packet_mirroring_rule

Creates, updates, deletes, gets or lists a packet_mirroring_rule resource.

Overview

Name	`packet_mirroring_rule`
Type	Resource
Id	`google.compute.packet_mirroring_rule`

Fields

The following fields are returned by SELECT queries:

get_packet_mirroring_rule

Name	Datatype	Description
`action`	`string`	The Action to perform when the client connection triggers the rule. Valid actions for firewall rules are: "allow", "deny", "apply_security_profile_group" and "goto_next" ( "apply_security_profile_group" can be specified only for global network firewall policies or hierarchical firewall policies). Valid actions for packet mirroring rules are: "mirror", "do_not_mirror" and "goto_next".
`description`	`string`	An optional description for this resource.
`direction`	`string`	The direction in which this rule applies. (EGRESS, INGRESS)
`disabled`	`boolean`	Denotes whether the firewall policy rule is disabled. When set to true, the firewall policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the firewall policy rule will be enabled.
`enableLogging`	`boolean`	Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.
`kind`	`string`	Output only. [Output only] Type of the resource. Returnscompute#firewallPolicyRule for firewall rules andcompute#packetMirroringRule for packet mirroring rules. (default: compute#firewallPolicyRule)
`match`	`object`	A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced. (id: FirewallPolicyRuleMatcher)
`priority`	`integer (int32)`	An integer indicating the priority of a rule in the list. The priority must be a positive value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
`ruleName`	`string`	An optional name for the rule. This field is not a unique identifier and can be updated.
`ruleTupleCount`	`integer (int32)`	Output only. [Output Only] Calculation of the complexity of a single firewall policy rule.
`securityProfileGroup`	`string`	A fully-qualified URL of a SecurityProfileGroup resource instance. Example: https://networksecurity.googleapis.com/v1/projects/{project}/locations/{location}/securityProfileGroups/my-security-profile-group Must be specified if action is one of 'apply_security_profile_group' or 'mirror'. Cannot be specified for other actions. Can be specified only for global network firewall policies or hierarchical firewall policies.
`targetForwardingRules`	`array`	A list of forwarding rules to which this rule applies. This field allows you to control which load balancers get this rule. For example, the following are valid values: - https://www.googleapis.com/compute/v1/projects/project/global/forwardingRules/forwardingRule - https://www.googleapis.com/compute/v1/projects/project/regions/region/forwardingRules/forwardingRule - projects/project/global/ forwardingRules/forwardingRule - projects/project/regions/region/forwardingRules/ forwardingRule
`targetResources`	`array`	A list of network resource URLs to which this rule applies. This field allows you to control which network's VMs get this rule. If this field is left blank, all VMs within the organization will receive the rule.
`targetSecureTags`	`array`	A list of secure tags that controls which instances the firewall rule applies to. If targetSecureTag are specified, then the firewall rule applies only to instances in the VPC network that have one of those EFFECTIVE secure tags, if all the target_secure_tag are in INEFFECTIVE state, then this rule will be ignored.targetSecureTag may not be set at the same time astargetServiceAccounts. If neither targetServiceAccounts nortargetSecureTag are specified, the firewall rule applies to all instances on the specified network. Maximum number of target label tags allowed is 256.
`targetServiceAccounts`	`array`	A list of service accounts indicating the sets of instances that are applied with this rule.
`targetType`	`string`	Target types of the firewall policy rule. Default value is INSTANCES. (INSTANCES, INTERNAL_MANAGED_LB)
`tlsInspect`	`boolean`	Boolean flag indicating if the traffic should be TLS decrypted. Can be set only if action = 'apply_security_profile_group' and cannot be set for other actions.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
`get_packet_mirroring_rule`	`select`	`project`, `firewallPolicy`	`priority`	Gets a packet mirroring rule of the specified priority.
`add_packet_mirroring_rule`	`insert`	`project`, `firewallPolicy`	`maxPriority`, `minPriority`, `requestId`	Inserts a packet mirroring rule into a firewall policy.
`patch_packet_mirroring_rule`	`update`	`project`, `firewallPolicy`	`priority`, `requestId`	Patches a packet mirroring rule of the specified priority.
`remove_packet_mirroring_rule`	`delete`	`project`, `firewallPolicy`	`priority`, `requestId`	Deletes a packet mirroring rule of the specified priority.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
`firewallPolicy`	`string`
`project`	`string`
`maxPriority`	`integer (int32)`
`minPriority`	`integer (int32)`
`priority`	`integer (int32)`
`requestId`	`string`

`SELECT` examples

get_packet_mirroring_rule

Gets a packet mirroring rule of the specified priority.

SELECT
action,
description,
direction,
disabled,
enableLogging,
kind,
match,
priority,
ruleName,
ruleTupleCount,
securityProfileGroup,
targetForwardingRules,
targetResources,
targetSecureTags,
targetServiceAccounts,
targetType,
tlsInspect
FROM google.compute.packet_mirroring_rule
WHERE project = '{{ project }}' -- required
AND firewallPolicy = '{{ firewallPolicy }}' -- required
AND priority = '{{ priority }}'
;

`INSERT` examples

add_packet_mirroring_rule
Manifest

Inserts a packet mirroring rule into a firewall policy.

INSERT INTO google.compute.packet_mirroring_rule (
data__description,
data__match,
data__priority,
data__targetServiceAccounts,
data__targetForwardingRules,
data__targetResources,
data__action,
data__ruleName,
data__targetSecureTags,
data__enableLogging,
data__targetType,
data__direction,
data__securityProfileGroup,
data__disabled,
data__tlsInspect,
project,
firewallPolicy,
maxPriority,
minPriority,
requestId
)
SELECT 
'{{ description }}',
'{{ match }}',
{{ priority }},
'{{ targetServiceAccounts }}',
'{{ targetForwardingRules }}',
'{{ targetResources }}',
'{{ action }}',
'{{ ruleName }}',
'{{ targetSecureTags }}',
{{ enableLogging }},
'{{ targetType }}',
'{{ direction }}',
'{{ securityProfileGroup }}',
{{ disabled }},
{{ tlsInspect }},
'{{ project }}',
'{{ firewallPolicy }}',
'{{ maxPriority }}',
'{{ minPriority }}',
'{{ requestId }}'
RETURNING
id,
name,
clientOperationId,
creationTimestamp,
description,
endTime,
error,
getVersionOperationMetadata,
httpErrorMessage,
httpErrorStatusCode,
insertTime,
instancesBulkInsertOperationMetadata,
kind,
operationGroupId,
operationType,
progress,
region,
selfLink,
setCommonInstanceMetadataOperationMetadata,
startTime,
status,
statusMessage,
targetId,
targetLink,
user,
warnings,
zone
;

# Description fields are for documentation purposes
- name: packet_mirroring_rule
props:
  - name: project
    value: "{{ project }}"
    description: Required parameter for the packet_mirroring_rule resource.
  - name: firewallPolicy
    value: "{{ firewallPolicy }}"
    description: Required parameter for the packet_mirroring_rule resource.
  - name: description
    value: "{{ description }}"
    description: |
      An optional description for this resource.
  - name: match
    description: |
      A match condition that incoming traffic is evaluated against.
      If it evaluates to true, the corresponding 'action' is enforced.
    value:
      destIpRanges:
        - "{{ destIpRanges }}"
      destRegionCodes:
        - "{{ destRegionCodes }}"
      destFqdns:
        - "{{ destFqdns }}"
      destNetworkContext: "{{ destNetworkContext }}"
      layer4Configs:
        - ipProtocol: "{{ ipProtocol }}"
          ports: "{{ ports }}"
      srcNetworkContext: "{{ srcNetworkContext }}"
      srcAddressGroups:
        - "{{ srcAddressGroups }}"
      srcRegionCodes:
        - "{{ srcRegionCodes }}"
      destThreatIntelligences:
        - "{{ destThreatIntelligences }}"
      srcSecureTags:
        - name: "{{ name }}"
          state: "{{ state }}"
      destNetworkType: "{{ destNetworkType }}"
      srcFqdns:
        - "{{ srcFqdns }}"
      srcNetworkType: "{{ srcNetworkType }}"
      srcIpRanges:
        - "{{ srcIpRanges }}"
      srcThreatIntelligences:
        - "{{ srcThreatIntelligences }}"
      srcNetworks:
        - "{{ srcNetworks }}"
      destAddressGroups:
        - "{{ destAddressGroups }}"
  - name: priority
    value: {{ priority }}
    description: |
      An integer indicating the priority of a rule in the list. The priority
      must be a positive value between 0 and 2147483647.
      Rules are evaluated from highest to lowest priority where 0 is the
      highest priority and 2147483647 is the lowest priority.
  - name: targetServiceAccounts
    value:
      - "{{ targetServiceAccounts }}"
    description: |
      A list of service accounts indicating the sets of instances that are
      applied with this rule.
  - name: targetForwardingRules
    value:
      - "{{ targetForwardingRules }}"
    description: |
      A list of forwarding rules to which this rule applies.
      This field allows you to control which load balancers get this rule.
      For example, the following are valid values:
      - https://www.googleapis.com/compute/v1/projects/project/global/forwardingRules/forwardingRule
      - https://www.googleapis.com/compute/v1/projects/project/regions/region/forwardingRules/forwardingRule
      - projects/project/global/
      forwardingRules/forwardingRule
      - projects/project/regions/region/forwardingRules/
      forwardingRule
  - name: targetResources
    value:
      - "{{ targetResources }}"
    description: |
      A list of network resource URLs to which this rule applies.  This field
      allows you to control which network's VMs get this rule.  If this field
      is left blank, all VMs within the organization will receive the rule.
  - name: action
    value: "{{ action }}"
    description: |
      The Action to perform when the client connection triggers the rule.
      Valid actions for firewall rules are: "allow", "deny",
      "apply_security_profile_group" and "goto_next" (
      "apply_security_profile_group" can be specified only for global
      network firewall policies or hierarchical firewall policies).
      Valid actions for packet mirroring rules are: "mirror", "do_not_mirror"
      and "goto_next".
  - name: ruleName
    value: "{{ ruleName }}"
    description: |
      An optional name for the rule. This field is not a unique identifier
      and can be updated.
  - name: targetSecureTags
    description: |
      A list of secure tags that controls which instances the firewall rule
      applies to. If targetSecureTag are specified, then the
      firewall rule applies only to instances in the VPC network that have one
      of those EFFECTIVE secure tags, if all the target_secure_tag are in
      INEFFECTIVE state, then this rule will be ignored.targetSecureTag may not be set at the same time astargetServiceAccounts.
      If neither targetServiceAccounts nortargetSecureTag are specified, the firewall rule applies
      to all instances on the specified network.
      Maximum number of target label tags allowed is 256.
    value:
      - name: "{{ name }}"
        state: "{{ state }}"
  - name: enableLogging
    value: {{ enableLogging }}
    description: |
      Denotes whether to enable logging for a particular rule. If logging is
      enabled, logs will be exported to the configured export destination in
      Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you
      cannot enable logging on "goto_next" rules.
  - name: targetType
    value: "{{ targetType }}"
    description: |
      Target types of the firewall policy rule.
      Default value is INSTANCES.
    valid_values: ['INSTANCES', 'INTERNAL_MANAGED_LB']
  - name: direction
    value: "{{ direction }}"
    description: |
      The direction in which this rule applies.
    valid_values: ['EGRESS', 'INGRESS']
  - name: securityProfileGroup
    value: "{{ securityProfileGroup }}"
    description: |
      A fully-qualified URL of a SecurityProfileGroup resource instance.
      Example:
      https://networksecurity.googleapis.com/v1/projects/{project}/locations/{location}/securityProfileGroups/my-security-profile-group
      Must be specified if action is one of 'apply_security_profile_group' or
      'mirror'. Cannot be specified for other actions. Can be specified only
      for global network firewall policies or hierarchical firewall policies.
  - name: disabled
    value: {{ disabled }}
    description: |
      Denotes whether the firewall policy rule is disabled. When set to true,
      the firewall policy rule is not enforced and traffic behaves as if it did
      not exist. If this is unspecified, the firewall policy rule will be
      enabled.
  - name: tlsInspect
    value: {{ tlsInspect }}
    description: |
      Boolean flag indicating if the traffic should be TLS decrypted.
      Can be set only if action = 'apply_security_profile_group' and cannot
      be set for other actions.
  - name: maxPriority
    value: "{{ maxPriority }}"
  - name: minPriority
    value: "{{ minPriority }}"
  - name: requestId
    value: "{{ requestId }}"

`UPDATE` examples

patch_packet_mirroring_rule

Patches a packet mirroring rule of the specified priority.

UPDATE google.compute.packet_mirroring_rule
SET 
data__description = '{{ description }}',
data__match = '{{ match }}',
data__priority = {{ priority }},
data__targetServiceAccounts = '{{ targetServiceAccounts }}',
data__targetForwardingRules = '{{ targetForwardingRules }}',
data__targetResources = '{{ targetResources }}',
data__action = '{{ action }}',
data__ruleName = '{{ ruleName }}',
data__targetSecureTags = '{{ targetSecureTags }}',
data__enableLogging = {{ enableLogging }},
data__targetType = '{{ targetType }}',
data__direction = '{{ direction }}',
data__securityProfileGroup = '{{ securityProfileGroup }}',
data__disabled = {{ disabled }},
data__tlsInspect = {{ tlsInspect }}
WHERE 
project = '{{ project }}' --required
AND firewallPolicy = '{{ firewallPolicy }}' --required
AND priority = '{{ priority}}'
AND requestId = '{{ requestId}}'
RETURNING
id,
name,
clientOperationId,
creationTimestamp,
description,
endTime,
error,
getVersionOperationMetadata,
httpErrorMessage,
httpErrorStatusCode,
insertTime,
instancesBulkInsertOperationMetadata,
kind,
operationGroupId,
operationType,
progress,
region,
selfLink,
setCommonInstanceMetadataOperationMetadata,
startTime,
status,
statusMessage,
targetId,
targetLink,
user,
warnings,
zone;

`DELETE` examples

remove_packet_mirroring_rule

Deletes a packet mirroring rule of the specified priority.

DELETE FROM google.compute.packet_mirroring_rule
WHERE project = '{{ project }}' --required
AND firewallPolicy = '{{ firewallPolicy }}' --required
AND priority = '{{ priority }}'
AND requestId = '{{ requestId }}'
;

Overview​

Fields​

Methods​

Parameters​

SELECT examples​

INSERT examples​

UPDATE examples​

DELETE examples​