Collection of Firewall Rules

Type: array of object

All items must be unique

Each item of this array must be:

root Firewall Rule
Type: object

Ensures that if Service-Accounts are specified in either Sources or Targets, only IP CIDR Ranges or Service-Accounts can be included in them.

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

root Firewall Rule if

root Firewall Rule if anyOf Check for Service-Account in Sources
Type: object

Validates the presence of a service account in the sources array.

root Firewall Rule if anyOf Check for Service-Account in Sources sources
Type: array

At least one of the items must be:

root Firewall Rule if anyOf Check for Service-Account in Sources sources Service Account
Type: string

The email address of a service account. Firewall rules can target or be applied based on service accounts.

Must match regular expression: ^\S+@\S+\.\S+$

Must be at most 63 characters long


Examples:

"project-number-compute@developer.gserviceaccount.com"

"project-id@appspot.gserviceaccount.com"

"project-number@cloudservices.gserviceaccount.com"
root Firewall Rule if anyOf Check for Service-Account in Targets
Type: object

Validates the presence of a service account in the targets array.

root Firewall Rule if anyOf Check for Service-Account in Targets targets
Type: array

At least one of the items must be:

root Firewall Rule if anyOf Check for Service-Account in Targets targets Service Account
Type: string

The email address of a service account. Firewall rules can target or be applied based on service accounts.

Must match regular expression: ^\S+@\S+\.\S+$

Must be at most 63 characters long


Examples:

"project-number-compute@developer.gserviceaccount.com"

"project-id@appspot.gserviceaccount.com"

"project-number@cloudservices.gserviceaccount.com"
root Firewall Rule then
Type: object

root Firewall Rule then sources
Type: array

Each item of this array must be:

root Firewall Rule then sources sources items

root Firewall Rule then sources sources items oneOf IP CIDR Range
Type: string

IP space allocated to this subnetwork in CIDR format.

Must match regular expression: ^(?:([0-9]|[1-9][0-9]{0,1}|1[0-9]{1,2}|2[0-4][0-9]|25[0-5])(\.([0-9]|[1-9][0-9]{0,1}|1[0-9]{1,2}|2[0-4][0-9]|25[0-5])){3}/(([0-9]|[1-2][0-9]|3[0-2])))$
Example:

"192.168.0.0/24"
root Firewall Rule then sources sources items oneOf Service Account
Type: string

The email address of a service account. Firewall rules can target or be applied based on service accounts.

Must match regular expression: ^\S+@\S+\.\S+$

Must be at most 63 characters long


Examples:

"project-number-compute@developer.gserviceaccount.com"

"project-id@appspot.gserviceaccount.com"

"project-number@cloudservices.gserviceaccount.com"

root Firewall Rule then targets
Type: array

Each item of this array must be:

root Firewall Rule then targets targets items

root Firewall Rule then targets targets items oneOf IP CIDR Range
Type: string

IP space allocated to this subnetwork in CIDR format.

Must match regular expression: ^(?:([0-9]|[1-9][0-9]{0,1}|1[0-9]{1,2}|2[0-4][0-9]|25[0-5])(\.([0-9]|[1-9][0-9]{0,1}|1[0-9]{1,2}|2[0-4][0-9]|25[0-5])){3}/(([0-9]|[1-2][0-9]|3[0-2])))$
Example:

"192.168.0.0/24"
root Firewall Rule then targets targets items oneOf Service Account
Type: string

The email address of a service account. Firewall rules can target or be applied based on service accounts.

Must match regular expression: ^\S+@\S+\.\S+$

Must be at most 63 characters long


Examples:

"project-number-compute@developer.gserviceaccount.com"

"project-id@appspot.gserviceaccount.com"

"project-number@cloudservices.gserviceaccount.com"

root Firewall Rule disabled
Type: boolean Default: false

Indicates if the rule is disabled.
Examples:

true

false

root Firewall Rule name
Type: string

The name of the firewall rule. If not specified, it will be based on the id field.

Must match regular expression: ^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$

Must be at least 1 characters long

Must be at most 63 characters long


Example:

"<prefix>-<environment>-<network>-firewall-<id>"

root Firewall Rule action
Default: "ALLOW"

Defines whether the rule allows or denies traffic.

root Firewall Rule action oneOf Allow
Type: const

Allow the traffic.

Specific value: "ALLOW"
root Firewall Rule action oneOf Deny
Type: const

Deny the traffic.

Specific value: "DENY"

Examples:

"ALLOW"

"DENY"

root Firewall Rule direction
Default: "INGRESS"

The direction of traffic to which this rule applies. Can be ingress (incoming traffic) or egress (outgoing traffic).

root Firewall Rule direction oneOf Ingress
Type: const

Incoming traffic direction.

Specific value: "INGRESS"
root Firewall Rule direction oneOf Egress
Type: const

Outgoing traffic direction.

Specific value: "EGRESS"

Examples:

"INGRESS"

"EGRESS"

root Firewall Rule description
Type: string

A detailed description of the rule.
Example:

"This rule allows traffic from specific IP ranges."

root Firewall Rule project_id
Type: string

The Google Cloud project ID to use for this firewall rule. If omitted, then project_id will be inherited.

Must match regular expression: ^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$

Must be at least 5 characters long

Must be at most 63 characters long


Example:

"my-example-project"

root Firewall Rule network
Type: string

The network to which this rule is attached. If omitted, then network will be inherited.

Must match regular expression: ^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$

Must be at least 5 characters long

Must be at most 63 characters long


Example:

"default-vpc"

root Firewall Rule id
Type: string

A unique identifier for the rule. If not specified, the name will be based on this field.

Must match regular expression: ^[a-z0-9][a-z0-9-]{0,23}$

Must be at least 1 characters long

Must be at most 24 characters long


Example:

"example-rule-id-allow-tcp-443"

root Firewall Rule prefix
Type: string

The prefix to apply to the rule when generating a dynamic name.
Example:

"fw-rule"

root Firewall Rule environment
Type: string

The environment to apply the rule to.
Examples:

"prod"

"dev"

"stage"

root Firewall Rule rules
Type: array of object

A list of individual rules that define the behavior of the firewall rule based on specified conditions of protocol and port combinations.

Must contain a minimum of 1 items

All items must be unique

Each item of this array must be:

root Firewall Rule rules Rule

root Firewall Rule rules Rule allOf item 0
Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

root Firewall Rule rules Rule allOf item 0 if
Type: object

root Firewall Rule rules Rule allOf item 0 if protocol
Type: string
Must match regular expression: ^(TCP|UDP)$
root Firewall Rule rules Rule allOf item 0 TCP/UDP Rule
Type: object
No Additional Properties

root Firewall Rule rules Rule allOf item 0 TCP/UDP Rule protocol
Type: enum (of string) Default: "TCP"

The IP protocol to which this rule applies. The value can be TCP, UDP, ICMP, or ALL.

Must be one of:

  • "ALL"
  • "AH"
  • "ESP"
  • "ICMP"
  • "IPIP"
  • "SCTP"
  • "TCP"
  • "UDP"

Examples:

"TCP"

"UDP"

"ICMP"

root Firewall Rule rules Rule allOf item 0 TCP/UDP Rule ports
Type: array of string Default: []

A list of ports or port-ranges to which the firewall rule will apply. If no port or port range is specified, all ranges are applied.

Must contain a minimum of 0 items

Each item of this array must be:

root Firewall Rule rules Rule allOf item 0 TCP/UDP Rule ports ports items

root Firewall Rule rules Rule allOf item 0 TCP/UDP Rule ports ports items oneOf Port Range
Type: object
Must match regular expression: ^(0|6[0-5][0-5][0-3][0-5]|[1-5][0-9][0-9][0-9][0-9]|[1-9][0-9]{0,3})-(6[0-5][0-5][0-3][0-5]|[1-5][0-9][0-9][0-9][0-9]|[1-9][0-9]{0,3})$
root Firewall Rule rules Rule allOf item 0 TCP/UDP Rule ports ports items oneOf Port
Type: object
Must match regular expression: ^(0|6[0-5][0-5][0-3][0-5]|[1-5][0-9][0-9][0-9][0-9]|[1-9][0-9]{0,3})$
root Firewall Rule rules Rule allOf item 1
Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

root Firewall Rule rules Rule allOf item 1 if
Type: object

root Firewall Rule rules Rule allOf item 1 if protocol
Type: string
Must match regular expression: ^(ALL|ICMP|ESP|AH|SCTP|IPIP)$
root Firewall Rule rules Rule allOf item 1 Other Named Protocol Rule
Type: object
No Additional Properties

root Firewall Rule rules Rule allOf item 1 Other Named Protocol Rule protocol
Type: enum (of string) Default: "TCP"

The IP protocol to which this rule applies. The value can be TCP, UDP, ICMP, or ALL.

Must be one of:

  • "ALL"
  • "AH"
  • "ESP"
  • "ICMP"
  • "IPIP"
  • "SCTP"
  • "TCP"
  • "UDP"

Examples:

"TCP"

"UDP"

"ICMP"

root Firewall Rule rules Rule allOf item 1 Other Named Protocol Rule ports
Type: array of string

For protocols other than TCP/UDP this should be an empty list.

Must contain a maximum of 0 items

Each item of this array must be:

root Firewall Rule rules Rule allOf item 1 Other Named Protocol Rule ports ports items
Type: string
Must match regular expression: ^(?!.*)

Must be at most 0 characters long

root Firewall Rule rules Rule protocol
Type: enum (of string) Default: "TCP"

The IP protocol to which this rule applies. The value can be TCP, UDP, ICMP, or ALL.

Must be one of:

  • "ALL"
  • "AH"
  • "ESP"
  • "ICMP"
  • "IPIP"
  • "SCTP"
  • "TCP"
  • "UDP"

Examples:

"TCP"

"UDP"

"ICMP"

Example:

{
    "protocol": "TCP",
    "ports": [
        "80",
        "443"
    ]
}

root Firewall Rule sources
Type: array of string Default: []

List of source specifications for the firewall rule. Can be an IP CIDR range, a tag, or a service account email.

Must contain a minimum of 0 items

Each item of this array must be:

root Firewall Rule sources sources items

root Firewall Rule sources sources items oneOf IP CIDR Range
Type: string

IP space allocated to this subnetwork in CIDR format.

Must match regular expression: ^(?:([0-9]|[1-9][0-9]{0,1}|1[0-9]{1,2}|2[0-4][0-9]|25[0-5])(\.([0-9]|[1-9][0-9]{0,1}|1[0-9]{1,2}|2[0-4][0-9]|25[0-5])){3}/(([0-9]|[1-2][0-9]|3[0-2])))$
Example:

"192.168.0.0/24"
root Firewall Rule sources sources items oneOf Network Tag
Type: string

Strings added to a tags field in a resource, such as Compute Engine virtual machine (VM) instances or instance templates. Tags enable you to make firewall rules and routes applicable to specific VM instances.

Must match regular expression: ^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$

Must be at most 63 characters long


Examples:

"alpha-tag"

"bravo-tag"

"charlie-tag"

"web-server"

"database"
root Firewall Rule sources sources items oneOf Service Account
Type: string

The email address of a service account. Firewall rules can target or be applied based on service accounts.

Must match regular expression: ^\S+@\S+\.\S+$

Must be at most 63 characters long


Examples:

"project-number-compute@developer.gserviceaccount.com"

"project-id@appspot.gserviceaccount.com"

"project-number@cloudservices.gserviceaccount.com"

Examples:

"192.168.1.0/24"

"example-tag"

"example-service-account@example.com"

root Firewall Rule targets
Type: array of string Default: []

List of target specifications for the firewall rule. Can be an IP CIDR range, a tag, or a service account email.

Must contain a minimum of 0 items

Each item of this array must be:

root Firewall Rule targets targets items

root Firewall Rule targets targets items oneOf IP CIDR Range
Type: string

IP space allocated to this subnetwork in CIDR format.

Must match regular expression: ^(?:([0-9]|[1-9][0-9]{0,1}|1[0-9]{1,2}|2[0-4][0-9]|25[0-5])(\.([0-9]|[1-9][0-9]{0,1}|1[0-9]{1,2}|2[0-4][0-9]|25[0-5])){3}/(([0-9]|[1-2][0-9]|3[0-2])))$
Example:

"192.168.0.0/24"
root Firewall Rule targets targets items oneOf Network Tag
Type: string

Strings added to a tags field in a resource, such as Compute Engine virtual machine (VM) instances or instance templates. Tags enable you to make firewall rules and routes applicable to specific VM instances.

Must match regular expression: ^(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)$

Must be at most 63 characters long


Examples:

"alpha-tag"

"bravo-tag"

"charlie-tag"

"web-server"

"database"
root Firewall Rule targets targets items oneOf Service Account
Type: string

The email address of a service account. Firewall rules can target or be applied based on service accounts.

Must match regular expression: ^\S+@\S+\.\S+$

Must be at most 63 characters long


Examples:

"project-number-compute@developer.gserviceaccount.com"

"project-id@appspot.gserviceaccount.com"

"project-number@cloudservices.gserviceaccount.com"

Examples:

"192.168.1.0/24"

"example-tag"

"example-service-account@example.com"

root Firewall Rule priority
Type: integer Default: 1000

The priority of the rule. Lower values indicate higher priority.

Value must be greater or equal to 0 and lesser or equal to 65535


Examples:

1000

2000

root Firewall Rule log_config
Default: "DISABLED"

Defines how traffic that matches this rule should be logged.

root Firewall Rule log_config oneOf Exclude All Metadata
Type: const

Exclude all metadata from the logs.

Specific value: "EXCLUDE_ALL_METADATA"
root Firewall Rule log_config oneOf Include All Metadata
Type: const

Include all metadata in the logs.

Specific value: "INCLUDE_ALL_METADATA"
root Firewall Rule log_config oneOf Disabled
Type: const

Disable logging for this rule.

Specific value: "DISABLED"

Examples:

"EXCLUDE_ALL_METADATA"

"INCLUDE_ALL_METADATA"

"DISABLED"