Access level attributes

Access levels define various attributes that are used to filter requests made to certain resources. The following table lists the attributes supported by access levels and provides additional details about each attribute.

When you create or modify an access level using the gcloud command-line tool, you must format the attributes in YAML. This table includes the YAML syntax for each attribute, and the valid values. Links to the REST and RPC reference information for each attribute are also included.

For more information about access levels and YAML, refer to the example YAML for an access level.

You can include the following attributes in your access level:

Attributes

IP subnetworks

Description

Checks whether a request is coming from one or more IPv4 and/or IPv6 CIDR blocks that you specify.

You cannot include private IP ranges for this attribute. For example, 192.168.0.0/16 or 172.16.0.0/12.

YAML ipSubnetworks
Valid values A list of one or more IPv4 and/or IPv6 CIDR blocks.
API reference

Regions

Description

Checks whether a request originated from a specific region. Regions are identified by the corresponding ISO 3166-1 alpha-2 codes.

YAML regions
Valid values A list of one or more ISO 3166-1 alpha-2 codes.
API reference None

Access level dependency

Description

Checks whether a request meets the criteria of one or more access levels.

While certain products validate whether an access level includes only attributes that are supported by that product, access levels that are included as dependencies will not be checked.

For example, VPC Service Controls service perimeters do not currently support device policy attributes.

When you attempt to add an access level that includes device policy attributes to a service perimeter, an error appears and the access level cannot be added.

However, if an access level includes an additional access level as a dependency that does include device policy attributes, no error will appear. This may cause unexpected behavior.

YAML requiredAccessLevels
Valid values

A list of one or more existing access levels formatted as:

accessPolicies/POLICY-NAME/accessLevels/LEVEL-NAME

Where:

  • POLICY-NAME is the numeric name of your Organization's access policy.
  • LEVEL-NAME is the name of the access level that you want to add as a dependency.
API reference

Members

Description

Checks whether a request is coming from a specific user or service account.

This attribute can only be included in conditions when creating or modifying an access level using the gcloud command-line tool or the Access Context Manager API. If you created an access level using Boogle Cloud Platform Console, either of the methods previously mentioned can be used to add members to that access level.

YAML members
Valid values

A list of one or more user or service accounts, formatted as:

  • user: EMAIL
  • serviceAccount: EMAIL

Where:

  • EMAIL is the email that corresponds to the user or service account that you want to include in the access level.

Groups are not supported as members.

API reference

Device policy

Description

A device policy is a collection of attributes that are used to filter requests based on information about the device where the request originated.

For example, device policy attributes are used in conjunction with Cloud Identity-Aware Proxy to support context-aware access.

All device policy attributes require that Endpoint Verification is enabled.

YAML devicePolicy
Valid values

devicePolicy is a list of one or more device policy attributes. The following attributes are supported:

API reference
Device policy attributes
Require screen lock
Description Checks if a device has screen lock enabled.
YAML requireScreenlock
Valid values
  • true
  • false

If omitted, defaults to false.

API reference
Storage encryption
Description Checks whether the device is encrypted, not encrypted, or does not support storage encryption.
YAML allowedEncryptionStatuses
Valid values

One or more of the following values:

  • ENCRYPTION_UNSUPPORTED
  • ENCRYPTED
  • UNENCRYPTED
API reference
Require admin approval
Description Checks whether the device has been approved by a an administrator.
YAML requireAdminApproval
Valid values
  • true
  • false
  • If omitted, defaults to false.

API reference None
Require corp owned device
Description Checks whether the device is owned by your enterprise.
YAML requireCorpOwned
Valid values
  • true
  • false
  • If omitted, defaults to false.

API reference None
OS policy
Description

Checks whether a device is using a specified operating system. Additionally, you can specify a minimum version of an OS that a device must be using.

If you create a Chrome OS policy, you can also specify that it must be a verified Chrome OS .

YAML osConstraints
Valid values

osConstraints is a list that must include one or more instances of osType. osType can be paired with an instance of minimumVersion, but minimumVersion is not required.

  • osType must include a list of one or more of the following values:

    • DESKTOP_MAC
    • DESKTOP_WINDOWS
    • DESKTOP_CHROME_OS
  • minimumVersion is optional. If used, it must be included with osType.

    minimumVersion must include a minimum version formatted as MAJOR.MINOR.PATCH.

    For example: 10.5.301.

  • If you specify DESKTOP_CHROME_OS for osType, you can optionally include requireVerifiedChromeOs.

    Valid values for requireVerifiedChromeOs are:

    • true
    • false
API reference
Was this page helpful? Let us know how we did:

Send feedback about...

Access Context Manager