
.TH "GCLOUD_ACCESS\-CONTEXT\-MANAGER_PERIMETERS_DRY\-RUN_UPDATE" 1



.SH "NAME"
.HP
gcloud access\-context\-manager perimeters dry\-run update \- update the dry\-run mode configuration for a Service Perimeter



.SH "SYNOPSIS"
.HP
\f5gcloud access\-context\-manager perimeters dry\-run update\fR (\fIPERIMETER\fR\ :\ \fB\-\-policy\fR=\fIPOLICY\fR) [\fB\-\-async\fR] [\fB\-\-etag\fR=\fIetag\fR] [\fB\-\-add\-access\-levels\fR=[\fIACCESS\-LEVELS\fR,...]\ |\ \fB\-\-clear\-access\-levels\fR\ |\ \fB\-\-remove\-access\-levels\fR=[\fIACCESS\-LEVELS\fR,...]] [\fB\-\-add\-resources\fR=[\fIRESOURCES\fR,...]\ |\ \fB\-\-clear\-resources\fR\ |\ \fB\-\-remove\-resources\fR=[\fIRESOURCES\fR,...]] [\fB\-\-add\-restricted\-services\fR=[\fIRESTRICTED\-SERVICES\fR,...]\ |\ \fB\-\-clear\-restricted\-services\fR\ |\ \fB\-\-remove\-restricted\-services\fR=[\fIRESTRICTED\-SERVICES\fR,...]] [\fB\-\-clear\-egress\-policies\fR\ |\ \fB\-\-set\-egress\-policies\fR=\fIYAML_FILE\fR] [\fB\-\-clear\-ingress\-policies\fR\ |\ \fB\-\-set\-ingress\-policies\fR=\fIYAML_FILE\fR] [\fB\-\-enable\-vpc\-accessible\-services\fR\ \fB\-\-add\-vpc\-allowed\-services\fR=[\fIVPC\-ALLOWED\-SERVICES\fR,...]\ |\ \fB\-\-clear\-vpc\-allowed\-services\fR\ |\ \fB\-\-remove\-vpc\-allowed\-services\fR=[\fIVPC\-ALLOWED\-SERVICES\fR,...]] [\fIGCLOUD_WIDE_FLAG\ ...\fR]



.SH "DESCRIPTION"

This command updates the dry\-run mode configuration (\f5spec\fR) for a Service
Perimeter.

For Service Perimeters with an explicitly defined dry\-run mode configuration
(i.e. an explicit \f5spec\fR), this operation updates that configuration
directly, ignoring enforcement mode configuration.

Service Perimeters that do not have explict dry\-run mode configuration will
inherit the enforcement mode configuration in the dry\-run mode. Therefore, this
command effectively clones the enforcement mode configuration, then applies the
update on that configuration, and uses that as the explicit dry\-run mode
configuration.



.SH "EXAMPLES"

To update the dry\-run mode configuration for a Service Perimeter:

.RS 2m
$ gcloud access\-context\-manager perimeters dry\-run update \e
    my\-perimeter \-\-add\-resources="projects/123,projects/456" \e
    \-\-remove\-restricted\-services="storage.googleapis.com" \e
    \-\-add\-access\-levels="accessPolicies/123/accessLevels/a_level" \e
    \-\-enable\-vpc\-accessible\-services \-\-clear\-vpc\-allowed\-services
.RE



.SH "POSITIONAL ARGUMENTS"

.RS 2m
.TP 2m

Perimeter resource \- The service perimeter to update. The arguments in this
group can be used to specify the attributes of this resource.

This must be specified.


.RS 2m
.TP 2m
\fIPERIMETER\fR

ID of the perimeter or fully qualified identifier for the perimeter.

To set the \f5perimeter\fR attribute:
.RS 2m
.IP "\(bu" 2m
provide the argument \f5perimeter\fR on the command line.
.RE
.sp

This positional argument must be specified if any of the other arguments in this
group are specified.

.TP 2m
\fB\-\-policy\fR=\fIPOLICY\fR

The ID of the access policy.

To set the \f5policy\fR attribute:
.RS 2m
.IP "\(bu" 2m
provide the argument \f5perimeter\fR on the command line with a fully specified
name;
.IP "\(bu" 2m
provide the argument \f5\-\-policy\fR on the command line;
.IP "\(bu" 2m
set the property \f5access_context_manager/policy\fR.
.RE
.sp


.RE
.RE
.sp

.SH "FLAGS"

.RS 2m
.TP 2m
\fB\-\-async\fR

Return immediately, without waiting for the operation in progress to complete.

.TP 2m
\fB\-\-etag\fR=\fIetag\fR

The etag for the version of the Access Policy that this operation is to be
performed on. If, at the time of the operation, the etag for the Access Policy
stored in Access Context Manager is different from the specified etag, then the
commit operation will not be performed and the call will fail. If etag is not
provided, the operation will be performed as if a valid etag is provided.

.TP 2m

These flags modify the member Access Level of this Service Perimeter.

At most one of these can be specified:


.RS 2m
.TP 2m
\fB\-\-add\-access\-levels\fR=[\fIACCESS\-LEVELS\fR,...]

Append the given values to the current Access Level.

.TP 2m
\fB\-\-clear\-access\-levels\fR

Empty the current Access Level.

.TP 2m
\fB\-\-remove\-access\-levels\fR=[\fIACCESS\-LEVELS\fR,...]

Remove the given values from the current Access Level.

.RE
.sp
.TP 2m

These flags modify the member Resources of this Service Perimeter.

At most one of these can be specified:


.RS 2m
.TP 2m
\fB\-\-add\-resources\fR=[\fIRESOURCES\fR,...]

Append the given values to the current Resources.

.TP 2m
\fB\-\-clear\-resources\fR

Empty the current Resources.

.TP 2m
\fB\-\-remove\-resources\fR=[\fIRESOURCES\fR,...]

Remove the given values from the current Resources.

.RE
.sp
.TP 2m

These flags modify the member Restricted Services of this Service Perimeter.

At most one of these can be specified:


.RS 2m
.TP 2m
\fB\-\-add\-restricted\-services\fR=[\fIRESTRICTED\-SERVICES\fR,...]

Append the given values to the current Restricted Services.

.TP 2m
\fB\-\-clear\-restricted\-services\fR

Empty the current Restricted Services.

.TP 2m
\fB\-\-remove\-restricted\-services\fR=[\fIRESTRICTED\-SERVICES\fR,...]

Remove the given values from the current Restricted Services.

.RE
.sp
.TP 2m

These flags modify the enforced EgressPolicies of this ServicePerimeter.

At most one of these can be specified:


.RS 2m
.TP 2m
\fB\-\-clear\-egress\-policies\fR

Empties existing enforced Egress Policies.

.TP 2m
\fB\-\-set\-egress\-policies\fR=\fIYAML_FILE\fR

Path to a file containing a list of Egress Policies.

This file contains a list of YAML\-compliant objects representing Egress
Policies described in the API reference.

For more information about the alpha version, see:
https://cloud.google.com/access\-context\-manager/docs/reference/rest/v1alpha/accessPolicies.servicePerimeters
For more information about non\-alpha versions, see:
https://cloud.google.com/access\-context\-manager/docs/reference/rest/v1/accessPolicies.servicePerimeters

.RE
.sp
.TP 2m

These flags modify the enforced IngressPolicies of this ServicePerimeter.

At most one of these can be specified:


.RS 2m
.TP 2m
\fB\-\-clear\-ingress\-policies\fR

Empties existing enforced Ingress Policies.

.TP 2m
\fB\-\-set\-ingress\-policies\fR=\fIYAML_FILE\fR

Path to a file containing a list of Ingress Policies.

This file contains a list of YAML\-compliant objects representing Ingress
Policies described in the API reference.

For more information about the alpha version, see:
https://cloud.google.com/access\-context\-manager/docs/reference/rest/v1alpha/accessPolicies.servicePerimeters
For more information about non\-alpha versions, see:
https://cloud.google.com/access\-context\-manager/docs/reference/rest/v1/accessPolicies.servicePerimeters

.RE
.sp
.TP 2m

Arguments for configuring VPC accessible service restrictions.


.TP 2m
\fB\-\-enable\-vpc\-accessible\-services\fR

When specified restrict API calls within the Service Perimeter to the set of vpc
allowed services. To disable use '\-\-no\-enable\-vpc\-accessible\-services'.

.TP 2m

These flags modify the member VPC Allowed Services of this Service Perimeter.

At most one of these can be specified:


.RS 2m
.TP 2m
\fB\-\-add\-vpc\-allowed\-services\fR=[\fIVPC\-ALLOWED\-SERVICES\fR,...]

Append the given values to the current VPC Allowed Services.

.TP 2m
\fB\-\-clear\-vpc\-allowed\-services\fR

Empty the current VPC Allowed Services.

.TP 2m
\fB\-\-remove\-vpc\-allowed\-services\fR=[\fIVPC\-ALLOWED\-SERVICES\fR,...]

Remove the given values from the current VPC Allowed Services.


.RE
.RE
.sp

.SH "GCLOUD WIDE FLAGS"

These flags are available to all commands: \-\-access\-token\-file, \-\-account,
\-\-billing\-project, \-\-configuration, \-\-flags\-file, \-\-flatten,
\-\-format, \-\-help, \-\-impersonate\-service\-account, \-\-log\-http,
\-\-project, \-\-quiet, \-\-trace\-token, \-\-user\-output\-enabled,
\-\-verbosity.

Run \fB$ gcloud help\fR for details.



.SH "NOTES"

These variants are also available:

.RS 2m
$ gcloud alpha access\-context\-manager perimeters dry\-run update
.RE

.RS 2m
$ gcloud beta access\-context\-manager perimeters dry\-run update
.R