Skip to main content

tls_inspection_policies

Creates, updates, deletes, gets or lists a tls_inspection_policies resource.

Overview​

Nametls_inspection_policies
TypeResource
Idgoogle.networksecurity.tls_inspection_policies

Fields​

The following fields are returned by SELECT queries:

Successful response

NameDatatypeDescription
namestringRequired. Name of the resource. Name is of the form projects/{project}/locations/{location}/tlsInspectionPolicies/{tls_inspection_policy} tls_inspection_policy should match the pattern:(^[a-z]([a-z0-9-]{0,61}[a-z0-9])?$).
caPoolstringRequired. A CA pool resource used to issue interception certificates. The CA pool string has a relative resource path following the form "projects/{project}/locations/{location}/caPools/{ca_pool}".
createTimestring (google-datetime)Output only. The timestamp when the resource was created.
customTlsFeaturesarrayOptional. List of custom TLS cipher suites selected. This field is valid only if the selected tls_feature_profile is CUSTOM. The compute.SslPoliciesService.ListAvailableFeatures method returns the set of features that can be specified in this list. Note that Secure Web Proxy does not yet honor this field.
descriptionstringOptional. Free-text description of the resource.
excludePublicCaSetbooleanOptional. If FALSE (the default), use our default set of public CAs in addition to any CAs specified in trust_config. These public CAs are currently based on the Mozilla Root Program and are subject to change over time. If TRUE, do not accept our default set of public CAs. Only CAs specified in trust_config will be accepted. This defaults to FALSE (use public CAs in addition to trust_config) for backwards compatibility, but trusting public root CAs is not recommended unless the traffic in question is outbound to public web servers. When possible, prefer setting this to "false" and explicitly specifying trusted CAs and certificates in a TrustConfig. Note that Secure Web Proxy does not yet honor this field.
minTlsVersionstringOptional. Minimum TLS version that the firewall should use when negotiating connections with both clients and servers. If this is not set, then the default value is to allow the broadest set of clients and servers (TLS 1.0 or higher). Setting this to more restrictive values may improve security, but may also prevent the firewall from connecting to some clients or servers. Note that Secure Web Proxy does not yet honor this field.
tlsFeatureProfilestringOptional. The selected Profile. If this is not set, then the default value is to allow the broadest set of clients and servers ("PROFILE_COMPATIBLE"). Setting this to more restrictive values may improve security, but may also prevent the TLS inspection proxy from connecting to some clients or servers. Note that Secure Web Proxy does not yet honor this field.
trustConfigstringOptional. A TrustConfig resource used when making a connection to the TLS server. This is a relative resource path following the form "projects/{project}/locations/{location}/trustConfigs/{trust_config}". This is necessary to intercept TLS connections to servers with certificates signed by a private CA or self-signed certificates. Note that Secure Web Proxy does not yet honor this field.
updateTimestring (google-datetime)Output only. The timestamp when the resource was updated.

Methods​

The following methods are available for this resource:

NameAccessible byRequired ParamsOptional ParamsDescription
projects_locations_tls_inspection_policies_getselectprojectsId, locationsId, tlsInspectionPoliciesIdGets details of a single TlsInspectionPolicy.
projects_locations_tls_inspection_policies_listselectprojectsId, locationsIdpageSize, pageTokenLists TlsInspectionPolicies in a given project and location.
projects_locations_tls_inspection_policies_createinsertprojectsId, locationsIdtlsInspectionPolicyIdCreates a new TlsInspectionPolicy in a given project and location.
projects_locations_tls_inspection_policies_patchupdateprojectsId, locationsId, tlsInspectionPoliciesIdupdateMaskUpdates the parameters of a single TlsInspectionPolicy.
projects_locations_tls_inspection_policies_deletedeleteprojectsId, locationsId, tlsInspectionPoliciesIdforceDeletes a single TlsInspectionPolicy.

Parameters​

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

NameDatatypeDescription
locationsIdstring
projectsIdstring
tlsInspectionPoliciesIdstring
forceboolean
pageSizeinteger (int32)
pageTokenstring
tlsInspectionPolicyIdstring
updateMaskstring (google-fieldmask)

SELECT examples​

Gets details of a single TlsInspectionPolicy.

SELECT
name,
caPool,
createTime,
customTlsFeatures,
description,
excludePublicCaSet,
minTlsVersion,
tlsFeatureProfile,
trustConfig,
updateTime
FROM google.networksecurity.tls_inspection_policies
WHERE projectsId = '{{ projectsId }}' -- required
AND locationsId = '{{ locationsId }}' -- required
AND tlsInspectionPoliciesId = '{{ tlsInspectionPoliciesId }}' -- required;

INSERT examples​

Creates a new TlsInspectionPolicy in a given project and location.

INSERT INTO google.networksecurity.tls_inspection_policies (
data__name,
data__description,
data__caPool,
data__trustConfig,
data__excludePublicCaSet,
data__minTlsVersion,
data__tlsFeatureProfile,
data__customTlsFeatures,
projectsId,
locationsId,
tlsInspectionPolicyId
)
SELECT 
'{{ name }}',
'{{ description }}',
'{{ caPool }}',
'{{ trustConfig }}',
{{ excludePublicCaSet }},
'{{ minTlsVersion }}',
'{{ tlsFeatureProfile }}',
'{{ customTlsFeatures }}',
'{{ projectsId }}',
'{{ locationsId }}',
'{{ tlsInspectionPolicyId }}'
RETURNING
name,
done,
error,
metadata,
response
;

UPDATE examples​

Updates the parameters of a single TlsInspectionPolicy.

UPDATE google.networksecurity.tls_inspection_policies
SET 
data__name = '{{ name }}',
data__description = '{{ description }}',
data__caPool = '{{ caPool }}',
data__trustConfig = '{{ trustConfig }}',
data__excludePublicCaSet = {{ excludePublicCaSet }},
data__minTlsVersion = '{{ minTlsVersion }}',
data__tlsFeatureProfile = '{{ tlsFeatureProfile }}',
data__customTlsFeatures = '{{ customTlsFeatures }}'
WHERE 
projectsId = '{{ projectsId }}' --required
AND locationsId = '{{ locationsId }}' --required
AND tlsInspectionPoliciesId = '{{ tlsInspectionPoliciesId }}' --required
AND updateMask = '{{ updateMask}}'
RETURNING
name,
done,
error,
metadata,
response;

DELETE examples​

Deletes a single TlsInspectionPolicy.

DELETE FROM google.networksecurity.tls_inspection_policies
WHERE projectsId = '{{ projectsId }}' --required
AND locationsId = '{{ locationsId }}' --required
AND tlsInspectionPoliciesId = '{{ tlsInspectionPoliciesId }}' --required
AND force = '{{ force }}';