firewalls

Creates, updates, deletes, gets or lists a firewalls resource.

Overview

Name	`firewalls`
Type	Resource
Id	`google.compute.firewalls`

Fields

The following fields are returned by SELECT queries:

get
list

Name	Datatype	Description
`id`	`string (uint64)`	Output only. [Output Only] The unique identifier for the resource. This identifier is defined by the server.
`name`	`string`	Name of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply withRFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit. (pattern: `[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?`)
`allowed`	`array`	The list of ALLOW rules specified by this firewall. Each rule specifies a protocol and port-range tuple that describes a permitted connection.
`creationTimestamp`	`string`	Output only. [Output Only] Creation timestamp inRFC3339 text format.
`denied`	`array`	The list of DENY rules specified by this firewall. Each rule specifies a protocol and port-range tuple that describes a denied connection.
`description`	`string`	An optional description of this resource. Provide this field when you create the resource.
`destinationRanges`	`array`	If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed inCIDR format. Both IPv4 and IPv6 are supported.
`direction`	`string`	Direction of traffic to which this firewall applies, either `INGRESS` or `EGRESS`. The default is `INGRESS`. For `EGRESS` traffic, you cannot specify the sourceTags fields. (EGRESS, INGRESS)
`disabled`	`boolean`	Denotes whether the firewall rule is disabled. When set to true, the firewall rule is not enforced and the network behaves as if it did not exist. If this is unspecified, the firewall rule will be enabled.
`kind`	`string`	Output only. [Output Only] Type of the resource. Always compute#firewall for firewall rules. (default: compute#firewall)
`logConfig`	`object`	This field denotes the logging options for a particular firewall rule. If logging is enabled, logs will be exported to Cloud Logging. (id: FirewallLogConfig)
`network`	`string`	URL of the network resource for this firewall rule. If not specified when creating a firewall rule, the default network is used: global/networks/default If you choose to specify this field, you can specify the network as a full or partial URL. For example, the following are all valid URLs: - https://www.googleapis.com/compute/v1/projects/myproject/global/networks/my-network - projects/myproject/global/networks/my-network - global/networks/default
`params`	`object`	Input only. [Input Only] Additional params passed with the request, but not persisted as part of resource payload. (id: FirewallParams)
`priority`	`integer (int32)`	Priority for this rule. This is an integer between `0` and `65535`, both inclusive. The default value is `1000`. Relative priorities determine which rule takes effect if multiple rules apply. Lower values indicate higher priority. For example, a rule with priority `0` has higher precedence than a rule with priority `1`. DENY rules take precedence over ALLOW rules if they have equal priority. Note that VPC networks have implied rules with a priority of `65535`. To avoid conflicts with the implied rules, use a priority number less than `65535`.
`selfLink`	`string`	[Output Only] Server-defined URL for the resource.
`sourceRanges`	`array`	If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed inCIDR format. One or both of sourceRanges and sourceTags may be set. If both fields are set, the rule applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in thesourceTags field. The connection does not need to match both fields for the rule to apply. Both IPv4 and IPv6 are supported.
`sourceServiceAccounts`	`array`	If source service accounts are specified, the firewall rules apply only to traffic originating from an instance with a service account in this list. Source service accounts cannot be used to control traffic to an instance's external IP address because service accounts are associated with an instance, not an IP address.sourceRanges can be set at the same time assourceServiceAccounts. If both are set, the firewall applies to traffic that has a source IP address within the sourceRanges OR a source IP that belongs to an instance with service account listed insourceServiceAccount. The connection does not need to match both fields for the firewall to apply.sourceServiceAccounts cannot be used at the same time assourceTags or targetTags.
`sourceTags`	`array`	If source tags are specified, the firewall rule applies only to traffic with source IPs that match the primary network interfaces of VM instances that have the tag and are in the same VPC network. Source tags cannot be used to control traffic to an instance's external IP address, it only applies to traffic between instances in the same virtual network. Because tags are associated with instances, not IP addresses. One or both of sourceRanges and sourceTags may be set. If both fields are set, the firewall applies to traffic that has a source IP address within sourceRanges OR a source IP from a resource with a matching tag listed in the sourceTags field. The connection does not need to match both fields for the firewall to apply.
`targetServiceAccounts`	`array`	A list of service accounts indicating sets of instances located in the network that may make network connections as specified inallowed[].targetServiceAccounts cannot be used at the same time astargetTags or sourceTags. If neither targetServiceAccounts nor targetTags are specified, the firewall rule applies to all instances on the specified network.
`targetTags`	`array`	A list of tags that controls which instances the firewall rule applies to. If targetTags are specified, then the firewall rule applies only to instances in the VPC network that have one of those tags. If no targetTags are specified, the firewall rule applies to all instances on the specified network.

Name	Datatype	Description
`id`	`string`	[Output Only] Unique identifier for the resource; defined by the server.
`items`	`array`	A list of Firewall resources.
`kind`	`string`	Output only. [Output Only] Type of resource. Always compute#firewallList for lists of firewalls. (default: compute#firewallList)
`nextPageToken`	`string`	[Output Only] This token allows you to get the next page of results for list requests. If the number of results is larger thanmaxResults, use the nextPageToken as a value for the query parameter pageToken in the next list request. Subsequent list requests will have their own nextPageToken to continue paging through the results.
`selfLink`	`string`	Output only. [Output Only] Server-defined URL for this resource.
`warning`	`object`	[Output Only] Informational warning message.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
`get`	`select`	`project`, `firewall`		Returns the specified firewall.
`list`	`select`	`project`	`orderBy`, `filter`, `maxResults`, `pageToken`, `returnPartialSuccess`	Retrieves the list of firewall rules available to the specified project.
`insert`	`insert`	`project`	`requestId`	Creates a firewall rule in the specified project using the data included in the request.
`patch`	`update`	`project`, `firewall`	`requestId`	Updates the specified firewall rule with the data included in the request. This method supportsPATCH semantics and uses theJSON merge patch format and processing rules.
`update`	`replace`	`project`, `firewall`	`requestId`	Updates the specified firewall rule with the data included in the request. Note that all fields will be updated if using PUT, even fields that are not specified. To update individual fields, please use PATCH instead.
`delete`	`delete`	`project`, `firewall`	`requestId`	Deletes the specified firewall.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
`firewall`	`string`
`project`	`string`
`filter`	`string`
`maxResults`	`integer (uint32)`
`orderBy`	`string`
`pageToken`	`string`
`requestId`	`string`
`returnPartialSuccess`	`boolean`

`SELECT` examples

get
list

Returns the specified firewall.

SELECT
id,
name,
allowed,
creationTimestamp,
denied,
description,
destinationRanges,
direction,
disabled,
kind,
logConfig,
network,
params,
priority,
selfLink,
sourceRanges,
sourceServiceAccounts,
sourceTags,
targetServiceAccounts,
targetTags
FROM google.compute.firewalls
WHERE project = '{{ project }}' -- required
AND firewall = '{{ firewall }}' -- required
;

Retrieves the list of firewall rules available to the specified
project.

SELECT
id,
items,
kind,
nextPageToken,
selfLink,
warning
FROM google.compute.firewalls
WHERE project = '{{ project }}' -- required
AND orderBy = '{{ orderBy }}'
AND filter = '{{ filter }}'
AND maxResults = '{{ maxResults }}'
AND pageToken = '{{ pageToken }}'
AND returnPartialSuccess = '{{ returnPartialSuccess }}'
;

`INSERT` examples

insert
Manifest

Creates a firewall rule in the specified project using the data
included in the request.

INSERT INTO google.compute.firewalls (
data__description,
data__sourceRanges,
data__sourceServiceAccounts,
data__selfLink,
data__name,
data__allowed,
data__denied,
data__sourceTags,
data__params,
data__priority,
data__targetServiceAccounts,
data__logConfig,
data__direction,
data__destinationRanges,
data__network,
data__disabled,
data__targetTags,
project,
requestId
)
SELECT 
'{{ description }}',
'{{ sourceRanges }}',
'{{ sourceServiceAccounts }}',
'{{ selfLink }}',
'{{ name }}',
'{{ allowed }}',
'{{ denied }}',
'{{ sourceTags }}',
'{{ params }}',
{{ priority }},
'{{ targetServiceAccounts }}',
'{{ logConfig }}',
'{{ direction }}',
'{{ destinationRanges }}',
'{{ network }}',
{{ disabled }},
'{{ targetTags }}',
'{{ project }}',
'{{ requestId }}'
RETURNING
id,
name,
clientOperationId,
creationTimestamp,
description,
endTime,
error,
getVersionOperationMetadata,
httpErrorMessage,
httpErrorStatusCode,
insertTime,
instancesBulkInsertOperationMetadata,
kind,
operationGroupId,
operationType,
progress,
region,
selfLink,
setCommonInstanceMetadataOperationMetadata,
startTime,
status,
statusMessage,
targetId,
targetLink,
user,
warnings,
zone
;

# Description fields are for documentation purposes
- name: firewalls
props:
  - name: project
    value: "{{ project }}"
    description: Required parameter for the firewalls resource.
  - name: description
    value: "{{ description }}"
    description: |
      An optional description of this resource. Provide this field when you
      create the resource.
  - name: sourceRanges
    value:
      - "{{ sourceRanges }}"
    description: |
      If source ranges are specified, the firewall rule applies only to traffic
      that has a source IP address in these ranges. These ranges must be
      expressed inCIDR format. One or both of sourceRanges
      and sourceTags may be set.
      If both fields are set, the rule applies to traffic that has a
      source IP address within sourceRanges OR a source IP
      from a resource with a matching tag listed in thesourceTags field. The connection does not need to match
      both fields for the rule to
      apply. Both IPv4 and IPv6 are supported.
  - name: sourceServiceAccounts
    value:
      - "{{ sourceServiceAccounts }}"
    description: |
      If source service accounts are specified, the firewall rules apply only to
      traffic originating from an instance with a service account in this list.
      Source service accounts cannot be used to control traffic to an instance's
      external IP address because service accounts are associated with an
      instance, not an IP address.sourceRanges can be set at the same time assourceServiceAccounts.
      If both are set, the firewall applies to traffic that
      has a source IP address within the sourceRanges OR a source
      IP that belongs to an instance with service account listed insourceServiceAccount. The connection does not need to match
      both fields for the firewall to apply.sourceServiceAccounts cannot be used at the same time assourceTags or targetTags.
  - name: selfLink
    value: "{{ selfLink }}"
    description: |
      [Output Only] Server-defined URL for the resource.
  - name: name
    value: "{{ name }}"
    description: |
      Name of the resource; provided by the client when the resource is created.
      The name must be 1-63 characters long, and comply withRFC1035.
      Specifically, the name must be 1-63 characters long and match the regular
      expression `[a-z]([-a-z0-9]*[a-z0-9])?`. The first character
      must be a lowercase letter, and all following characters (except for the
      last character) must be a dash, lowercase letter, or digit. The last
      character must be a lowercase letter or digit.
  - name: allowed
    description: |
      The list of ALLOW rules specified by this firewall. Each rule specifies a
      protocol and port-range tuple that describes a permitted connection.
    value:
      - IPProtocol: "{{ IPProtocol }}"
        ports: "{{ ports }}"
  - name: denied
    description: |
      The list of DENY rules specified by this firewall. Each rule specifies a
      protocol and port-range tuple that describes a denied connection.
    value:
      - IPProtocol: "{{ IPProtocol }}"
        ports: "{{ ports }}"
  - name: sourceTags
    value:
      - "{{ sourceTags }}"
    description: |
      If source tags are specified, the firewall rule applies only to traffic
      with source IPs that match the primary network interfaces of VM instances
      that have the tag and are in the same VPC network.
      Source tags cannot be used to control traffic to an instance's external IP
      address, it only applies to traffic between instances in the same virtual
      network. Because tags are associated with instances, not IP addresses.
      One or both of sourceRanges and sourceTags may be
      set. If both fields are set, the firewall applies to traffic that has a
      source IP address within sourceRanges OR a source IP from a
      resource with a matching tag listed in the sourceTags
      field. The connection does not need to match both fields for the
      firewall to apply.
  - name: params
    description: |
      Input only. [Input Only] Additional params passed with the request, but not persisted
      as part of resource payload.
    value:
      resourceManagerTags: "{{ resourceManagerTags }}"
  - name: priority
    value: {{ priority }}
    description: |
      Priority for this rule.
      This is an integer between `0` and `65535`, both inclusive.
      The default value is `1000`.
      Relative priorities determine which rule takes effect if multiple rules
      apply. Lower values indicate higher priority. For example, a rule with
      priority `0` has higher precedence than a rule with priority `1`.
      DENY rules take precedence over ALLOW rules if they have equal priority.
      Note that VPC networks have implied
      rules with a priority of `65535`. To avoid conflicts with the implied
      rules, use a priority number less than `65535`.
  - name: targetServiceAccounts
    value:
      - "{{ targetServiceAccounts }}"
    description: |
      A list of service accounts indicating sets of instances located in the
      network that may make network connections as specified inallowed[].targetServiceAccounts cannot be used at the same time astargetTags or sourceTags.
      If neither targetServiceAccounts nor targetTags
      are specified, the firewall rule applies to all instances on the specified
      network.
  - name: logConfig
    description: |
      This field denotes the logging options for a particular firewall rule. If
      logging is enabled, logs will be exported to Cloud Logging.
    value:
      enable: {{ enable }}
      metadata: "{{ metadata }}"
  - name: direction
    value: "{{ direction }}"
    description: |
      Direction of traffic to which this firewall applies, either `INGRESS` or
      `EGRESS`. The default is `INGRESS`. For `EGRESS` traffic, you cannot
      specify the sourceTags fields.
    valid_values: ['EGRESS', 'INGRESS']
  - name: destinationRanges
    value:
      - "{{ destinationRanges }}"
    description: |
      If destination ranges are specified, the firewall rule applies only to
      traffic that has destination IP address in these ranges. These ranges must
      be expressed inCIDR format. Both IPv4 and IPv6 are supported.
  - name: network
    value: "{{ network }}"
    description: |
      URL of the network resource for this firewall rule. If not
      specified when creating a firewall rule, the default network
      is used:
      global/networks/default
      If you choose to specify this field, you can specify the network as a full
      or partial URL. For example, the following are all valid URLs:
      -
      https://www.googleapis.com/compute/v1/projects/myproject/global/networks/my-network
      - projects/myproject/global/networks/my-network
      - global/networks/default
  - name: disabled
    value: {{ disabled }}
    description: |
      Denotes whether the firewall rule is disabled. When set to true, the
      firewall rule is not enforced and the network behaves as if it did not
      exist. If this is unspecified, the firewall rule will be enabled.
  - name: targetTags
    value:
      - "{{ targetTags }}"
    description: |
      A list of tags that controls which instances the firewall rule
      applies to. If targetTags are specified, then the firewall
      rule applies only to instances in the VPC network that have one of those
      tags. If no targetTags are specified, the firewall rule
      applies to all instances on the specified network.
  - name: requestId
    value: "{{ requestId }}"

`UPDATE` examples

patch

Updates the specified firewall rule with the data included in the
request. This method supportsPATCH
semantics and uses theJSON merge
patch format and processing rules.

UPDATE google.compute.firewalls
SET 
data__description = '{{ description }}',
data__sourceRanges = '{{ sourceRanges }}',
data__sourceServiceAccounts = '{{ sourceServiceAccounts }}',
data__selfLink = '{{ selfLink }}',
data__name = '{{ name }}',
data__allowed = '{{ allowed }}',
data__denied = '{{ denied }}',
data__sourceTags = '{{ sourceTags }}',
data__params = '{{ params }}',
data__priority = {{ priority }},
data__targetServiceAccounts = '{{ targetServiceAccounts }}',
data__logConfig = '{{ logConfig }}',
data__direction = '{{ direction }}',
data__destinationRanges = '{{ destinationRanges }}',
data__network = '{{ network }}',
data__disabled = {{ disabled }},
data__targetTags = '{{ targetTags }}'
WHERE 
project = '{{ project }}' --required
AND firewall = '{{ firewall }}' --required
AND requestId = '{{ requestId}}'
RETURNING
id,
name,
clientOperationId,
creationTimestamp,
description,
endTime,
error,
getVersionOperationMetadata,
httpErrorMessage,
httpErrorStatusCode,
insertTime,
instancesBulkInsertOperationMetadata,
kind,
operationGroupId,
operationType,
progress,
region,
selfLink,
setCommonInstanceMetadataOperationMetadata,
startTime,
status,
statusMessage,
targetId,
targetLink,
user,
warnings,
zone;

`REPLACE` examples

update

Updates the specified firewall rule with the data included in the
request.
Note that all fields will be updated if using PUT, even fields that are not
specified. To update individual fields, please use PATCH instead.

REPLACE google.compute.firewalls
SET 
data__description = '{{ description }}',
data__sourceRanges = '{{ sourceRanges }}',
data__sourceServiceAccounts = '{{ sourceServiceAccounts }}',
data__selfLink = '{{ selfLink }}',
data__name = '{{ name }}',
data__allowed = '{{ allowed }}',
data__denied = '{{ denied }}',
data__sourceTags = '{{ sourceTags }}',
data__params = '{{ params }}',
data__priority = {{ priority }},
data__targetServiceAccounts = '{{ targetServiceAccounts }}',
data__logConfig = '{{ logConfig }}',
data__direction = '{{ direction }}',
data__destinationRanges = '{{ destinationRanges }}',
data__network = '{{ network }}',
data__disabled = {{ disabled }},
data__targetTags = '{{ targetTags }}'
WHERE 
project = '{{ project }}' --required
AND firewall = '{{ firewall }}' --required
AND requestId = '{{ requestId}}'
RETURNING
id,
name,
clientOperationId,
creationTimestamp,
description,
endTime,
error,
getVersionOperationMetadata,
httpErrorMessage,
httpErrorStatusCode,
insertTime,
instancesBulkInsertOperationMetadata,
kind,
operationGroupId,
operationType,
progress,
region,
selfLink,
setCommonInstanceMetadataOperationMetadata,
startTime,
status,
statusMessage,
targetId,
targetLink,
user,
warnings,
zone;

`DELETE` examples

delete

Deletes the specified firewall.

DELETE FROM google.compute.firewalls
WHERE project = '{{ project }}' --required
AND firewall = '{{ firewall }}' --required
AND requestId = '{{ requestId }}'
;

Overview​

Fields​

Methods​

Parameters​

SELECT examples​

INSERT examples​

UPDATE examples​

REPLACE examples​

DELETE examples​