google_compute_security_policy resource

[edit on GitHub]

Syntax

A google_compute_security_policy is used to test a Google SecurityPolicy resource

Beta Resource

This resource has beta fields available. To retrieve these fields, include beta: true in the constructor for the resource

Examples

describe google_compute_security_policy(project: 'chef-gcp-inspec', name: 'sec-policy') do
  it { should exist }
  its('rules.size') { should cmp 2 }
  its('rules.first.priority') { should cmp '1000' }
  its('rules.first.match.config.src_ip_ranges.first') { should cmp '9.9.9.0/24' }
end

describe google_compute_security_policy(project: 'chef-gcp-inspec', name: 'nonexistent') do
  it { should_not exist }
end

Properties

Properties that can be accessed from the google_compute_security_policy resource:

name

Name of the security policy.

id

The unique identifier for the resource.

rules

A list of rules that belong to this policy. There must always be a default rule (rule with priority 2147483647 and match “*"). If no rules are provided when creating a security policy, a default rule with action “allow” will be added.

description

A description of the rule.

priority

An integer indicating the priority of a rule in the list. The priority must be a positive value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest prority.

action

The Action to preform when the client connection triggers the rule. Can currently be either “allow” or “deny()” where valid values for status are 403, 404, and 502.

preview

If set to true, the specified action is not enforced.

match

A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding ‘action’ is enforced.

description : A description of the rule.

expr : User defined CEVAL expression. A CEVAL expression is used to specify match criteria such as origin.ip, source.region_code and contents in the request header.

`expression`
: Textual representation of an expression in Common Expression Language syntax.

`title`
: Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.

`description`
: Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.

`location`
: Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.

versioned_expr : Preconfigured versioned expression. If this field is specified, config must also be specified. Available preconfigured expressions along with their requirements are: SRC_IPS_V1 - must specify the corresponding srcIpRange field in config.

config : The configuration options available when specifying versionedExpr. This field must be specified if versionedExpr is specified and cannot be specified if versionedExpr is not specified.

`src_ip_ranges`
: CIDR IP address range.

GCP Permissions

Ensure the Compute Engine API is enabled for the current project.