googleAccessContextManagerGcpUserAccessBinding

Restricts access to Cloud Console and Google Cloud APIs for a set of users using Context-Aware Access.

To get more information about GcpUserAccessBinding, see:

API documentation

Example Usage - Access Context Manager Gcp User Access Binding Basic

/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as google from "./.gen/providers/google";
/*The following providers are missing schema information and might need manual adjustments to synthesize correctly: google.
For a more precise conversion please use the --provider flag in convert.*/
const googleAccessContextManagerAccessPolicyAccessPolicy =
  new google.accessContextManagerAccessPolicy.AccessContextManagerAccessPolicy(
    this,
    "access-policy",
    {
      parent: "organizations/123456789",
      title: "my policy",
    }
  );
const googleCloudIdentityGroupGroup =
  new google.cloudIdentityGroup.CloudIdentityGroup(this, "group", {
    display_name: "my-identity-group",
    group_key: [
      {
        id: "my-identity-group@example.com",
      },
    ],
    labels: [
      {
        "cloudidentity.googleapis.com/groups.discussion_forum": "",
      },
    ],
    parent: "customers/A01b123xz",
  });
const googleAccessContextManagerAccessLevelAccessLevelIdForUserAccessBinding =
  new google.accessContextManagerAccessLevel.AccessContextManagerAccessLevel(
    this,
    "access_level_id_for_user_access_binding",
    {
      basic: [
        {
          conditions: [
            {
              device_policy: [
                {
                  os_constraints: [
                    {
                      os_type: "DESKTOP_CHROME_OS",
                    },
                  ],
                  require_screen_lock: true,
                },
              ],
              regions: ["US"],
            },
          ],
        },
      ],
      name: `accessPolicies/\${${googleAccessContextManagerAccessPolicyAccessPolicy.name}}/accessLevels/chromeos_no_lock`,
      parent: `accessPolicies/\${${googleAccessContextManagerAccessPolicyAccessPolicy.name}}`,
      title: "chromeos_no_lock",
    }
  );
new google.accessContextManagerGcpUserAccessBinding.AccessContextManagerGcpUserAccessBinding(
  this,
  "gcp_user_access_binding",
  {
    access_levels: [
      googleAccessContextManagerAccessLevelAccessLevelIdForUserAccessBinding.name,
    ],
    group_key: `\${trimprefix(${googleCloudIdentityGroupGroup.id}, "groups/")}`,
    organization_id: "123456789",
  }
);

Argument Reference

The following arguments are supported:

groupKey - (Required) Required. Immutable. Google Group id whose members are subject to this binding's restrictions. See "id" in the G Suite Directory API's Groups resource. If a group's email address/alias is changed, this resource will continue to point at the changed group. This field does not accept group email addresses or aliases. Example: "01d520gv4vjcrht"
accessLevels - (Required) Required. Access level that a user must have to be granted access. Only one access level is supported, not multiple. This repeated field must have exactly one element. Example: "accessPolicies/9522/accessLevels/device_trusted"
organizationId - (Required) Required. ID of the parent organization.

Attributes Reference

In addition to the arguments listed above, the following computed attributes are exported:

id - an identifier for the resource with format {{name}}
name - Immutable. Assigned by the server during creation. The last segment has an arbitrary length and has only URI unreserved characters (as defined by RFC 3986 Section 2.3). Should not be specified by the client during creation. Example: "organizations/256/gcpUserAccessBindings/b3-BhcX_Ud5N"

Timeouts

This resource provides the following Timeouts configuration options:

create - Default is 20 minutes.
update - Default is 20 minutes.
delete - Default is 20 minutes.

Import

GcpUserAccessBinding can be imported using any of these accepted formats:

$ terraform import google_access_context_manager_gcp_user_access_binding.default {{name}}