyWithRulesRuleMatchSrcSecureTag>

    List of secure tag values, which should be matched at the source of the traffic. For INGRESS rule, if all the srcSecureTag are INEFFECTIVE, and there is no srcIpRange, this rule will be ignored. Maximum number of source tag values allowed is 256. Structure is documented below.

    The layer4_config block supports:

    SrcThreatIntelligences List<string>
    Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic source.
    Layer4Configs []NetworkFirewallPolicyWithRulesRuleMatchLayer4Config
    Pairs of IP protocols and ports that the rule should match. Structure is documented below.
    DestAddressGroups []string
    Address groups which should be matched against the traffic destination. Maximum number of destination address groups is 10.
    DestFqdns []string
    Fully Qualified Domain Name (FQDN) which should be matched against traffic destination. Maximum number of destination fqdn allowed is 100.
    DestIpRanges []string
    Destination IP address range in CIDR format. Required for EGRESS rules.
    DestNetworkScope string
    Network scope of the traffic destination. Possible values are: INTERNET, INTRA_VPC, NON_INTERNET, VPC_NETWORKS.
    DestRegionCodes []string
    Region codes whose IP addresses will be used to match for destination of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of destination region codes allowed is 5000.
    DestThreatIntelligences []string
    Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic destination.
    SrcAddressGroups []string
    Address groups which should be matched against the traffic source. Maximum number of source address groups is 10.
    SrcFqdns []string
    Fully Qualified Domain Name (FQDN) which should be matched against traffic source. Maximum number of source fqdn allowed is 100.
    SrcIpRanges []string
    Source IP address range in CIDR format. Required for INGRESS rules.
    SrcNetworkScope string
    Network scope of the traffic source. Possible values are: INTERNET, INTRA_VPC, NON_INTERNET, VPC_NETWORKS.
    SrcNetworks []string
    Networks of the traffic source. It can be either a full or partial url.
    SrcRegionCodes []string
    Region codes whose IP addresses will be used to match for source of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of source region codes allowed is 5000.
    SrcSecureTags []NetworkFirewallPolicyWithRulesRuleMatchSrcSecureTag

    List of secure tag values, which should be matched at the source of the traffic. For INGRESS rule, if all the srcSecureTag are INEFFECTIVE, and there is no srcIpRange, this rule will be ignored. Maximum number of source tag values allowed is 256. Structure is documented below.

    The layer4_config block supports:

    SrcThreatIntelligences []string
    Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic source.
    layer4Configs List<NetworkFirewallPolicyWithRulesRuleMatchLayer4Config>
    Pairs of IP protocols and ports that the rule should match. Structure is documented below.
    destAddressGroups List<String>
    Address groups which should be matched against the traffic destination. Maximum number of destination address groups is 10.
    destFqdns List<String>
    Fully Qualified Domain Name (FQDN) which should be matched against traffic destination. Maximum number of destination fqdn allowed is 100.
    destIpRanges List<String>
    Destination IP address range in CIDR format. Required for EGRESS rules.
    destNetworkScope String
    Network scope of the traffic destination. Possible values are: INTERNET, INTRA_VPC, NON_INTERNET, VPC_NETWORKS.
    destRegionCodes List<String>
    Region codes whose IP addresses will be used to match for destination of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of destination region codes allowed is 5000.
    destThreatIntelligences List<String>
    Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic destination.
    srcAddressGroups List<String>
    Address groups which should be matched against the traffic source. Maximum number of source address groups is 10.
    srcFqdns List<String>
    Fully Qualified Domain Name (FQDN) which should be matched against traffic source. Maximum number of source fqdn allowed is 100.
    srcIpRanges List<String>
    Source IP address range in CIDR format. Required for INGRESS rules.
    srcNetworkScope String
    Network scope of the traffic source. Possible values are: INTERNET, INTRA_VPC, NON_INTERNET, VPC_NETWORKS.
    srcNetworks List<String>
    Networks of the traffic source. It can be either a full or partial url.
    srcRegionCodes List<String>
    Region codes whose IP addresses will be used to match for source of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of source region codes allowed is 5000.
    srcSecureTags List<NetworkFirewallPolicyWithRulesRuleMatchSrcSecureTag>

    List of secure tag values, which should be matched at the source of the traffic. For INGRESS rule, if all the srcSecureTag are INEFFECTIVE, and there is no srcIpRange, this rule will be ignored. Maximum number of source tag values allowed is 256. Structure is documented below.

    The layer4_config block supports:

    srcThreatIntelligences List<String>
    Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic source.
    layer4Configs NetworkFirewallPolicyWithRulesRuleMatchLayer4Config[]
    Pairs of IP protocols and ports that the rule should match. Structure is documented below.
    destAddressGroups string[]
    Address groups which should be matched against the traffic destination. Maximum number of destination address groups is 10.
    destFqdns string[]
    Fully Qualified Domain Name (FQDN) which should be matched against traffic destination. Maximum number of destination fqdn allowed is 100.
    destIpRanges string[]
    Destination IP address range in CIDR format. Required for EGRESS rules.
    destNetworkScope string
    Network scope of the traffic destination. Possible values are: INTERNET, INTRA_VPC, NON_INTERNET, VPC_NETWORKS.
    destRegionCodes string[]
    Region codes whose IP addresses will be used to match for destination of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of destination region codes allowed is 5000.
    destThreatIntelligences string[]
    Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic destination.
    srcAddressGroups string[]
    Address groups which should be matched against the traffic source. Maximum number of source address groups is 10.
    srcFqdns string[]
    Fully Qualified Domain Name (FQDN) which should be matched against traffic source. Maximum number of source fqdn allowed is 100.
    srcIpRanges string[]
    Source IP address range in CIDR format. Required for INGRESS rules.
    srcNetworkScope string
    Network scope of the traffic source. Possible values are: INTERNET, INTRA_VPC, NON_INTERNET, VPC_NETWORKS.
    srcNetworks string[]
    Networks of the traffic source. It can be either a full or partial url.
    srcRegionCodes string[]
    Region codes whose IP addresses will be used to match for source of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of source region codes allowed is 5000.
    srcSecureTags NetworkFirewallPolicyWithRulesRuleMatchSrcSecureTag[]

    List of secure tag values, which should be matched at the source of the traffic. For INGRESS rule, if all the srcSecureTag are INEFFECTIVE, and there is no srcIpRange, this rule will be ignored. Maximum number of source tag values allowed is 256. Structure is documented below.

    The layer4_config block supports:

    srcThreatIntelligences string[]
    Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic source.
    layer4_configs Sequence[NetworkFirewallPolicyWithRulesRuleMatchLayer4Config]
    Pairs of IP protocols and ports that the rule should match. Structure is documented below.
    dest_address_groups Sequence[str]
    Address groups which should be matched against the traffic destination. Maximum number of destination address groups is 10.
    dest_fqdns Sequence[str]
    Fully Qualified Domain Name (FQDN) which should be matched against traffic destination. Maximum number of destination fqdn allowed is 100.
    dest_ip_ranges Sequence[str]
    Destination IP address range in CIDR format. Required for EGRESS rules.
    dest_network_scope str
    Network scope of the traffic destination. Possible values are: INTERNET, INTRA_VPC, NON_INTERNET, VPC_NETWORKS.
    dest_region_codes Sequence[str]
    Region codes whose IP addresses will be used to match for destination of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of destination region codes allowed is 5000.
    dest_threat_intelligences Sequence[str]
    Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic destination.
    src_address_groups Sequence[str]
    Address groups which should be matched against the traffic source. Maximum number of source address groups is 10.
    src_fqdns Sequence[str]
    Fully Qualified Domain Name (FQDN) which should be matched against traffic source. Maximum number of source fqdn allowed is 100.
    src_ip_ranges Sequence[str]
    Source IP address range in CIDR format. Required for INGRESS rules.
    src_network_scope str
    Network scope of the traffic source. Possible values are: INTERNET, INTRA_VPC, NON_INTERNET, VPC_NETWORKS.
    src_networks Sequence[str]
    Networks of the traffic source. It can be either a full or partial url.
    src_region_codes Sequence[str]
    Region codes whose IP addresses will be used to match for source of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of source region codes allowed is 5000.
    src_secure_tags Sequence[NetworkFirewallPolicyWithRulesRuleMatchSrcSecureTag]

    List of secure tag values, which should be matched at the source of the traffic. For INGRESS rule, if all the srcSecureTag are INEFFECTIVE, and there is no srcIpRange, this rule will be ignored. Maximum number of source tag values allowed is 256. Structure is documented below.

    The layer4_config block supports:

    src_threat_intelligences Sequence[str]
    Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic source.
    layer4Configs List<Property Map>
    Pairs of IP protocols and ports that the rule should match. Structure is documented below.
    destAddressGroups List<String>
    Address groups which should be matched against the traffic destination. Maximum number of destination address groups is 10.
    destFqdns List<String>
    Fully Qualified Domain Name (FQDN) which should be matched against traffic destination. Maximum number of destination fqdn allowed is 100.
    destIpRanges List<String>
    Destination IP address range in CIDR format. Required for EGRESS rules.
    destNetworkScope String
    Network scope of the traffic destination. Possible values are: INTERNET, INTRA_VPC, NON_INTERNET, VPC_NETWORKS.
    destRegionCodes List<String>
    Region codes whose IP addresses will be used to match for destination of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of destination region codes allowed is 5000.
    destThreatIntelligences List<String>
    Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic destination.
    srcAddressGroups List<String>
    Address groups which should be matched against the traffic source. Maximum number of source address groups is 10.
    srcFqdns List<String>
    Fully Qualified Domain Name (FQDN) which should be matched against traffic source. Maximum number of source fqdn allowed is 100.
    srcIpRanges List<String>
    Source IP address range in CIDR format. Required for INGRESS rules.
    srcNetworkScope String
    Network scope of the traffic source. Possible values are: INTERNET, INTRA_VPC, NON_INTERNET, VPC_NETWORKS.
    srcNetworks List<String>
    Networks of the traffic source. It can be either a full or partial url.
    srcRegionCodes List<String>
    Region codes whose IP addresses will be used to match for source of traffic. Should be specified as 2 letter country code defined as per ISO 3166 alpha-2 country codes. ex."US" Maximum number of source region codes allowed is 5000.
    srcSecureTags List<Property Map>

    List of secure tag values, which should be matched at the source of the traffic. For INGRESS rule, if all the srcSecureTag are INEFFECTIVE, and there is no srcIpRange, this rule will be ignored. Maximum number of source tag values allowed is 256. Structure is documented below.

    The layer4_config block supports:

    srcThreatIntelligences List<String>
    Names of Network Threat Intelligence lists. The IPs in these lists will be matched against traffic source.

    NetworkFirewallPolicyWithRulesRuleMatchLayer4Config, NetworkFirewallPolicyWithRulesRuleMatchLayer4ConfigArgs

    IpProtocol string
    (Output) The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
    Ports List<string>
    (Output) An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].
    IpProtocol string
    (Output) The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
    Ports []string
    (Output) An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].
    ipProtocol String
    (Output) The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
    ports List<String>
    (Output) An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].
    ipProtocol string
    (Output) The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
    ports string[]
    (Output) An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].
    ip_protocol str
    (Output) The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
    ports Sequence[str]
    (Output) An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].
    ipProtocol String
    (Output) The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule. This value can either be one of the following well known protocol strings (tcp, udp, icmp, esp, ah, ipip, sctp), or the IP protocol number.
    ports List<String>
    (Output) An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"].

    NetworkFirewallPolicyWithRulesRuleMatchSrcSecureTag, NetworkFirewallPolicyWithRulesRuleMatchSrcSecureTagArgs

    Name string
    Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
    State string
    (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.
    Name string
    Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
    State string
    (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.
    name String
    Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
    state String
    (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.
    name string
    Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
    state string
    (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.
    name str
    Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
    state str
    (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.
    name String
    Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
    state String
    (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.

    NetworkFirewallPolicyWithRulesRuleTargetSecureTag, NetworkFirewallPolicyWithRulesRuleTargetSecureTagArgs

    Name string
    Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
    State string
    (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.

    Name string
    Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
    State string
    (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.

    name String
    Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
    state String
    (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.

    name string
    Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
    state string
    (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.

    name str
    Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
    state str
    (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.

    name String
    Name of the secure tag, created with TagManager's TagValue API. @pattern tagValues/[0-9]+
    state String
    (Output) [Output Only] State of the secure tag, either EFFECTIVE or INEFFECTIVE. A secure tag is INEFFECTIVE when it is deleted or its network is deleted.

    Import

    NetworkFirewallPolicyWithRules can be imported using any of these accepted formats:

    • projects/{{project}}/global/firewallPolicies/{{name}}

    • {{project}}/{{name}}

    • {{name}}

    When using the pulumi import command, NetworkFirewallPolicyWithRules can be imported using one of the formats above. For example:

    $ pulumi import gcp:compute/networkFirewallPolicyWithRules:NetworkFirewallPolicyWithRules default projects/{{project}}/global/firewallPolicies/{{name}}

    $ pulumi import gcp:compute/networkFirewallPolicyWithRules:NetworkFirewallPolicyWithRules default {{project}}/{{name}}

    $ pulumi import gcp:compute/networkFirewallPolicyWithRules:NetworkFirewallPolicyWithRules default {{name}}

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Google Cloud (GCP) Classic pulumi/pulumi-gcp
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the google-beta Terraform Provider.
    gcp logo
    Google Cloud v8.21.0 published on Wednesday, Mar 5, 2025 by Pulumi
    pulumi/pulumi-gcp