
.TH "GCLOUD_ALPHA_ACCESS\-CONTEXT\-MANAGER_CLOUD\-BINDINGS_CREATE" 1



.SH "NAME"
.HP
gcloud alpha access\-context\-manager cloud\-bindings create \- create cloud access bindings for a specific group



.SH "SYNOPSIS"
.HP
\f5gcloud alpha access\-context\-manager cloud\-bindings create\fR [\fB\-\-binding\-file\fR=\fIYAML_FILE\fR] [\fB\-\-dry\-run\-level\fR=[\fIDRY_RUN_LEVEL\fR,...]] [\fB\-\-group\-key\fR=\fIGROUP_KEY\fR] [\fB\-\-level\fR=[\fILEVEL\fR,...]] [\fB\-\-organization\fR=\fIORGANIZATION\fR] [\fB\-\-restricted\-client\-application\-client\-ids\fR=[\fIRESTRICTED_CLIENT_APPLICATION_CLIENT_IDS\fR,...]] [\fB\-\-restricted\-client\-application\-names\fR=[\fIRESTRICTED_CLIENT_APPLICATION_NAMES\fR,...]] [\fB\-\-session\-length\fR=\fISESSION_LENGTH\fR] [\fB\-\-session\-reauth\-method\fR=\fISESSION_REAUTH_METHOD\fR;\ default="login"] [\fIGCLOUD_WIDE_FLAG\ ...\fR]



.SH "DESCRIPTION"

\fB(ALPHA)\fR Create a new access binding. The access level (if any) will be
bound with

.RS 2m
.IP "\(bu" 2m
a group and the restricted client application
.IP "\(bu" 2m
a specific service account or all service accounts in a specified project.
.RE
.sp

The session settings (if any) will be bound with

.RS 2m
.IP "\(bu" 2m
a group
.RE
.sp

If you want to bind session settings to a particular application, use scoped
access settings.

If a group key is specified, the access level and/or session settings are
globally enforced for all context\-aware access group members, as specified in
the binding. If a restricted client application is also specified, then the
enforcement applies only to the specified application, and not to the entire
organization. Session settings are incompatible with the top level
\-\-restricted\-client\-application flags; please use \-\-binding\-file to
specify scoped access settings. If the restricted client application is
specified, then \-\-binding\-file cannot be set. If a service account is
specified, then the enforcement applies only to the specified service account.
If a service account project is specified, the enforcement applies to all of the
service accounts belonging to the specified project.



.SH "EXAMPLES"

To create a new global cloud access binding, run:

.RS 2m
$ gcloud alpha access\-context\-manager cloud\-bindings create \e
    \-\-group\-key=my\-group\-key \e
    \-\-level=accessPolicies/123/accessLevels/abc
.RE

To create a new cloud access binding for particular applications, run:

.RS 2m
$ gcloud alpha access\-context\-manager cloud\-bindings create \e
    \-\-group\-key=my\-group\-key \e
    \-\-level=accessPolicies/123/accessLevels/abc \e
    \-\-organization='1234567890' \e
    \-\-restricted\-client\-application\-names='Google Cloud SDK, Cloud
 Console' \e
    \-\-restricted\-client\-application\-client\-ids='123456789.apps.googl\e
eusercontent.com'
.RE

To create a new cloud access binding for particular applications using a yaml
file, run:

.RS 2m
$ gcloud alpha access\-context\-manager cloud\-bindings create \e
    \-\-group\-key=my\-group\-key \-\-organization='1234567890' \e
    \-\-binding\-file='binding.yaml'
.RE

To create a new global cloud access binding, and for particular applications
using a yaml file, run:

.RS 2m
$ gcloud alpha access\-context\-manager cloud\-bindings create \e
    \-\-group\-key=my\-group\-key \e
    \-\-level=accessPolicies/123/accessLevels/abc \e
    \-\-organization='1234567890' \-\-binding\-file='binding.yaml'
.RE

To create a new global cloud access binding for the dry run access level, run:

.RS 2m
$ gcloud alpha access\-context\-manager cloud\-bindings create \e
    \-\-group\-key=my\-group\-key \e
    \-\-level=accessPolicies/123/accessLevels/abc \e
    \-\-dry\-run\-level=accessPolicies/123/accessLevels/def
.RE

To create a new cloud access binding for the dry run access level for particular
applications, run:

.RS 2m
$ gcloud alpha access\-context\-manager cloud\-bindings create \e
    \-\-group\-key=my\-group\-key \e
    \-\-level=accessPolicies/123/accessLevels/abc \e
    \-\-dry\-run\-level=accessPolicies/123/accessLevels/def \e
    \-\-organization='1234567890' \e
    \-\-restricted\-client\-application\-names='Google Cloud SDK, Cloud
 Console' \e
    \-\-restricted\-client\-application\-client\-ids='123456789.apps.googl\e
eusercontent.com'
.RE

To create a new cloud access binding for a particular service account, run:

.RS 2m
$ gcloud alpha access\-context\-manager cloud\-bindings create \e
    \-\-service\-account=service\-account@project.iam.gserviceaccount.co\e
m \-\-level=accessPolicies/123/accessLevels/abc \e
    \-\-organization='1234567890'
.RE

To create a new cloud access binding for all service accounts in a particular
project, run:

.RS 2m
$ gcloud alpha access\-context\-manager cloud\-bindings create \e
    \-\-service\-account\-project\-number='987654321' \e
    \-\-level=accessPolicies/123/accessLevels/abc \e
    \-\-organization='1234567890' \e
.RE

To create a new cloud access binding for a specific federated principal, run:

.RS 2m
$ gcloud alpha access\-context\-manager cloud\-bindings create \e
    \-\-federated\-principal='//iam.googleapis.com/projects/1234567890/\e
locations/global/workloadIdentityPools/my\-pool/subject/my\-subject' \e
    \-\-level=accessPolicies/123/accessLevels/abc \e
    \-\-organization='1234567890'
.RE

To create a new cloud access binding with global session settings, specify your
session length using an ISO duration string and the \f5session\-length\fR flag.
For example:

.RS 2m
$ gcloud alpha access\-context\-manager cloud\-bindings create \e
    \-\-group\-key=my\-group\-key \-\-organization='1234567890' \e
    \-\-session\-length=2h
.RE

To set a particular session reauth method for these session settings, run:

.RS 2m
$ gcloud alpha access\-context\-manager cloud\-bindings create \e
    \-\-group\-key=my\-group\-key \-\-organization='1234567890' \e
    \-\-session\-length=2h \-\-session\-reauth\-method=LOGIN
.RE

To create session settings for specific applications, supply a YAML file and
run:

.RS 2m
$ gcloud alpha access\-context\-manager cloud\-bindings create \e
    \-\-group\-key=my\-group\-key \-\-organization='1234567890' \e
    \-\-binding\-file='binding.yaml'
.RE

Global and per\-app session settings can be set on the same group, along with
access levels. For example:

.RS 2m
$ gcloud alpha access\-context\-manager cloud\-bindings create \e
    \-\-group\-key=my\-group\-key \-\-organization='1234567890' \e
    \-\-session\-length=2h \-\-session\-reauth\-method=LOGIN \e
    \-\-level=accessPolicies/123/accessLevels/abc \e
    \-\-dry\-run\-level=accessPolicies/123/accessLevels/def \e
    \-\-binding\-file='binding.yaml'
.RE



.SH "FLAGS"

.RS 2m
.TP 2m
\fB\-\-binding\-file\fR=\fIYAML_FILE\fR

Path to the file that contains a Google Cloud Platform user access binding.

This file contains a YAML\-compliant object representing a GcpUserAccessBinding
(as described in the API reference) containing ScopedAccessSettings only. No
other binding fields are allowed.

.TP 2m
\fB\-\-dry\-run\-level\fR=[\fIDRY_RUN_LEVEL\fR,...]

The dry run access level that binds to the given group and restricted client
applications. The dry run access level is evaluated but isn't enforced. Denial
on a dry run access level is logged. The input must be the full identifier of an
access level, such as \f5accessPolicies/123/accessLevels/new\-def\fR. If no
\f5restricted\-client\-application\-client\-ids\fR or
\f5restricted\-client\-application\-names\fR are provided, then the access level
is applied to the entire organization.

.TP 2m
\fB\-\-group\-key\fR=\fIGROUP_KEY\fR

Google Group ID whose members are subject to the restrictions of this binding.

.TP 2m
\fB\-\-level\fR=[\fILEVEL\fR,...]

The access level that binds to the given group and restricted client
applications. The input must be the full identifier of an access level, such as
\f5accessPolicies/123/accessLevels/abc\fR. If no
\f5restricted\-client\-application\-client\-ids\fR or
\f5restricted\-client\-application\-names\fR are provided, then the access level
is applied to the entire organization.

.TP 2m
\fB\-\-organization\fR=\fIORGANIZATION\fR

Parent organization for this binding.

.TP 2m
\fB\-\-restricted\-client\-application\-client\-ids\fR=[\fIRESTRICTED_CLIENT_APPLICATION_CLIENT_IDS\fR,...]

Client IDs to which the access level is applied.

.TP 2m
\fB\-\-restricted\-client\-application\-names\fR=[\fIRESTRICTED_CLIENT_APPLICATION_NAMES\fR,...]

Application names to which the access level is applied.

.TP 2m
\fB\-\-session\-length\fR=\fISESSION_LENGTH\fR

The maximum lifetime of a user session provided as an ISO 8601 duration string.
Must be at least one hour or zero seconds, and no more than twenty\-four hours.
Granularity is limited to seconds.

When \-\-session\-length=0 then users in the group attached to this binding will
have infinite session length, effectively disabling session.

A session begins when a user signs\-in successfully. If a user signs out before
the end of the session lifetime, a new login creates a new session with a fresh
lifetime. When a session expires, the user is asked to re\-authenticate in
accordance with session\-method.

Setting \-\-session\-reauth\-method when \-\-session\-length is empty raises an
error. Cannot set \-\-session\-length with
\-\-restricted\-client\-application\-client\-ids or
\-\-restricted\-client\-application\-names; please use scoped access settings.

.TP 2m
\fB\-\-session\-reauth\-method\fR=\fISESSION_REAUTH_METHOD\fR; default="login"

Specifies the type of re\-authentication challenge given to the user when their
session expires. Defaults to \-\-session\-reauth\-method=login if unspecified
and \-\-session\-length is set. Cannot be used when \-\-session\-length is empty
or 0.

\fISESSION_REAUTH_METHOD\fR must be one of:

.RS 2m
.TP 2m
\fBlogin\fR
The user must complete a regular login.

.TP 2m
\fBpassword\fR
The user will only be required to enter their password.

.TP 2m
\fBsecurity\-key\fR
The user must re\-autheticate using their security key. Before enabling this
session reauth method, ensure a security key is properly configured for the
user. For help configuring your security key, see
https://support.google.com/a/answer/2537800?hl=en#zippy=%2Cview\-add\-or\-remove\-security\-keys

.RE
.sp



.RE
.sp

.SH "GCLOUD WIDE FLAGS"

These flags are available to all commands: \-\-access\-token\-file, \-\-account,
\-\-billing\-project, \-\-configuration, \-\-flags\-file, \-\-flatten,
\-\-format, \-\-help, \-\-impersonate\-service\-account, \-\-log\-http,
\-\-project, \-\-quiet, \-\-trace\-token, \-\-user\-output\-enabled,
\-\-verbosity.

Run \fB$ gcloud help\fR for details.



.SH "API REFERENCE"

This command uses the \fBaccesscontextmanager/v1alpha\fR API. The full
documentation for this API can be found at:
https://cloud.google.com/access\-context\-manager/docs/reference/rest/



.SH "NOTES"

This command is currently in alpha and might change without notice. If this
command fails with API permission errors despite specifying the correct project,
you might be trying to access an API with an invitation\-only early access
allowlist. This variant is also available:

.RS 2m
$ gcloud access\-context\-manager cloud\-bindings create
.RE


