Networking

This page lists the IAM bindings available to policy rules for each network-related API operation: operation, parameters and resources. For general information on how rules and bindings work, see the IAM policy guide.

Overview

The operations below belong to the networking IAM service.

Routes are not exposed as a resource. To write rules about routes, use parameters (for example parameters.destination on create-route) together with the parent vpc and subnet resources.

Resources

Resources are only loaded when a rule in the networking service policy references them.

vpc

The VPC targeted by the request, or the parent VPC of the targeted subnet or route.

• resources.vpc.id
• resources.vpc.name
• resources.vpc.description
• resources.vpc.created_at
• resources.vpc.default: true if this is the organization’s default VPC
• resources.vpc.labels

subnet

The subnet targeted by the request, or the parent subnet of the targeted route.

• resources.subnet.id
• resources.subnet.name
• resources.subnet.description
• resources.subnet.created_at
• resources.subnet.addressfamily
• resources.subnet.address_space
• resources.subnet.ipv4_block
• resources.subnet.labels
• resources.subnet.instances: list of attached instances, each with id, name and ipv4

VPC operations

create-vpc

POST /vpc - Create a VPC

Parameters:

• parameters.name
• parameters.description
• parameters.labels

Resources:

None.

list-vpcs

GET /vpc - List VPCs

Resources:

None.

get-vpc

GET /vpc/<id> - Retrieve VPC details

Parameters:

• parameters.id

Resources:

• resources.vpc

update-vpc

PUT /vpc/<id> - Update a VPC

Parameters:

• parameters.id
• parameters.name
• parameters.description
• parameters.labels

Resources:

• resources.vpc

delete-vpc

DELETE /vpc/<id> - Delete a VPC

Parameters:

• parameters.id

Resources:

• resources.vpc

Subnet operations

create-subnet

POST /vpc/<vpc-id>/subnet - Create a Subnet

Parameters:

• parameters.vpc_id
• parameters.name
• parameters.description
• parameters.labels
• parameters.addressfamily
• parameters.address_space
• parameters.ipv4_block

Resources:

• resources.vpc

list-subnets

GET /vpc/<vpc-id>/subnet - List Subnets

Parameters:

• parameters.vpc_id

Resources:

• resources.vpc

get-subnet

GET /vpc/<vpc-id>/subnet/<id> - Retrieve Subnet details

Parameters:

• parameters.vpc_id
• parameters.id

Resources:

• resources.vpc
• resources.subnet

update-subnet

PUT /vpc/<vpc-id>/subnet/<id> - Update a Subnet

Parameters:

• parameters.vpc_id
• parameters.id
• parameters.name
• parameters.description
• parameters.labels

Resources:

• resources.vpc
• resources.subnet

delete-subnet

DELETE /vpc/<vpc-id>/subnet/<id> - Delete a Subnet

Parameters:

• parameters.vpc_id
• parameters.id

Resources:

• resources.vpc
• resources.subnet

Route operations

create-route

POST /vpc/<vpc-id>/subnet/<subnet-id>/route - Create a route

Parameters:

• parameters.vpc_id
• parameters.subnet_id
• parameters.description
• parameters.destination
• parameters.target

Resources:

• resources.vpc
• resources.subnet

delete-route

DELETE /vpc/<vpc-id>/subnet/<subnet-id>/route/<id> - Delete a route

Parameters:

• parameters.vpc_id
• parameters.subnet_id
• parameters.id: the route ID

Resources:

• resources.vpc
• resources.subnet

list-routes

GET /vpc/<vpc-id>/subnet/<subnet-id>/route - List Subnet routes

Parameters:

• parameters.vpc_id
• parameters.subnet_id

Resources:

• resources.vpc
• resources.subnet

list-vpc-routes

GET /vpc/<vpc-id>/route - List VPC routes

Parameters:

• parameters.vpc_id

Resources:

• resources.vpc

Examples

Restrict VPC management to VPCs labelled env=dev

create-vpc and list-vpcs load no resource, so the first rule lets them through. Every other networking operation is only allowed on VPCs labelled env=dev. Any request that matches no rule is denied.

{
  "default-service-strategy": "deny",
  "services": {
    "networking": {
      "type": "rules",
      "rules": [
        {
          "action": "allow",
          "expression": "!has(resources.vpc)"
        },
        {
          "action": "allow",
          "expression": "has(resources.vpc.labels.env) && resources.vpc.labels.env == 'dev'"
        }
      ]
    }
  }
}