Docs
PackagesGoogle Cloud Classic v7.29.0 published on Wednesday, Jun 26, 2024 by Pulumi
gcp.networksecurity.TlsInspectionPolicy
Explore with Pulumi AI
The TlsInspectionPolicy resource contains references to CA pools in Certificate Authority Service and associated metadata.
To get more information about TlsInspectionPolicy, see:
- API documentation
- How-to Guides
Example Usage
Network Security Tls Inspection Policy Basic
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const _default = new gcp.certificateauthority.CaPool("default", {
name: "my-basic-ca-pool",
location: "us-central1",
tier: "DEVOPS",
publishingOptions: {
publishCaCert: false,
publishCrl: false,
},
issuancePolicy: {
maximumLifetime: "1209600s",
baselineValues: {
caOptions: {
isCa: false,
},
keyUsage: {
baseKeyUsage: {},
extendedKeyUsage: {
serverAuth: true,
},
},
},
},
});
const defaultAuthority = new gcp.certificateauthority.Authority("default", {
pool: _default.name,
certificateAuthorityId: "my-basic-certificate-authority",
location: "us-central1",
lifetime: "86400s",
type: "SELF_SIGNED",
deletionProtection: false,
skipGracePeriod: true,
ignoreActiveCertificatesOnDeletion: true,
config: {
subjectConfig: {
subject: {
organization: "Test LLC",
commonName: "my-ca",
},
},
x509Config: {
caOptions: {
isCa: true,
},
keyUsage: {
baseKeyUsage: {
certSign: true,
crlSign: true,
},
extendedKeyUsage: {
serverAuth: false,
},
},
},
},
keySpec: {
algorithm: "RSA_PKCS1_4096_SHA256",
},
});
const project = gcp.organizations.getProject({});
const tlsInspectionPermission = new gcp.certificateauthority.CaPoolIamMember("tls_inspection_permission", {
caPool: _default.id,
role: "roles/privateca.certificateManager",
member: project.then(project => `serviceAccount:service-${project.number}@gcp-sa-networksecurity.iam.gserviceaccount.com`),
});
const defaultTlsInspectionPolicy = new gcp.networksecurity.TlsInspectionPolicy("default", {
name: "my-tls-inspection-policy",
location: "us-central1",
caPool: _default.id,
excludePublicCaSet: false,
}, {
dependsOn: [
_default,
defaultAuthority,
tlsInspectionPermission,
],
});
import pulumi
import pulumi_gcp as gcp
default = gcp.certificateauthority.CaPool("default",
name="my-basic-ca-pool",
location="us-central1",
tier="DEVOPS",
publishing_options=gcp.certificateauthority.CaPoolPublishingOptionsArgs(
publish_ca_cert=False,
publish_crl=False,
),
issuance_policy=gcp.certificateauthority.CaPoolIssuancePolicyArgs(
maximum_lifetime="1209600s",
baseline_values=gcp.certificateauthority.CaPoolIssuancePolicyBaselineValuesArgs(
ca_options=gcp.certificateauthority.CaPoolIssuancePolicyBaselineValuesCaOptionsArgs(
is_ca=False,
),
key_usage=gcp.certificateauthority.CaPoolIssuancePolicyBaselineValuesKeyUsageArgs(
base_key_usage=gcp.certificateauthority.CaPoolIssuancePolicyBaselineValuesKeyUsageBaseKeyUsageArgs(),
extended_key_usage=gcp.certificateauthority.CaPoolIssuancePolicyBaselineValuesKeyUsageExtendedKeyUsageArgs(
server_auth=True,
),
),
),
))
default_authority = gcp.certificateauthority.Authority("default",
pool=default.name,
certificate_authority_id="my-basic-certificate-authority",
location="us-central1",
lifetime="86400s",
type="SELF_SIGNED",
deletion_protection=False,
skip_grace_period=True,
ignore_active_certificates_on_deletion=True,
config=gcp.certificateauthority.AuthorityConfigArgs(
subject_config=gcp.certificateauthority.AuthorityConfigSubjectConfigArgs(
subject=gcp.certificateauthority.AuthorityConfigSubjectConfigSubjectArgs(
organization="Test LLC",
common_name="my-ca",
),
),
x509_config=gcp.certificateauthority.AuthorityConfigX509ConfigArgs(
ca_options=gcp.certificateauthority.AuthorityConfigX509ConfigCaOptionsArgs(
is_ca=True,
),
key_usage=gcp.certificateauthority.AuthorityConfigX509ConfigKeyUsageArgs(
base_key_usage=gcp.certificateauthority.AuthorityConfigX509ConfigKeyUsageBaseKeyUsageArgs(
cert_sign=True,
crl_sign=True,
),
extended_key_usage=gcp.certificateauthority.AuthorityConfigX509ConfigKeyUsageExtendedKeyUsageArgs(
server_auth=False,
),
),
),
),
key_spec=gcp.certificateauthority.AuthorityKeySpecArgs(
algorithm="RSA_PKCS1_4096_SHA256",
))
project = gcp.organizations.get_project()
tls_inspection_permission = gcp.certificateauthority.CaPoolIamMember("tls_inspection_permission",
ca_pool=default.id,
role="roles/privateca.certificateManager",
member=f"serviceAccount:service-{project.number}@gcp-sa-networksecurity.iam.gserviceaccount.com")
default_tls_inspection_policy = gcp.networksecurity.TlsInspectionPolicy("default",
name="my-tls-inspection-policy",
location="us-central1",
ca_pool=default.id,
exclude_public_ca_set=False,
opts = pulumi.ResourceOptions(depends_on=[
default,
default_authority,
tls_inspection_permission,
]))
package main
import (
"fmt"
"github.com/pulumi/pulumi-gcp/sdk/v7/go/gcp/certificateauthority"
"github.com/pulumi/pulumi-gcp/sdk/v7/go/gcp/networksecurity"
"github.com/pulumi/pulumi-gcp/sdk/v7/go/gcp/organizations"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := certificateauthority.NewCaPool(ctx, "default", &certificateauthority.CaPoolArgs{
Name: pulumi.String("my-basic-ca-pool"),
Location: pulumi.String("us-central1"),
Tier: pulumi.String("DEVOPS"),
PublishingOptions: &certificateauthority.CaPoolPublishingOptionsArgs{
PublishCaCert: pulumi.Bool(false),
PublishCrl: pulumi.Bool(false),
},
IssuancePolicy: &certificateauthority.CaPoolIssuancePolicyArgs{
MaximumLifetime: pulumi.String("1209600s"),
BaselineValues: &certificateauthority.CaPoolIssuancePolicyBaselineValuesArgs{
CaOptions: &certificateauthority.CaPoolIssuancePolicyBaselineValuesCaOptionsArgs{
IsCa: pulumi.Bool(false),
},
KeyUsage: &certificateauthority.CaPoolIssuancePolicyBaselineValuesKeyUsageArgs{
BaseKeyUsage: nil,
ExtendedKeyUsage: &certificateauthority.CaPoolIssuancePolicyBaselineValuesKeyUsageExtendedKeyUsageArgs{
ServerAuth: pulumi.Bool(true),
},
},
},
},
})
if err != nil {
return err
}
defaultAuthority, err := certificateauthority.NewAuthority(ctx, "default", &certificateauthority.AuthorityArgs{
Pool: _default.Name,
CertificateAuthorityId: pulumi.String("my-basic-certificate-authority"),
Location: pulumi.String("us-central1"),
Lifetime: pulumi.String("86400s"),
Type: pulumi.String("SELF_SIGNED"),
DeletionProtection: pulumi.Bool(false),
SkipGracePeriod: pulumi.Bool(true),
IgnoreActiveCertificatesOnDeletion: pulumi.Bool(true),
Config: &certificateauthority.AuthorityConfigArgs{
SubjectConfig: &certificateauthority.AuthorityConfigSubjectConfigArgs{
Subject: &certificateauthority.AuthorityConfigSubjectConfigSubjectArgs{
Organization: pulumi.String("Test LLC"),
CommonName: pulumi.String("my-ca"),
},
},
X509Config: &certificateauthority.AuthorityConfigX509ConfigArgs{
CaOptions: &certificateauthority.AuthorityConfigX509ConfigCaOptionsArgs{
IsCa: pulumi.Bool(true),
},
KeyUsage: &certificateauthority.AuthorityConfigX509ConfigKeyUsageArgs{
BaseKeyUsage: &certificateauthority.AuthorityConfigX509ConfigKeyUsageBaseKeyUsageArgs{
CertSign: pulumi.Bool(true),
CrlSign: pulumi.Bool(true),
},
ExtendedKeyUsage: &certificateauthority.AuthorityConfigX509ConfigKeyUsageExtendedKeyUsageArgs{
ServerAuth: pulumi.Bool(false),
},
},
},
},
KeySpec: &certificateauthority.AuthorityKeySpecArgs{
Algorithm: pulumi.String("RSA_PKCS1_4096_SHA256"),
},
})
if err != nil {
return err
}
project, err := organizations.LookupProject(ctx, nil, nil)
if err != nil {
return err
}
tlsInspectionPermission, err := certificateauthority.NewCaPoolIamMember(ctx, "tls_inspection_permission", &certificateauthority.CaPoolIamMemberArgs{
CaPool: _default.ID(),
Role: pulumi.String("roles/privateca.certificateManager"),
Member: pulumi.String(fmt.Sprintf("serviceAccount:service-%v@gcp-sa-networksecurity.iam.gserviceaccount.com", project.Number)),
})
if err != nil {
return err
}
_, err = networksecurity.NewTlsInspectionPolicy(ctx, "default", &networksecurity.TlsInspectionPolicyArgs{
Name: pulumi.String("my-tls-inspection-policy"),
Location: pulumi.String("us-central1"),
CaPool: _default.ID(),
ExcludePublicCaSet: pulumi.Bool(false),
}, pulumi.DependsOn([]pulumi.Resource{
_default,
defaultAuthority,
tlsInspectionPermission,
}))
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var @default = new Gcp.CertificateAuthority.CaPool("default", new()
{
Name = "my-basic-ca-pool",
Location = "us-central1",
Tier = "DEVOPS",
PublishingOptions = new Gcp.CertificateAuthority.Inputs.CaPoolPublishingOptionsArgs
{
PublishCaCert = false,
PublishCrl = false,
},
IssuancePolicy = new Gcp.CertificateAuthority.Inputs.CaPoolIssuancePolicyArgs
{
MaximumLifetime = "1209600s",
BaselineValues = new Gcp.CertificateAuthority.Inputs.CaPoolIssuancePolicyBaselineValuesArgs
{
CaOptions = new Gcp.CertificateAuthority.Inputs.CaPoolIssuancePolicyBaselineValuesCaOptionsArgs
{
IsCa = false,
},
KeyUsage = new Gcp.CertificateAuthority.Inputs.CaPoolIssuancePolicyBaselineValuesKeyUsageArgs
{
BaseKeyUsage = null,
ExtendedKeyUsage = new Gcp.CertificateAuthority.Inputs.CaPoolIssuancePolicyBaselineValuesKeyUsageExtendedKeyUsageArgs
{
ServerAuth = true,
},
},
},
},
});
var defaultAuthority = new Gcp.CertificateAuthority.Authority("default", new()
{
Pool = @default.Name,
CertificateAuthorityId = "my-basic-certificate-authority",
Location = "us-central1",
Lifetime = "86400s",
Type = "SELF_SIGNED",
DeletionProtection = false,
SkipGracePeriod = true,
IgnoreActiveCertificatesOnDeletion = true,
Config = new Gcp.CertificateAuthority.Inputs.AuthorityConfigArgs
{
SubjectConfig = new Gcp.CertificateAuthority.Inputs.AuthorityConfigSubjectConfigArgs
{
Subject = new Gcp.CertificateAuthority.Inputs.AuthorityConfigSubjectConfigSubjectArgs
{
Organization = "Test LLC",
CommonName = "my-ca",
},
},
X509Config = new Gcp.CertificateAuthority.Inputs.AuthorityConfigX509ConfigArgs
{
CaOptions = new Gcp.CertificateAuthority.Inputs.AuthorityConfigX509ConfigCaOptionsArgs
{
IsCa = true,
},
KeyUsage = new Gcp.CertificateAuthority.Inputs.AuthorityConfigX509ConfigKeyUsageArgs
{
BaseKeyUsage = new Gcp.CertificateAuthority.Inputs.AuthorityConfigX509ConfigKeyUsageBaseKeyUsageArgs
{
CertSign = true,
CrlSign = true,
},
ExtendedKeyUsage = new Gcp.CertificateAuthority.Inputs.AuthorityConfigX509ConfigKeyUsageExtendedKeyUsageArgs
{
ServerAuth = false,
},
},
},
},
KeySpec = new Gcp.CertificateAuthority.Inputs.AuthorityKeySpecArgs
{
Algorithm = "RSA_PKCS1_4096_SHA256",
},
});
var project = Gcp.Organizations.GetProject.Invoke();
var tlsInspectionPermission = new Gcp.CertificateAuthority.CaPoolIamMember("tls_inspection_permission", new()
{
CaPool = @default.Id,
Role = "roles/privateca.certificateManager",
Member = $"serviceAccount:service-{project.Apply(getProjectResult => getProjectResult.Number)}@gcp-sa-networksecurity.iam.gserviceaccount.com",
});
var defaultTlsInspectionPolicy = new Gcp.NetworkSecurity.TlsInspectionPolicy("default", new()
{
Name = "my-tls-inspection-policy",
Location = "us-central1",
CaPool = @default.Id,
ExcludePublicCaSet = false,
}, new CustomResourceOptions
{
DependsOn =
{
@default,
defaultAuthority,
tlsInspectionPermission,
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.certificateauthority.CaPool;
import com.pulumi.gcp.certificateauthority.CaPoolArgs;
import com.pulumi.gcp.certificateauthority.inputs.CaPoolPublishingOptionsArgs;
import com.pulumi.gcp.certificateauthority.inputs.CaPoolIssuancePolicyArgs;
import com.pulumi.gcp.certificateauthority.inputs.CaPoolIssuancePolicyBaselineValuesArgs;
import com.pulumi.gcp.certificateauthority.inputs.CaPoolIssuancePolicyBaselineValuesCaOptionsArgs;
import com.pulumi.gcp.certificateauthority.inputs.CaPoolIssuancePolicyBaselineValuesKeyUsageArgs;
import com.pulumi.gcp.certificateauthority.inputs.CaPoolIssuancePolicyBaselineValuesKeyUsageBaseKeyUsageArgs;
import com.pulumi.gcp.certificateauthority.inputs.CaPoolIssuancePolicyBaselineValuesKeyUsageExtendedKeyUsageArgs;
import com.pulumi.gcp.certificateauthority.Authority;
import com.pulumi.gcp.certificateauthority.AuthorityArgs;
import com.pulumi.gcp.certificateauthority.inputs.AuthorityConfigArgs;
import com.pulumi.gcp.certificateauthority.inputs.AuthorityConfigSubjectConfigArgs;
import com.pulumi.gcp.certificateauthority.inputs.AuthorityConfigSubjectConfigSubjectArgs;
import com.pulumi.gcp.certificateauthority.inputs.AuthorityConfigX509ConfigArgs;
import com.pulumi.gcp.certificateauthority.inputs.AuthorityConfigX509ConfigCaOptionsArgs;
import com.pulumi.gcp.certificateauthority.inputs.AuthorityConfigX509ConfigKeyUsageArgs;
import com.pulumi.gcp.certificateauthority.inputs.AuthorityConfigX509ConfigKeyUsageBaseKeyUsageArgs;
import com.pulumi.gcp.certificateauthority.inputs.AuthorityConfigX509ConfigKeyUsageExtendedKeyUsageArgs;
import com.pulumi.gcp.certificateauthority.inputs.AuthorityKeySpecArgs;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetProjectArgs;
import com.pulumi.gcp.certificateauthority.CaPoolIamMember;
import com.pulumi.gcp.certificateauthority.CaPoolIamMemberArgs;
import com.pulumi.gcp.networksecurity.TlsInspectionPolicy;
import com.pulumi.gcp.networksecurity.TlsInspectionPolicyArgs;
import com.pulumi.resources.CustomResourceOptions;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var default_ = new CaPool("default", CaPoolArgs.builder()
.name("my-basic-ca-pool")
.location("us-central1")
.tier("DEVOPS")
.publishingOptions(CaPoolPublishingOptionsArgs.builder()
.publishCaCert(false)
.publishCrl(false)
.build())
.issuancePolicy(CaPoolIssuancePolicyArgs.builder()
.maximumLifetime("1209600s")
.baselineValues(CaPoolIssuancePolicyBaselineValuesArgs.builder()
.caOptions(CaPoolIssuancePolicyBaselineValuesCaOptionsArgs.builder()
.isCa(false)
.build())
.keyUsage(CaPoolIssuancePolicyBaselineValuesKeyUsageArgs.builder()
.baseKeyUsage()
.extendedKeyUsage(CaPoolIssuancePolicyBaselineValuesKeyUsageExtendedKeyUsageArgs.builder()
.serverAuth(true)
.build())
.build())
.build())
.build())
.build());
var defaultAuthority = new Authority("defaultAuthority", AuthorityArgs.builder()
.pool(default_.name())
.certificateAuthorityId("my-basic-certificate-authority")
.location("us-central1")
.lifetime("86400s")
.type("SELF_SIGNED")
.deletionProtection(false)
.skipGracePeriod(true)
.ignoreActiveCertificatesOnDeletion(true)
.config(AuthorityConfigArgs.builder()
.subjectConfig(AuthorityConfigSubjectConfigArgs.builder()
.subject(AuthorityConfigSubjectConfigSubjectArgs.builder()
.organization("Test LLC")
.commonName("my-ca")
.build())
.build())
.x509Config(AuthorityConfigX509ConfigArgs.builder()
.caOptions(AuthorityConfigX509ConfigCaOptionsArgs.builder()
.isCa(true)
.build())
.keyUsage(AuthorityConfigX509ConfigKeyUsageArgs.builder()
.baseKeyUsage(AuthorityConfigX509ConfigKeyUsageBaseKeyUsageArgs.builder()
.certSign(true)
.crlSign(true)
.build())
.extendedKeyUsage(AuthorityConfigX509ConfigKeyUsageExtendedKeyUsageArgs.builder()
.serverAuth(false)
.build())
.build())
.build())
.build())
.keySpec(AuthorityKeySpecArgs.builder()
.algorithm("RSA_PKCS1_4096_SHA256")
.build())
.build());
final var project = OrganizationsFunctions.getProject();
var tlsInspectionPermission = new CaPoolIamMember("tlsInspectionPermission", CaPoolIamMemberArgs.builder()
.caPool(default_.id())
.role("roles/privateca.certificateManager")
.member(String.format("serviceAccount:service-%s@gcp-sa-networksecurity.iam.gserviceaccount.com", project.applyValue(getProjectResult -> getProjectResult.number())))
.build());
var defaultTlsInspectionPolicy = new TlsInspectionPolicy("defaultTlsInspectionPolicy", TlsInspectionPolicyArgs.builder()
.name("my-tls-inspection-policy")
.location("us-central1")
.caPool(default_.id())
.excludePublicCaSet(false)
.build(), CustomResourceOptions.builder()
.dependsOn(
default_,
defaultAuthority,
tlsInspectionPermission)
.build());
}
}
resources:
default:
type: gcp:certificateauthority:CaPool
properties:
name: my-basic-ca-pool
location: us-central1
tier: DEVOPS
publishingOptions:
publishCaCert: false
publishCrl: false
issuancePolicy:
maximumLifetime: 1209600s
baselineValues:
caOptions:
isCa: false
keyUsage:
baseKeyUsage: {}
extendedKeyUsage:
serverAuth: true
defaultAuthority:
type: gcp:certificateauthority:Authority
name: default
properties:
pool: ${default.name}
certificateAuthorityId: my-basic-certificate-authority
location: us-central1
lifetime: 86400s
type: SELF_SIGNED
deletionProtection: false
skipGracePeriod: true
ignoreActiveCertificatesOnDeletion: true
config:
subjectConfig:
subject:
organization: Test LLC
commonName: my-ca
x509Config:
caOptions:
isCa: true
keyUsage:
baseKeyUsage:
certSign: true
crlSign: true
extendedKeyUsage:
serverAuth: false
keySpec:
algorithm: RSA_PKCS1_4096_SHA256
tlsInspectionPermission:
type: gcp:certificateauthority:CaPoolIamMember
name: tls_inspection_permission
properties:
caPool: ${default.id}
role: roles/privateca.certificateManager
member: serviceAccount:service-${project.number}@gcp-sa-networksecurity.iam.gserviceaccount.com
defaultTlsInspectionPolicy:
type: gcp:networksecurity:TlsInspectionPolicy
name: default
properties:
name: my-tls-inspection-policy
location: us-central1
caPool: ${default.id}
excludePublicCaSet: false
options:
dependson:
- ${default}
- ${defaultAuthority}
- ${tlsInspectionPermission}
variables:
project:
fn::invoke:
Function: gcp:organizations:getProject
Arguments: {}
Network Security Tls Inspection Policy Custom
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
import * as std from "@pulumi/std";
const _default = new gcp.certificateauthority.CaPool("default", {
name: "my-basic-ca-pool",
location: "us-central1",
tier: "DEVOPS",
publishingOptions: {
publishCaCert: false,
publishCrl: false,
},
issuancePolicy: {
maximumLifetime: "1209600s",
baselineValues: {
caOptions: {
isCa: false,
},
keyUsage: {
baseKeyUsage: {},
extendedKeyUsage: {
serverAuth: true,
},
},
},
},
});
const defaultAuthority = new gcp.certificateauthority.Authority("default", {
pool: _default.name,
certificateAuthorityId: "my-basic-certificate-authority",
location: "us-central1",
lifetime: "86400s",
type: "SELF_SIGNED",
deletionProtection: false,
skipGracePeriod: true,
ignoreActiveCertificatesOnDeletion: true,
config: {
subjectConfig: {
subject: {
organization: "Test LLC",
commonName: "my-ca",
},
},
x509Config: {
caOptions: {
isCa: true,
},
keyUsage: {
baseKeyUsage: {
certSign: true,
crlSign: true,
},
extendedKeyUsage: {
serverAuth: false,
},
},
},
},
keySpec: {
algorithm: "RSA_PKCS1_4096_SHA256",
},
});
const nsSa = new gcp.projects.ServiceIdentity("ns_sa", {service: "networksecurity.googleapis.com"});
const defaultCaPoolIamMember = new gcp.certificateauthority.CaPoolIamMember("default", {
caPool: _default.id,
role: "roles/privateca.certificateManager",
member: pulumi.interpolate`serviceAccount:${nsSa.email}`,
});
const defaultTrustConfig = new gcp.certificatemanager.TrustConfig("default", {
name: "my-trust-config",
description: "sample trust config description",
location: "us-central1",
trustStores: [{
trustAnchors: [{
pemCertificate: std.file({
input: "test-fixtures/ca_cert.pem",
}).then(invoke => invoke.result),
}],
intermediateCas: [{
pemCertificate: std.file({
input: "test-fixtures/ca_cert.pem",
}).then(invoke => invoke.result),
}],
}],
});
const defaultTlsInspectionPolicy = new gcp.networksecurity.TlsInspectionPolicy("default", {
name: "my-tls-inspection-policy",
location: "us-central1",
caPool: _default.id,
excludePublicCaSet: false,
minTlsVersion: "TLS_1_0",
trustConfig: defaultTrustConfig.id,
tlsFeatureProfile: "PROFILE_CUSTOM",
customTlsFeatures: [
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
"TLS_RSA_WITH_3DES_EDE_CBC_SHA",
"TLS_RSA_WITH_AES_128_CBC_SHA",
"TLS_RSA_WITH_AES_128_GCM_SHA256",
"TLS_RSA_WITH_AES_256_CBC_SHA",
"TLS_RSA_WITH_AES_256_GCM_SHA384",
],
}, {
dependsOn: [
defaultAuthority,
defaultCaPoolIamMember,
],
});
import pulumi
import pulumi_gcp as gcp
import pulumi_std as std
default = gcp.certificateauthority.CaPool("default",
name="my-basic-ca-pool",
location="us-central1",
tier="DEVOPS",
publishing_options=gcp.certificateauthority.CaPoolPublishingOptionsArgs(
publish_ca_cert=False,
publish_crl=False,
),
issuance_policy=gcp.certificateauthority.CaPoolIssuancePolicyArgs(
maximum_lifetime="1209600s",
baseline_values=gcp.certificateauthority.CaPoolIssuancePolicyBaselineValuesArgs(
ca_options=gcp.certificateauthority.CaPoolIssuancePolicyBaselineValuesCaOptionsArgs(
is_ca=False,
),
key_usage=gcp.certificateauthority.CaPoolIssuancePolicyBaselineValuesKeyUsageArgs(
base_key_usage=gcp.certificateauthority.CaPoolIssuancePolicyBaselineValuesKeyUsageBaseKeyUsageArgs(),
extended_key_usage=gcp.certificateauthority.CaPoolIssuancePolicyBaselineValuesKeyUsageExtendedKeyUsageArgs(
server_auth=True,
),
),
),
))
default_authority = gcp.certificateauthority.Authority("default",
pool=default.name,
certificate_authority_id="my-basic-certificate-authority",
location="us-central1",
lifetime="86400s",
type="SELF_SIGNED",
deletion_protection=False,
skip_grace_period=True,
ignore_active_certificates_on_deletion=True,
config=gcp.certificateauthority.AuthorityConfigArgs(
subject_config=gcp.certificateauthority.AuthorityConfigSubjectConfigArgs(
subject=gcp.certificateauthority.AuthorityConfigSubjectConfigSubjectArgs(
organization="Test LLC",
common_name="my-ca",
),
),
x509_config=gcp.certificateauthority.AuthorityConfigX509ConfigArgs(
ca_options=gcp.certificateauthority.AuthorityConfigX509ConfigCaOptionsArgs(
is_ca=True,
),
key_usage=gcp.certificateauthority.AuthorityConfigX509ConfigKeyUsageArgs(
base_key_usage=gcp.certificateauthority.AuthorityConfigX509ConfigKeyUsageBaseKeyUsageArgs(
cert_sign=True,
crl_sign=True,
),
extended_key_usage=gcp.certificateauthority.AuthorityConfigX509ConfigKeyUsageExtendedKeyUsageArgs(
server_auth=False,
),
),
),
),
key_spec=gcp.certificateauthority.AuthorityKeySpecArgs(
algorithm="RSA_PKCS1_4096_SHA256",
))
ns_sa = gcp.projects.ServiceIdentity("ns_sa", service="networksecurity.googleapis.com")
default_ca_pool_iam_member = gcp.certificateauthority.CaPoolIamMember("default",
ca_pool=default.id,
role="roles/privateca.certificateManager",
member=ns_sa.email.apply(lambda email: f"serviceAccount:{email}"))
default_trust_config = gcp.certificatemanager.TrustConfig("default",
name="my-trust-config",
description="sample trust config description",
location="us-central1",
trust_stores=[gcp.certificatemanager.TrustConfigTrustStoreArgs(
trust_anchors=[gcp.certificatemanager.TrustConfigTrustStoreTrustAnchorArgs(
pem_certificate=std.file(input="test-fixtures/ca_cert.pem").result,
)],
intermediate_cas=[gcp.certificatemanager.TrustConfigTrustStoreIntermediateCaArgs(
pem_certificate=std.file(input="test-fixtures/ca_cert.pem").result,
)],
)])
default_tls_inspection_policy = gcp.networksecurity.TlsInspectionPolicy("default",
name="my-tls-inspection-policy",
location="us-central1",
ca_pool=default.id,
exclude_public_ca_set=False,
min_tls_version="TLS_1_0",
trust_config=default_trust_config.id,
tls_feature_profile="PROFILE_CUSTOM",
custom_tls_features=[
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
"TLS_RSA_WITH_3DES_EDE_CBC_SHA",
"TLS_RSA_WITH_AES_128_CBC_SHA",
"TLS_RSA_WITH_AES_128_GCM_SHA256",
"TLS_RSA_WITH_AES_256_CBC_SHA",
"TLS_RSA_WITH_AES_256_GCM_SHA384",
],
opts = pulumi.ResourceOptions(depends_on=[
default_authority,
default_ca_pool_iam_member,
]))
package main
import (
"fmt"
"github.com/pulumi/pulumi-gcp/sdk/v7/go/gcp/certificateauthority"
"github.com/pulumi/pulumi-gcp/sdk/v7/go/gcp/certificatemanager"
"github.com/pulumi/pulumi-gcp/sdk/v7/go/gcp/networksecurity"
"github.com/pulumi/pulumi-gcp/sdk/v7/go/gcp/projects"
"github.com/pulumi/pulumi-std/sdk/go/std"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := certificateauthority.NewCaPool(ctx, "default", &certificateauthority.CaPoolArgs{
Name: pulumi.String("my-basic-ca-pool"),
Location: pulumi.String("us-central1"),
Tier: pulumi.String("DEVOPS"),
PublishingOptions: &certificateauthority.CaPoolPublishingOptionsArgs{
PublishCaCert: pulumi.Bool(false),
PublishCrl: pulumi.Bool(false),
},
IssuancePolicy: &certificateauthority.CaPoolIssuancePolicyArgs{
MaximumLifetime: pulumi.String("1209600s"),
BaselineValues: &certificateauthority.CaPoolIssuancePolicyBaselineValuesArgs{
CaOptions: &certificateauthority.CaPoolIssuancePolicyBaselineValuesCaOptionsArgs{
IsCa: pulumi.Bool(false),
},
KeyUsage: &certificateauthority.CaPoolIssuancePolicyBaselineValuesKeyUsageArgs{
BaseKeyUsage: nil,
ExtendedKeyUsage: &certificateauthority.CaPoolIssuancePolicyBaselineValuesKeyUsageExtendedKeyUsageArgs{
ServerAuth: pulumi.Bool(true),
},
},
},
},
})
if err != nil {
return err
}
defaultAuthority, err := certificateauthority.NewAuthority(ctx, "default", &certificateauthority.AuthorityArgs{
Pool: _default.Name,
CertificateAuthorityId: pulumi.String("my-basic-certificate-authority"),
Location: pulumi.String("us-central1"),
Lifetime: pulumi.String("86400s"),
Type: pulumi.String("SELF_SIGNED"),
DeletionProtection: pulumi.Bool(false),
SkipGracePeriod: pulumi.Bool(true),
IgnoreActiveCertificatesOnDeletion: pulumi.Bool(true),
Config: &certificateauthority.AuthorityConfigArgs{
SubjectConfig: &certificateauthority.AuthorityConfigSubjectConfigArgs{
Subject: &certificateauthority.AuthorityConfigSubjectConfigSubjectArgs{
Organization: pulumi.String("Test LLC"),
CommonName: pulumi.String("my-ca"),
},
},
X509Config: &certificateauthority.AuthorityConfigX509ConfigArgs{
CaOptions: &certificateauthority.AuthorityConfigX509ConfigCaOptionsArgs{
IsCa: pulumi.Bool(true),
},
KeyUsage: &certificateauthority.AuthorityConfigX509ConfigKeyUsageArgs{
BaseKeyUsage: &certificateauthority.AuthorityConfigX509ConfigKeyUsageBaseKeyUsageArgs{
CertSign: pulumi.Bool(true),
CrlSign: pulumi.Bool(true),
},
ExtendedKeyUsage: &certificateauthority.AuthorityConfigX509ConfigKeyUsageExtendedKeyUsageArgs{
ServerAuth: pulumi.Bool(false),
},
},
},
},
KeySpec: &certificateauthority.AuthorityKeySpecArgs{
Algorithm: pulumi.String("RSA_PKCS1_4096_SHA256"),
},
})
if err != nil {
return err
}
nsSa, err := projects.NewServiceIdentity(ctx, "ns_sa", &projects.ServiceIdentityArgs{
Service: pulumi.String("networksecurity.googleapis.com"),
})
if err != nil {
return err
}
defaultCaPoolIamMember, err := certificateauthority.NewCaPoolIamMember(ctx, "default", &certificateauthority.CaPoolIamMemberArgs{
CaPool: _default.ID(),
Role: pulumi.String("roles/privateca.certificateManager"),
Member: nsSa.Email.ApplyT(func(email string) (string, error) {
return fmt.Sprintf("serviceAccount:%v", email), nil
}).(pulumi.StringOutput),
})
if err != nil {
return err
}
invokeFile, err := std.File(ctx, &std.FileArgs{
Input: "test-fixtures/ca_cert.pem",
}, nil)
if err != nil {
return err
}
invokeFile1, err := std.File(ctx, &std.FileArgs{
Input: "test-fixtures/ca_cert.pem",
}, nil)
if err != nil {
return err
}
defaultTrustConfig, err := certificatemanager.NewTrustConfig(ctx, "default", &certificatemanager.TrustConfigArgs{
Name: pulumi.String("my-trust-config"),
Description: pulumi.String("sample trust config description"),
Location: pulumi.String("us-central1"),
TrustStores: certificatemanager.TrustConfigTrustStoreArray{
&certificatemanager.TrustConfigTrustStoreArgs{
TrustAnchors: certificatemanager.TrustConfigTrustStoreTrustAnchorArray{
&certificatemanager.TrustConfigTrustStoreTrustAnchorArgs{
PemCertificate: invokeFile.Result,
},
},
IntermediateCas: certificatemanager.TrustConfigTrustStoreIntermediateCaArray{
&certificatemanager.TrustConfigTrustStoreIntermediateCaArgs{
PemCertificate: invokeFile1.Result,
},
},
},
},
})
if err != nil {
return err
}
_, err = networksecurity.NewTlsInspectionPolicy(ctx, "default", &networksecurity.TlsInspectionPolicyArgs{
Name: pulumi.String("my-tls-inspection-policy"),
Location: pulumi.String("us-central1"),
CaPool: _default.ID(),
ExcludePublicCaSet: pulumi.Bool(false),
MinTlsVersion: pulumi.String("TLS_1_0"),
TrustConfig: defaultTrustConfig.ID(),
TlsFeatureProfile: pulumi.String("PROFILE_CUSTOM"),
CustomTlsFeatures: pulumi.StringArray{
pulumi.String("TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA"),
pulumi.String("TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"),
pulumi.String("TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA"),
pulumi.String("TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"),
pulumi.String("TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"),
pulumi.String("TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"),
pulumi.String("TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"),
pulumi.String("TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"),
pulumi.String("TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"),
pulumi.String("TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"),
pulumi.String("TLS_RSA_WITH_3DES_EDE_CBC_SHA"),
pulumi.String("TLS_RSA_WITH_AES_128_CBC_SHA"),
pulumi.String("TLS_RSA_WITH_AES_128_GCM_SHA256"),
pulumi.String("TLS_RSA_WITH_AES_256_CBC_SHA"),
pulumi.String("TLS_RSA_WITH_AES_256_GCM_SHA384"),
},
}, pulumi.DependsOn([]pulumi.Resource{
defaultAuthority,
defaultCaPoolIamMember,
}))
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
using Std = Pulumi.Std;
return await Deployment.RunAsync(() =>
{
var @default = new Gcp.CertificateAuthority.CaPool("default", new()
{
Name = "my-basic-ca-pool",
Location = "us-central1",
Tier = "DEVOPS",
PublishingOptions = new Gcp.CertificateAuthority.Inputs.CaPoolPublishingOptionsArgs
{
PublishCaCert = false,
PublishCrl = false,
},
IssuancePolicy = new Gcp.CertificateAuthority.Inputs.CaPoolIssuancePolicyArgs
{
MaximumLifetime = "1209600s",
BaselineValues = new Gcp.CertificateAuthority.Inputs.CaPoolIssuancePolicyBaselineValuesArgs
{
CaOptions = new Gcp.CertificateAuthority.Inputs.CaPoolIssuancePolicyBaselineValuesCaOptionsArgs
{
IsCa = false,
},
KeyUsage = new Gcp.CertificateAuthority.Inputs.CaPoolIssuancePolicyBaselineValuesKeyUsageArgs
{
BaseKeyUsage = null,
ExtendedKeyUsage = new Gcp.CertificateAuthority.Inputs.CaPoolIssuancePolicyBaselineValuesKeyUsageExtendedKeyUsageArgs
{
ServerAuth = true,
},
},
},
},
});
var defaultAuthority = new Gcp.CertificateAuthority.Authority("default", new()
{
Pool = @default.Name,
CertificateAuthorityId = "my-basic-certificate-authority",
Location = "us-central1",
Lifetime = "86400s",
Type = "SELF_SIGNED",
DeletionProtection = false,
SkipGracePeriod = true,
IgnoreActiveCertificatesOnDeletion = true,
Config = new Gcp.CertificateAuthority.Inputs.AuthorityConfigArgs
{
SubjectConfig = new Gcp.CertificateAuthority.Inputs.AuthorityConfigSubjectConfigArgs
{
Subject = new Gcp.CertificateAuthority.Inputs.AuthorityConfigSubjectConfigSubjectArgs
{
Organization = "Test LLC",
CommonName = "my-ca",
},
},
X509Config = new Gcp.CertificateAuthority.Inputs.AuthorityConfigX509ConfigArgs
{
CaOptions = new Gcp.CertificateAuthority.Inputs.AuthorityConfigX509ConfigCaOptionsArgs
{
IsCa = true,
},
KeyUsage = new Gcp.CertificateAuthority.Inputs.AuthorityConfigX509ConfigKeyUsageArgs
{
BaseKeyUsage = new Gcp.CertificateAuthority.Inputs.AuthorityConfigX509ConfigKeyUsageBaseKeyUsageArgs
{
CertSign = true,
CrlSign = true,
},
ExtendedKeyUsage = new Gcp.CertificateAuthority.Inputs.AuthorityConfigX509ConfigKeyUsageExtendedKeyUsageArgs
{
ServerAuth = false,
},
},
},
},
KeySpec = new Gcp.CertificateAuthority.Inputs.AuthorityKeySpecArgs
{
Algorithm = "RSA_PKCS1_4096_SHA256",
},
});
var nsSa = new Gcp.Projects.ServiceIdentity("ns_sa", new()
{
Service = "networksecurity.googleapis.com",
});
var defaultCaPoolIamMember = new Gcp.CertificateAuthority.CaPoolIamMember("default", new()
{
CaPool = @default.Id,
Role = "roles/privateca.certificateManager",
Member = nsSa.Email.Apply(email => $"serviceAccount:{email}"),
});
var defaultTrustConfig = new Gcp.CertificateManager.TrustConfig("default", new()
{
Name = "my-trust-config",
Description = "sample trust config description",
Location = "us-central1",
TrustStores = new[]
{
new Gcp.CertificateManager.Inputs.TrustConfigTrustStoreArgs
{
TrustAnchors = new[]
{
new Gcp.CertificateManager.Inputs.TrustConfigTrustStoreTrustAnchorArgs
{
PemCertificate = Std.File.Invoke(new()
{
Input = "test-fixtures/ca_cert.pem",
}).Apply(invoke => invoke.Result),
},
},
IntermediateCas = new[]
{
new Gcp.CertificateManager.Inputs.TrustConfigTrustStoreIntermediateCaArgs
{
PemCertificate = Std.File.Invoke(new()
{
Input = "test-fixtures/ca_cert.pem",
}).Apply(invoke => invoke.Result),
},
},
},
},
});
var defaultTlsInspectionPolicy = new Gcp.NetworkSecurity.TlsInspectionPolicy("default", new()
{
Name = "my-tls-inspection-policy",
Location = "us-central1",
CaPool = @default.Id,
ExcludePublicCaSet = false,
MinTlsVersion = "TLS_1_0",
TrustConfig = defaultTrustConfig.Id,
TlsFeatureProfile = "PROFILE_CUSTOM",
CustomTlsFeatures = new[]
{
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
"TLS_RSA_WITH_3DES_EDE_CBC_SHA",
"TLS_RSA_WITH_AES_128_CBC_SHA",
"TLS_RSA_WITH_AES_128_GCM_SHA256",
"TLS_RSA_WITH_AES_256_CBC_SHA",
"TLS_RSA_WITH_AES_256_GCM_SHA384",
},
}, new CustomResourceOptions
{
DependsOn =
{
defaultAuthority,
defaultCaPoolIamMember,
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.certificateauthority.CaPool;
import com.pulumi.gcp.certificateauthority.CaPoolArgs;
import com.pulumi.gcp.certificateauthority.inputs.CaPoolPublishingOptionsArgs;
import com.pulumi.gcp.certificateauthority.inputs.CaPoolIssuancePolicyArgs;
import com.pulumi.gcp.certificateauthority.inputs.CaPoolIssuancePolicyBaselineValuesArgs;
import com.pulumi.gcp.certificateauthority.inputs.CaPoolIssuancePolicyBaselineValuesCaOptionsArgs;
import com.pulumi.gcp.certificateauthority.inputs.CaPoolIssuancePolicyBaselineValuesKeyUsageArgs;
import com.pulumi.gcp.certificateauthority.inputs.CaPoolIssuancePolicyBaselineValuesKeyUsageBaseKeyUsageArgs;
import com.pulumi.gcp.certificateauthority.inputs.CaPoolIssuancePolicyBaselineValuesKeyUsageExtendedKeyUsageArgs;
import com.pulumi.gcp.certificateauthority.Authority;
import com.pulumi.gcp.certificateauthority.AuthorityArgs;
import com.pulumi.gcp.certificateauthority.inputs.AuthorityConfigArgs;
import com.pulumi.gcp.certificateauthority.inputs.AuthorityConfigSubjectConfigArgs;
import com.pulumi.gcp.certificateauthority.inputs.AuthorityConfigSubjectConfigSubjectArgs;
import com.pulumi.gcp.certificateauthority.inputs.AuthorityConfigX509ConfigArgs;
import com.pulumi.gcp.certificateauthority.inputs.AuthorityConfigX509ConfigCaOptionsArgs;
import com.pulumi.gcp.certificateauthority.inputs.AuthorityConfigX509ConfigKeyUsageArgs;
import com.pulumi.gcp.certificateauthority.inputs.AuthorityConfigX509ConfigKeyUsageBaseKeyUsageArgs;
import com.pulumi.gcp.certificateauthority.inputs.AuthorityConfigX509ConfigKeyUsageExtendedKeyUsageArgs;
import com.pulumi.gcp.certificateauthority.inputs.AuthorityKeySpecArgs;
import com.pulumi.gcp.projects.ServiceIdentity;
import com.pulumi.gcp.projects.ServiceIdentityArgs;
import com.pulumi.gcp.certificateauthority.CaPoolIamMember;
import com.pulumi.gcp.certificateauthority.CaPoolIamMemberArgs;
import com.pulumi.gcp.certificatemanager.TrustConfig;
import com.pulumi.gcp.certificatemanager.TrustConfigArgs;
import com.pulumi.gcp.certificatemanager.inputs.TrustConfigTrustStoreArgs;
import com.pulumi.gcp.networksecurity.TlsInspectionPolicy;
import com.pulumi.gcp.networksecurity.TlsInspectionPolicyArgs;
import com.pulumi.resources.CustomResourceOptions;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var default_ = new CaPool("default", CaPoolArgs.builder()
.name("my-basic-ca-pool")
.location("us-central1")
.tier("DEVOPS")
.publishingOptions(CaPoolPublishingOptionsArgs.builder()
.publishCaCert(false)
.publishCrl(false)
.build())
.issuancePolicy(CaPoolIssuancePolicyArgs.builder()
.maximumLifetime("1209600s")
.baselineValues(CaPoolIssuancePolicyBaselineValuesArgs.builder()
.caOptions(CaPoolIssuancePolicyBaselineValuesCaOptionsArgs.builder()
.isCa(false)
.build())
.keyUsage(CaPoolIssuancePolicyBaselineValuesKeyUsageArgs.builder()
.baseKeyUsage()
.extendedKeyUsage(CaPoolIssuancePolicyBaselineValuesKeyUsageExtendedKeyUsageArgs.builder()
.serverAuth(true)
.build())
.build())
.build())
.build())
.build());
var defaultAuthority = new Authority("defaultAuthority", AuthorityArgs.builder()
.pool(default_.name())
.certificateAuthorityId("my-basic-certificate-authority")
.location("us-central1")
.lifetime("86400s")
.type("SELF_SIGNED")
.deletionProtection(false)
.skipGracePeriod(true)
.ignoreActiveCertificatesOnDeletion(true)
.config(AuthorityConfigArgs.builder()
.subjectConfig(AuthorityConfigSubjectConfigArgs.builder()
.subject(AuthorityConfigSubjectConfigSubjectArgs.builder()
.organization("Test LLC")
.commonName("my-ca")
.build())
.build())
.x509Config(AuthorityConfigX509ConfigArgs.builder()
.caOptions(AuthorityConfigX509ConfigCaOptionsArgs.builder()
.isCa(true)
.build())
.keyUsage(AuthorityConfigX509ConfigKeyUsageArgs.builder()
.baseKeyUsage(AuthorityConfigX509ConfigKeyUsageBaseKeyUsageArgs.builder()
.certSign(true)
.crlSign(true)
.build())
.extendedKeyUsage(AuthorityConfigX509ConfigKeyUsageExtendedKeyUsageArgs.builder()
.serverAuth(false)
.build())
.build())
.build())
.build())
.keySpec(AuthorityKeySpecArgs.builder()
.algorithm("RSA_PKCS1_4096_SHA256")
.build())
.build());
var nsSa = new ServiceIdentity("nsSa", ServiceIdentityArgs.builder()
.service("networksecurity.googleapis.com")
.build());
var defaultCaPoolIamMember = new CaPoolIamMember("defaultCaPoolIamMember", CaPoolIamMemberArgs.builder()
.caPool(default_.id())
.role("roles/privateca.certificateManager")
.member(nsSa.email().applyValue(email -> String.format("serviceAccount:%s", email)))
.build());
var defaultTrustConfig = new TrustConfig("defaultTrustConfig", TrustConfigArgs.builder()
.name("my-trust-config")
.description("sample trust config description")
.location("us-central1")
.trustStores(TrustConfigTrustStoreArgs.builder()
.trustAnchors(TrustConfigTrustStoreTrustAnchorArgs.builder()
.pemCertificate(StdFunctions.file(FileArgs.builder()
.input("test-fixtures/ca_cert.pem")
.build()).result())
.build())
.intermediateCas(TrustConfigTrustStoreIntermediateCaArgs.builder()
.pemCertificate(StdFunctions.file(FileArgs.builder()
.input("test-fixtures/ca_cert.pem")
.build()).result())
.build())
.build())
.build());
var defaultTlsInspectionPolicy = new TlsInspectionPolicy("defaultTlsInspectionPolicy", TlsInspectionPolicyArgs.builder()
.name("my-tls-inspection-policy")
.location("us-central1")
.caPool(default_.id())
.excludePublicCaSet(false)
.minTlsVersion("TLS_1_0")
.trustConfig(defaultTrustConfig.id())
.tlsFeatureProfile("PROFILE_CUSTOM")
.customTlsFeatures(
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
"TLS_RSA_WITH_3DES_EDE_CBC_SHA",
"TLS_RSA_WITH_AES_128_CBC_SHA",
"TLS_RSA_WITH_AES_128_GCM_SHA256",
"TLS_RSA_WITH_AES_256_CBC_SHA",
"TLS_RSA_WITH_AES_256_GCM_SHA384")
.build(), CustomResourceOptions.builder()
.dependsOn(
defaultAuthority,
defaultCaPoolIamMember)
.build());
}
}
resources:
default:
type: gcp:certificateauthority:CaPool
properties:
name: my-basic-ca-pool
location: us-central1
tier: DEVOPS
publishingOptions:
publishCaCert: false
publishCrl: false
issuancePolicy:
maximumLifetime: 1209600s
baselineValues:
caOptions:
isCa: false
keyUsage:
baseKeyUsage: {}
extendedKeyUsage:
serverAuth: true
defaultAuthority:
type: gcp:certificateauthority:Authority
name: default
properties:
pool: ${default.name}
certificateAuthorityId: my-basic-certificate-authority
location: us-central1
lifetime: 86400s
type: SELF_SIGNED
deletionProtection: false
skipGracePeriod: true
ignoreActiveCertificatesOnDeletion: true
config:
subjectConfig:
subject:
organization: Test LLC
commonName: my-ca
x509Config:
caOptions:
isCa: true
keyUsage:
baseKeyUsage:
certSign: true
crlSign: true
extendedKeyUsage:
serverAuth: false
keySpec:
algorithm: RSA_PKCS1_4096_SHA256
nsSa:
type: gcp:projects:ServiceIdentity
name: ns_sa
properties:
service: networksecurity.googleapis.com
defaultCaPoolIamMember:
type: gcp:certificateauthority:CaPoolIamMember
name: default
properties:
caPool: ${default.id}
role: roles/privateca.certificateManager
member: serviceAccount:${nsSa.email}
defaultTrustConfig:
type: gcp:certificatemanager:TrustConfig
name: default
properties:
name: my-trust-config
description: sample trust config description
location: us-central1
trustStores:
- trustAnchors:
- pemCertificate:
fn::invoke:
Function: std:file
Arguments:
input: test-fixtures/ca_cert.pem
Return: result
intermediateCas:
- pemCertificate:
fn::invoke:
Function: std:file
Arguments:
input: test-fixtures/ca_cert.pem
Return: result
defaultTlsInspectionPolicy:
type: gcp:networksecurity:TlsInspectionPolicy
name: default
properties:
name: my-tls-inspection-policy
location: us-central1
caPool: ${default.id}
excludePublicCaSet: false
minTlsVersion: TLS_1_0
trustConfig: ${defaultTrustConfig.id}
tlsFeatureProfile: PROFILE_CUSTOM
customTlsFeatures:
- TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
- TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
- TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
- TLS_RSA_WITH_3DES_EDE_CBC_SHA
- TLS_RSA_WITH_AES_128_CBC_SHA
- TLS_RSA_WITH_AES_128_GCM_SHA256
- TLS_RSA_WITH_AES_256_CBC_SHA
- TLS_RSA_WITH_AES_256_GCM_SHA384
options:
dependson:
- ${defaultAuthority}
- ${defaultCaPoolIamMember}
Create TlsInspectionPolicy Resource
Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.
Constructor syntax
new TlsInspectionPolicy(name: string, args: TlsInspectionPolicyArgs, opts?: CustomResourceOptions);@overload
def TlsInspectionPolicy(resource_name: str,
args: TlsInspectionPolicyArgs,
opts: Optional[ResourceOptions] = None)
@overload
def TlsInspectionPolicy(resource_name: str,
opts: Optional[ResourceOptions] = None,
ca_pool: Optional[str] = None,
custom_tls_features: Optional[Sequence[str]] = None,
description: Optional[str] = None,
exclude_public_ca_set: Optional[bool] = None,
location: Optional[str] = None,
min_tls_version: Optional[str] = None,
name: Optional[str] = None,
project: Optional[str] = None,
tls_feature_profile: Optional[str] = None,
trust_config: Optional[str] = None)func NewTlsInspectionPolicy(ctx *Context, name string, args TlsInspectionPolicyArgs, opts ...ResourceOption) (*TlsInspectionPolicy, error)public TlsInspectionPolicy(string name, TlsInspectionPolicyArgs args, CustomResourceOptions? opts = null)
public TlsInspectionPolicy(String name, TlsInspectionPolicyArgs args)
public TlsInspectionPolicy(String name, TlsInspectionPolicyArgs args, CustomResourceOptions options)
type: gcp:networksecurity:TlsInspectionPolicy
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
Parameters
- name string
- The unique name of the resource.
- args TlsInspectionPolicyArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name str
- The unique name of the resource.
- args TlsInspectionPolicyArgs
- The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name string
- The unique name of the resource.
- args TlsInspectionPolicyArgs
- The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args TlsInspectionPolicyArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name String
- The unique name of the resource.
- args TlsInspectionPolicyArgs
- The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
Constructor example
The following reference example uses placeholder values for all input properties.
var tlsInspectionPolicyResource = new Gcp.NetworkSecurity.TlsInspectionPolicy("tlsInspectionPolicyResource", new()
{
CaPool = "string",
CustomTlsFeatures = new[]
{
"string",
},
Description = "string",
ExcludePublicCaSet = false,
Location = "string",
MinTlsVersion = "string",
Name = "string",
Project = "string",
TlsFeatureProfile = "string",
TrustConfig = "string",
});
example, err := networksecurity.NewTlsInspectionPolicy(ctx, "tlsInspectionPolicyResource", &networksecurity.TlsInspectionPolicyArgs{
CaPool: pulumi.String("string"),
CustomTlsFeatures: pulumi.StringArray{
pulumi.String("string"),
},
Description: pulumi.String("string"),
ExcludePublicCaSet: pulumi.Bool(false),
Location: pulumi.String("string"),
MinTlsVersion: pulumi.String("string"),
Name: pulumi.String("string"),
Project: pulumi.String("string"),
TlsFeatureProfile: pulumi.String("string"),
TrustConfig: pulumi.String("string"),
})
var tlsInspectionPolicyResource = new TlsInspectionPolicy("tlsInspectionPolicyResource", TlsInspectionPolicyArgs.builder()
.caPool("string")
.customTlsFeatures("string")
.description("string")
.excludePublicCaSet(false)
.location("string")
.minTlsVersion("string")
.name("string")
.project("string")
.tlsFeatureProfile("string")
.trustConfig("string")
.build());
tls_inspection_policy_resource = gcp.networksecurity.TlsInspectionPolicy("tlsInspectionPolicyResource",
ca_pool="string",
custom_tls_features=["string"],
description="string",
exclude_public_ca_set=False,
location="string",
min_tls_version="string",
name="string",
project="string",
tls_feature_profile="string",
trust_config="string")
const tlsInspectionPolicyResource = new gcp.networksecurity.TlsInspectionPolicy("tlsInspectionPolicyResource", {
caPool: "string",
customTlsFeatures: ["string"],
description: "string",
excludePublicCaSet: false,
location: "string",
minTlsVersion: "string",
name: "string",
project: "string",
tlsFeatureProfile: "string",
trustConfig: "string",
});
type: gcp:networksecurity:TlsInspectionPolicy
properties:
caPool: string
customTlsFeatures:
- string
description: string
excludePublicCaSet: false
location: string
minTlsVersion: string
name: string
project: string
tlsFeatureProfile: string
trustConfig: string
TlsInspectionPolicy Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
The TlsInspectionPolicy resource accepts the following input properties:
- Ca
Pool string - A CA pool resource used to issue interception certificates.
- Custom
Tls List<string>Features - List of custom TLS cipher suites selected. This field is valid only if the selected tls_feature_profile is CUSTOM. The compute.SslPoliciesService.ListAvailableFeatures method returns the set of features that can be specified in this list. Note that Secure Web Proxy does not yet honor this field.
- Description string
- Free-text description of the resource.
- Exclude
Public boolCa Set - If FALSE (the default), use our default set of public CAs in addition to any CAs specified in trustConfig. These public CAs are currently based on the Mozilla Root Program and are subject to change over time. If TRUE, do not accept our default set of public CAs. Only CAs specified in trustConfig will be accepted.
- Location string
- The location of the tls inspection policy.
- Min
Tls stringVersion - Minimum TLS version that the firewall should use when negotiating connections with both clients and servers. If this is not set, then the default value is to allow the broadest set of clients and servers (TLS 1.0 or higher). Setting this to more restrictive values may improve security, but may also prevent the firewall from connecting to some clients or servers. Note that Secure Web Proxy does not yet honor this field.
Possible values are:
TLS_VERSION_UNSPECIFIED,TLS_1_0,TLS_1_1,TLS_1_2,TLS_1_3. - Name string
- Short name of the TlsInspectionPolicy resource to be created.
- Project string
- The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
- Tls
Feature stringProfile - The selected Profile. If this is not set, then the default value is to allow the broadest set of clients and servers ("PROFILE_COMPATIBLE"). Setting this to more restrictive values may improve security, but may also prevent the TLS inspection proxy from connecting to some clients or servers. Note that Secure Web Proxy does not yet honor this field.
Possible values are:
PROFILE_UNSPECIFIED,PROFILE_COMPATIBLE,PROFILE_MODERN,PROFILE_RESTRICTED,PROFILE_CUSTOM. - Trust
Config string - A TrustConfig resource used when making a connection to the TLS server. This is a relative resource path following the form "projects/{project}/locations/{location}/trustConfigs/{trust_config}". This is necessary to intercept TLS connections to servers with certificates signed by a private CA or self-signed certificates. Trust config and the TLS inspection policy must be in the same region. Note that Secure Web Proxy does not yet honor this field.
- Ca
Pool string - A CA pool resource used to issue interception certificates.
- Custom
Tls []stringFeatures - List of custom TLS cipher suites selected. This field is valid only if the selected tls_feature_profile is CUSTOM. The compute.SslPoliciesService.ListAvailableFeatures method returns the set of features that can be specified in this list. Note that Secure Web Proxy does not yet honor this field.
- Description string
- Free-text description of the resource.
- Exclude
Public boolCa Set - If FALSE (the default), use our default set of public CAs in addition to any CAs specified in trustConfig. These public CAs are currently based on the Mozilla Root Program and are subject to change over time. If TRUE, do not accept our default set of public CAs. Only CAs specified in trustConfig will be accepted.
- Location string
- The location of the tls inspection policy.
- Min
Tls stringVersion - Minimum TLS version that the firewall should use when negotiating connections with both clients and servers. If this is not set, then the default value is to allow the broadest set of clients and servers (TLS 1.0 or higher). Setting this to more restrictive values may improve security, but may also prevent the firewall from connecting to some clients or servers. Note that Secure Web Proxy does not yet honor this field.
Possible values are:
TLS_VERSION_UNSPECIFIED,TLS_1_0,TLS_1_1,TLS_1_2,TLS_1_3. - Name string
- Short name of the TlsInspectionPolicy resource to be created.
- Project string
- The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
- Tls
Feature stringProfile - The selected Profile. If this is not set, then the default value is to allow the broadest set of clients and servers ("PROFILE_COMPATIBLE"). Setting this to more restrictive values may improve security, but may also prevent the TLS inspection proxy from connecting to some clients or servers. Note that Secure Web Proxy does not yet honor this field.
Possible values are:
PROFILE_UNSPECIFIED,PROFILE_COMPATIBLE,PROFILE_MODERN,PROFILE_RESTRICTED,PROFILE_CUSTOM. - Trust
Config string - A TrustConfig resource used when making a connection to the TLS server. This is a relative resource path following the form "projects/{project}/locations/{location}/trustConfigs/{trust_config}". This is necessary to intercept TLS connections to servers with certificates signed by a private CA or self-signed certificates. Trust config and the TLS inspection policy must be in the same region. Note that Secure Web Proxy does not yet honor this field.
- ca
Pool String - A CA pool resource used to issue interception certificates.
- custom
Tls List<String>Features - List of custom TLS cipher suites selected. This field is valid only if the selected tls_feature_profile is CUSTOM. The compute.SslPoliciesService.ListAvailableFeatures method returns the set of features that can be specified in this list. Note that Secure Web Proxy does not yet honor this field.
- description String
- Free-text description of the resource.
- exclude
Public BooleanCa Set - If FALSE (the default), use our default set of public CAs in addition to any CAs specified in trustConfig. These public CAs are currently based on the Mozilla Root Program and are subject to change over time. If TRUE, do not accept our default set of public CAs. Only CAs specified in trustConfig will be accepted.
- location String
- The location of the tls inspection policy.
- min
Tls StringVersion - Minimum TLS version that the firewall should use when negotiating connections with both clients and servers. If this is not set, then the default value is to allow the broadest set of clients and servers (TLS 1.0 or higher). Setting this to more restrictive values may improve security, but may also prevent the firewall from connecting to some clients or servers. Note that Secure Web Proxy does not yet honor this field.
Possible values are:
TLS_VERSION_UNSPECIFIED,TLS_1_0,TLS_1_1,TLS_1_2,TLS_1_3. - name String
- Short name of the TlsInspectionPolicy resource to be created.
- project String
- The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
- tls
Feature StringProfile - The selected Profile. If this is not set, then the default value is to allow the broadest set of clients and servers ("PROFILE_COMPATIBLE"). Setting this to more restrictive values may improve security, but may also prevent the TLS inspection proxy from connecting to some clients or servers. Note that Secure Web Proxy does not yet honor this field.
Possible values are:
PROFILE_UNSPECIFIED,PROFILE_COMPATIBLE,PROFILE_MODERN,PROFILE_RESTRICTED,PROFILE_CUSTOM. - trust
Config String - A TrustConfig resource used when making a connection to the TLS server. This is a relative resource path following the form "projects/{project}/locations/{location}/trustConfigs/{trust_config}". This is necessary to intercept TLS connections to servers with certificates signed by a private CA or self-signed certificates. Trust config and the TLS inspection policy must be in the same region. Note that Secure Web Proxy does not yet honor this field.
- ca
Pool string - A CA pool resource used to issue interception certificates.
- custom
Tls string[]Features - List of custom TLS cipher suites selected. This field is valid only if the selected tls_feature_profile is CUSTOM. The compute.SslPoliciesService.ListAvailableFeatures method returns the set of features that can be specified in this list. Note that Secure Web Proxy does not yet honor this field.
- description string
- Free-text description of the resource.
- exclude
Public booleanCa Set - If FALSE (the default), use our default set of public CAs in addition to any CAs specified in trustConfig. These public CAs are currently based on the Mozilla Root Program and are subject to change over time. If TRUE, do not accept our default set of public CAs. Only CAs specified in trustConfig will be accepted.
- location string
- The location of the tls inspection policy.
- min
Tls stringVersion - Minimum TLS version that the firewall should use when negotiating connections with both clients and servers. If this is not set, then the default value is to allow the broadest set of clients and servers (TLS 1.0 or higher). Setting this to more restrictive values may improve security, but may also prevent the firewall from connecting to some clients or servers. Note that Secure Web Proxy does not yet honor this field.
Possible values are:
TLS_VERSION_UNSPECIFIED,TLS_1_0,TLS_1_1,TLS_1_2,TLS_1_3. - name string
- Short name of the TlsInspectionPolicy resource to be created.
- project string
- The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
- tls
Feature stringProfile - The selected Profile. If this is not set, then the default value is to allow the broadest set of clients and servers ("PROFILE_COMPATIBLE"). Setting this to more restrictive values may improve security, but may also prevent the TLS inspection proxy from connecting to some clients or servers. Note that Secure Web Proxy does not yet honor this field.
Possible values are:
PROFILE_UNSPECIFIED,PROFILE_COMPATIBLE,PROFILE_MODERN,PROFILE_RESTRICTED,PROFILE_CUSTOM. - trust
Config string - A TrustConfig resource used when making a connection to the TLS server. This is a relative resource path following the form "projects/{project}/locations/{location}/trustConfigs/{trust_config}". This is necessary to intercept TLS connections to servers with certificates signed by a private CA or self-signed certificates. Trust config and the TLS inspection policy must be in the same region. Note that Secure Web Proxy does not yet honor this field.
- ca_
pool str - A CA pool resource used to issue interception certificates.
- custom_
tls_ Sequence[str]features - List of custom TLS cipher suites selected. This field is valid only if the selected tls_feature_profile is CUSTOM. The compute.SslPoliciesService.ListAvailableFeatures method returns the set of features that can be specified in this list. Note that Secure Web Proxy does not yet honor this field.
- description str
- Free-text description of the resource.
- exclude_
public_ boolca_ set - If FALSE (the default), use our default set of public CAs in addition to any CAs specified in trustConfig. These public CAs are currently based on the Mozilla Root Program and are subject to change over time. If TRUE, do not accept our default set of public CAs. Only CAs specified in trustConfig will be accepted.
- location str
- The location of the tls inspection policy.
- min_
tls_ strversion - Minimum TLS version that the firewall should use when negotiating connections with both clients and servers. If this is not set, then the default value is to allow the broadest set of clients and servers (TLS 1.0 or higher). Setting this to more restrictive values may improve security, but may also prevent the firewall from connecting to some clients or servers. Note that Secure Web Proxy does not yet honor this field.
Possible values are:
TLS_VERSION_UNSPECIFIED,TLS_1_0,TLS_1_1,TLS_1_2,TLS_1_3. - name str
- Short name of the TlsInspectionPolicy resource to be created.
- project str
- The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
- tls_
feature_ strprofile - The selected Profile. If this is not set, then the default value is to allow the broadest set of clients and servers ("PROFILE_COMPATIBLE"). Setting this to more restrictive values may improve security, but may also prevent the TLS inspection proxy from connecting to some clients or servers. Note that Secure Web Proxy does not yet honor this field.
Possible values are:
PROFILE_UNSPECIFIED,PROFILE_COMPATIBLE,PROFILE_MODERN,PROFILE_RESTRICTED,PROFILE_CUSTOM. - trust_
config str - A TrustConfig resource used when making a connection to the TLS server. This is a relative resource path following the form "projects/{project}/locations/{location}/trustConfigs/{trust_config}". This is necessary to intercept TLS connections to servers with certificates signed by a private CA or self-signed certificates. Trust config and the TLS inspection policy must be in the same region. Note that Secure Web Proxy does not yet honor this field.
- ca
Pool String - A CA pool resource used to issue interception certificates.
- custom
Tls List<String>Features - List of custom TLS cipher suites selected. This field is valid only if the selected tls_feature_profile is CUSTOM. The compute.SslPoliciesService.ListAvailableFeatures method returns the set of features that can be specified in this list. Note that Secure Web Proxy does not yet honor this field.
- description String
- Free-text description of the resource.
- exclude
Public BooleanCa Set - If FALSE (the default), use our default set of public CAs in addition to any CAs specified in trustConfig. These public CAs are currently based on the Mozilla Root Program and are subject to change over time. If TRUE, do not accept our default set of public CAs. Only CAs specified in trustConfig will be accepted.
- location String
- The location of the tls inspection policy.
- min
Tls StringVersion - Minimum TLS version that the firewall should use when negotiating connections with both clients and servers. If this is not set, then the default value is to allow the broadest set of clients and servers (TLS 1.0 or higher). Setting this to more restrictive values may improve security, but may also prevent the firewall from connecting to some clients or servers. Note that Secure Web Proxy does not yet honor this field.
Possible values are:
TLS_VERSION_UNSPECIFIED,TLS_1_0,TLS_1_1,TLS_1_2,TLS_1_3. - name String
- Short name of the TlsInspectionPolicy resource to be created.
- project String
- The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
- tls
Feature StringProfile - The selected Profile. If this is not set, then the default value is to allow the broadest set of clients and servers ("PROFILE_COMPATIBLE"). Setting this to more restrictive values may improve security, but may also prevent the TLS inspection proxy from connecting to some clients or servers. Note that Secure Web Proxy does not yet honor this field.
Possible values are:
PROFILE_UNSPECIFIED,PROFILE_COMPATIBLE,PROFILE_MODERN,PROFILE_RESTRICTED,PROFILE_CUSTOM. - trust
Config String - A TrustConfig resource used when making a connection to the TLS server. This is a relative resource path following the form "projects/{project}/locations/{location}/trustConfigs/{trust_config}". This is necessary to intercept TLS connections to servers with certificates signed by a private CA or self-signed certificates. Trust config and the TLS inspection policy must be in the same region. Note that Secure Web Proxy does not yet honor this field.
Outputs
All input properties are implicitly available as output properties. Additionally, the TlsInspectionPolicy resource produces the following output properties:
- Create
Time string - The timestamp when the resource was created.
- Id string
- The provider-assigned unique ID for this managed resource.
- Update
Time string - The timestamp when the resource was updated.
- Create
Time string - The timestamp when the resource was created.
- Id string
- The provider-assigned unique ID for this managed resource.
- Update
Time string - The timestamp when the resource was updated.
- create
Time String - The timestamp when the resource was created.
- id String
- The provider-assigned unique ID for this managed resource.
- update
Time String - The timestamp when the resource was updated.
- create
Time string - The timestamp when the resource was created.
- id string
- The provider-assigned unique ID for this managed resource.
- update
Time string - The timestamp when the resource was updated.
- create_
time str - The timestamp when the resource was created.
- id str
- The provider-assigned unique ID for this managed resource.
- update_
time str - The timestamp when the resource was updated.
- create
Time String - The timestamp when the resource was created.
- id String
- The provider-assigned unique ID for this managed resource.
- update
Time String - The timestamp when the resource was updated.
Look up Existing TlsInspectionPolicy Resource
Get an existing TlsInspectionPolicy resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.
public static get(name: string, id: Input<ID>, state?: TlsInspectionPolicyState, opts?: CustomResourceOptions): TlsInspectionPolicy@staticmethod
def get(resource_name: str,
id: str,
opts: Optional[ResourceOptions] = None,
ca_pool: Optional[str] = None,
create_time: Optional[str] = None,
custom_tls_features: Optional[Sequence[str]] = None,
description: Optional[str] = None,
exclude_public_ca_set: Optional[bool] = None,
location: Optional[str] = None,
min_tls_version: Optional[str] = None,
name: Optional[str] = None,
project: Optional[str] = None,
tls_feature_profile: Optional[str] = None,
trust_config: Optional[str] = None,
update_time: Optional[str] = None) -> TlsInspectionPolicyfunc GetTlsInspectionPolicy(ctx *Context, name string, id IDInput, state *TlsInspectionPolicyState, opts ...ResourceOption) (*TlsInspectionPolicy, error)public static TlsInspectionPolicy Get(string name, Input<string> id, TlsInspectionPolicyState? state, CustomResourceOptions? opts = null)public static TlsInspectionPolicy get(String name, Output<String> id, TlsInspectionPolicyState state, CustomResourceOptions options)Resource lookup is not supported in YAML- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- resource_name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- Ca
Pool string - A CA pool resource used to issue interception certificates.
- Create
Time string - The timestamp when the resource was created.
- Custom
Tls List<string>Features - List of custom TLS cipher suites selected. This field is valid only if the selected tls_feature_profile is CUSTOM. The compute.SslPoliciesService.ListAvailableFeatures method returns the set of features that can be specified in this list. Note that Secure Web Proxy does not yet honor this field.
- Description string
- Free-text description of the resource.
- Exclude
Public boolCa Set - If FALSE (the default), use our default set of public CAs in addition to any CAs specified in trustConfig. These public CAs are currently based on the Mozilla Root Program and are subject to change over time. If TRUE, do not accept our default set of public CAs. Only CAs specified in trustConfig will be accepted.
- Location string
- The location of the tls inspection policy.
- Min
Tls stringVersion - Minimum TLS version that the firewall should use when negotiating connections with both clients and servers. If this is not set, then the default value is to allow the broadest set of clients and servers (TLS 1.0 or higher). Setting this to more restrictive values may improve security, but may also prevent the firewall from connecting to some clients or servers. Note that Secure Web Proxy does not yet honor this field.
Possible values are:
TLS_VERSION_UNSPECIFIED,TLS_1_0,TLS_1_1,TLS_1_2,TLS_1_3. - Name string
- Short name of the TlsInspectionPolicy resource to be created.
- Project string
- The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
- Tls
Feature stringProfile - The selected Profile. If this is not set, then the default value is to allow the broadest set of clients and servers ("PROFILE_COMPATIBLE"). Setting this to more restrictive values may improve security, but may also prevent the TLS inspection proxy from connecting to some clients or servers. Note that Secure Web Proxy does not yet honor this field.
Possible values are:
PROFILE_UNSPECIFIED,PROFILE_COMPATIBLE,PROFILE_MODERN,PROFILE_RESTRICTED,PROFILE_CUSTOM. - Trust
Config string - A TrustConfig resource used when making a connection to the TLS server. This is a relative resource path following the form "projects/{project}/locations/{location}/trustConfigs/{trust_config}". This is necessary to intercept TLS connections to servers with certificates signed by a private CA or self-signed certificates. Trust config and the TLS inspection policy must be in the same region. Note that Secure Web Proxy does not yet honor this field.
- Update
Time string - The timestamp when the resource was updated.
- Ca
Pool string - A CA pool resource used to issue interception certificates.
- Create
Time string - The timestamp when the resource was created.
- Custom
Tls []stringFeatures - List of custom TLS cipher suites selected. This field is valid only if the selected tls_feature_profile is CUSTOM. The compute.SslPoliciesService.ListAvailableFeatures method returns the set of features that can be specified in this list. Note that Secure Web Proxy does not yet honor this field.
- Description string
- Free-text description of the resource.
- Exclude
Public boolCa Set - If FALSE (the default), use our default set of public CAs in addition to any CAs specified in trustConfig. These public CAs are currently based on the Mozilla Root Program and are subject to change over time. If TRUE, do not accept our default set of public CAs. Only CAs specified in trustConfig will be accepted.
- Location string
- The location of the tls inspection policy.
- Min
Tls stringVersion - Minimum TLS version that the firewall should use when negotiating connections with both clients and servers. If this is not set, then the default value is to allow the broadest set of clients and servers (TLS 1.0 or higher). Setting this to more restrictive values may improve security, but may also prevent the firewall from connecting to some clients or servers. Note that Secure Web Proxy does not yet honor this field.
Possible values are:
TLS_VERSION_UNSPECIFIED,TLS_1_0,TLS_1_1,TLS_1_2,TLS_1_3. - Name string
- Short name of the TlsInspectionPolicy resource to be created.
- Project string
- The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
- Tls
Feature stringProfile - The selected Profile. If this is not set, then the default value is to allow the broadest set of clients and servers ("PROFILE_COMPATIBLE"). Setting this to more restrictive values may improve security, but may also prevent the TLS inspection proxy from connecting to some clients or servers. Note that Secure Web Proxy does not yet honor this field.
Possible values are:
PROFILE_UNSPECIFIED,PROFILE_COMPATIBLE,PROFILE_MODERN,PROFILE_RESTRICTED,PROFILE_CUSTOM. - Trust
Config string - A TrustConfig resource used when making a connection to the TLS server. This is a relative resource path following the form "projects/{project}/locations/{location}/trustConfigs/{trust_config}". This is necessary to intercept TLS connections to servers with certificates signed by a private CA or self-signed certificates. Trust config and the TLS inspection policy must be in the same region. Note that Secure Web Proxy does not yet honor this field.
- Update
Time string - The timestamp when the resource was updated.
- ca
Pool String - A CA pool resource used to issue interception certificates.
- create
Time String - The timestamp when the resource was created.
- custom
Tls List<String>Features - List of custom TLS cipher suites selected. This field is valid only if the selected tls_feature_profile is CUSTOM. The compute.SslPoliciesService.ListAvailableFeatures method returns the set of features that can be specified in this list. Note that Secure Web Proxy does not yet honor this field.
- description String
- Free-text description of the resource.
- exclude
Public BooleanCa Set - If FALSE (the default), use our default set of public CAs in addition to any CAs specified in trustConfig. These public CAs are currently based on the Mozilla Root Program and are subject to change over time. If TRUE, do not accept our default set of public CAs. Only CAs specified in trustConfig will be accepted.
- location String
- The location of the tls inspection policy.
- min
Tls StringVersion - Minimum TLS version that the firewall should use when negotiating connections with both clients and servers. If this is not set, then the default value is to allow the broadest set of clients and servers (TLS 1.0 or higher). Setting this to more restrictive values may improve security, but may also prevent the firewall from connecting to some clients or servers. Note that Secure Web Proxy does not yet honor this field.
Possible values are:
TLS_VERSION_UNSPECIFIED,TLS_1_0,TLS_1_1,TLS_1_2,TLS_1_3. - name String
- Short name of the TlsInspectionPolicy resource to be created.
- project String
- The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
- tls
Feature StringProfile - The selected Profile. If this is not set, then the default value is to allow the broadest set of clients and servers ("PROFILE_COMPATIBLE"). Setting this to more restrictive values may improve security, but may also prevent the TLS inspection proxy from connecting to some clients or servers. Note that Secure Web Proxy does not yet honor this field.
Possible values are:
PROFILE_UNSPECIFIED,PROFILE_COMPATIBLE,PROFILE_MODERN,PROFILE_RESTRICTED,PROFILE_CUSTOM. - trust
Config String - A TrustConfig resource used when making a connection to the TLS server. This is a relative resource path following the form "projects/{project}/locations/{location}/trustConfigs/{trust_config}". This is necessary to intercept TLS connections to servers with certificates signed by a private CA or self-signed certificates. Trust config and the TLS inspection policy must be in the same region. Note that Secure Web Proxy does not yet honor this field.
- update
Time String - The timestamp when the resource was updated.
- ca
Pool string - A CA pool resource used to issue interception certificates.
- create
Time string - The timestamp when the resource was created.
- custom
Tls string[]Features - List of custom TLS cipher suites selected. This field is valid only if the selected tls_feature_profile is CUSTOM. The compute.SslPoliciesService.ListAvailableFeatures method returns the set of features that can be specified in this list. Note that Secure Web Proxy does not yet honor this field.
- description string
- Free-text description of the resource.
- exclude
Public booleanCa Set - If FALSE (the default), use our default set of public CAs in addition to any CAs specified in trustConfig. These public CAs are currently based on the Mozilla Root Program and are subject to change over time. If TRUE, do not accept our default set of public CAs. Only CAs specified in trustConfig will be accepted.
- location string
- The location of the tls inspection policy.
- min
Tls stringVersion - Minimum TLS version that the firewall should use when negotiating connections with both clients and servers. If this is not set, then the default value is to allow the broadest set of clients and servers (TLS 1.0 or higher). Setting this to more restrictive values may improve security, but may also prevent the firewall from connecting to some clients or servers. Note that Secure Web Proxy does not yet honor this field.
Possible values are:
TLS_VERSION_UNSPECIFIED,TLS_1_0,TLS_1_1,TLS_1_2,TLS_1_3. - name string
- Short name of the TlsInspectionPolicy resource to be created.
- project string
- The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
- tls
Feature stringProfile - The selected Profile. If this is not set, then the default value is to allow the broadest set of clients and servers ("PROFILE_COMPATIBLE"). Setting this to more restrictive values may improve security, but may also prevent the TLS inspection proxy from connecting to some clients or servers. Note that Secure Web Proxy does not yet honor this field.
Possible values are:
PROFILE_UNSPECIFIED,PROFILE_COMPATIBLE,PROFILE_MODERN,PROFILE_RESTRICTED,PROFILE_CUSTOM. - trust
Config string - A TrustConfig resource used when making a connection to the TLS server. This is a relative resource path following the form "projects/{project}/locations/{location}/trustConfigs/{trust_config}". This is necessary to intercept TLS connections to servers with certificates signed by a private CA or self-signed certificates. Trust config and the TLS inspection policy must be in the same region. Note that Secure Web Proxy does not yet honor this field.
- update
Time string - The timestamp when the resource was updated.
- ca_
pool str - A CA pool resource used to issue interception certificates.
- create_
time str - The timestamp when the resource was created.
- custom_
tls_ Sequence[str]features - List of custom TLS cipher suites selected. This field is valid only if the selected tls_feature_profile is CUSTOM. The compute.SslPoliciesService.ListAvailableFeatures method returns the set of features that can be specified in this list. Note that Secure Web Proxy does not yet honor this field.
- description str
- Free-text description of the resource.
- exclude_
public_ boolca_ set - If FALSE (the default), use our default set of public CAs in addition to any CAs specified in trustConfig. These public CAs are currently based on the Mozilla Root Program and are subject to change over time. If TRUE, do not accept our default set of public CAs. Only CAs specified in trustConfig will be accepted.
- location str
- The location of the tls inspection policy.
- min_
tls_ strversion - Minimum TLS version that the firewall should use when negotiating connections with both clients and servers. If this is not set, then the default value is to allow the broadest set of clients and servers (TLS 1.0 or higher). Setting this to more restrictive values may improve security, but may also prevent the firewall from connecting to some clients or servers. Note that Secure Web Proxy does not yet honor this field.
Possible values are:
TLS_VERSION_UNSPECIFIED,TLS_1_0,TLS_1_1,TLS_1_2,TLS_1_3. - name str
- Short name of the TlsInspectionPolicy resource to be created.
- project str
- The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
- tls_
feature_ strprofile - The selected Profile. If this is not set, then the default value is to allow the broadest set of clients and servers ("PROFILE_COMPATIBLE"). Setting this to more restrictive values may improve security, but may also prevent the TLS inspection proxy from connecting to some clients or servers. Note that Secure Web Proxy does not yet honor this field.
Possible values are:
PROFILE_UNSPECIFIED,PROFILE_COMPATIBLE,PROFILE_MODERN,PROFILE_RESTRICTED,PROFILE_CUSTOM. - trust_
config str - A TrustConfig resource used when making a connection to the TLS server. This is a relative resource path following the form "projects/{project}/locations/{location}/trustConfigs/{trust_config}". This is necessary to intercept TLS connections to servers with certificates signed by a private CA or self-signed certificates. Trust config and the TLS inspection policy must be in the same region. Note that Secure Web Proxy does not yet honor this field.
- update_
time str - The timestamp when the resource was updated.
- ca
Pool String - A CA pool resource used to issue interception certificates.
- create
Time String - The timestamp when the resource was created.
- custom
Tls List<String>Features - List of custom TLS cipher suites selected. This field is valid only if the selected tls_feature_profile is CUSTOM. The compute.SslPoliciesService.ListAvailableFeatures method returns the set of features that can be specified in this list. Note that Secure Web Proxy does not yet honor this field.
- description String
- Free-text description of the resource.
- exclude
Public BooleanCa Set - If FALSE (the default), use our default set of public CAs in addition to any CAs specified in trustConfig. These public CAs are currently based on the Mozilla Root Program and are subject to change over time. If TRUE, do not accept our default set of public CAs. Only CAs specified in trustConfig will be accepted.
- location String
- The location of the tls inspection policy.
- min
Tls StringVersion - Minimum TLS version that the firewall should use when negotiating connections with both clients and servers. If this is not set, then the default value is to allow the broadest set of clients and servers (TLS 1.0 or higher). Setting this to more restrictive values may improve security, but may also prevent the firewall from connecting to some clients or servers. Note that Secure Web Proxy does not yet honor this field.
Possible values are:
TLS_VERSION_UNSPECIFIED,TLS_1_0,TLS_1_1,TLS_1_2,TLS_1_3. - name String
- Short name of the TlsInspectionPolicy resource to be created.
- project String
- The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
- tls
Feature StringProfile - The selected Profile. If this is not set, then the default value is to allow the broadest set of clients and servers ("PROFILE_COMPATIBLE"). Setting this to more restrictive values may improve security, but may also prevent the TLS inspection proxy from connecting to some clients or servers. Note that Secure Web Proxy does not yet honor this field.
Possible values are:
PROFILE_UNSPECIFIED,PROFILE_COMPATIBLE,PROFILE_MODERN,PROFILE_RESTRICTED,PROFILE_CUSTOM. - trust
Config String - A TrustConfig resource used when making a connection to the TLS server. This is a relative resource path following the form "projects/{project}/locations/{location}/trustConfigs/{trust_config}". This is necessary to intercept TLS connections to servers with certificates signed by a private CA or self-signed certificates. Trust config and the TLS inspection policy must be in the same region. Note that Secure Web Proxy does not yet honor this field.
- update
Time String - The timestamp when the resource was updated.
Import
TlsInspectionPolicy can be imported using any of these accepted formats:
projects/{{project}}/locations/{{location}}/tlsInspectionPolicies/{{name}}{{project}}/{{location}}/{{name}}{{location}}/{{name}}
When using the pulumi import command, TlsInspectionPolicy can be imported using one of the formats above. For example:
$ pulumi import gcp:networksecurity/tlsInspectionPolicy:TlsInspectionPolicy default projects/{{project}}/locations/{{location}}/tlsInspectionPolicies/{{name}}
$ pulumi import gcp:networksecurity/tlsInspectionPolicy:TlsInspectionPolicy default {{project}}/{{location}}/{{name}}
$ pulumi import gcp:networksecurity/tlsInspectionPolicy:TlsInspectionPolicy default {{location}}/{{name}}
To learn more about importing existing cloud resources, see Importing resources.
Package Details
- Repository
- Google Cloud (GCP) Classic pulumi/pulumi-gcp
- License
- Apache-2.0
- Notes
- This Pulumi package is based on the
google-betaTerraform Provider.