
.TH "GCLOUD_ACCESS\-CONTEXT\-MANAGER_PERIMETERS_DRY\-RUN_CREATE" 1



.SH "NAME"
.HP
gcloud access\-context\-manager perimeters dry\-run create \- create a dry\-run mode configuration for a new or existing Service         Perimeter



.SH "SYNOPSIS"
.HP
\f5gcloud access\-context\-manager perimeters dry\-run create\fR (\fIPERIMETER\fR\ :\ \fB\-\-policy\fR=\fIPOLICY\fR) (\fB\-\-access\-levels\fR=[\fIaccess_levels\fR,...]\ \fB\-\-egress\-policies\fR=\fIYAML_FILE\fR\ \fB\-\-ingress\-policies\fR=\fIYAML_FILE\fR\ \fB\-\-resources\fR=[\fIresources\fR,...]\ \fB\-\-restricted\-services\fR=[\fIrestricted_services\fR,...]\ \fB\-\-enable\-vpc\-accessible\-services\fR\ \fB\-\-vpc\-allowed\-services\fR=[\fIvpc_allowed_services\fR,...]\ |\ [\fB\-\-perimeter\-title\fR=\fIPERIMETER_TITLE\fR\ \fB\-\-perimeter\-type\fR=\fIPERIMETER_TYPE\fR\ :\ \fB\-\-perimeter\-access\-levels\fR=[\fIaccess_levels\fR,...]\ \fB\-\-perimeter\-description\fR=\fIPERIMETER_DESCRIPTION\fR\ \fB\-\-perimeter\-egress\-policies\fR=\fIYAML_FILE\fR\ \fB\-\-perimeter\-ingress\-policies\fR=\fIYAML_FILE\fR\ \fB\-\-perimeter\-resources\fR=[\fIresources\fR,...]\ \fB\-\-perimeter\-restricted\-services\fR=[\fIrestricted_services\fR,...]\ \fB\-\-perimeter\-enable\-vpc\-accessible\-services\fR\ \fB\-\-perimeter\-vpc\-allowed\-services\fR=[\fIvpc_allowed_services\fR,...]]) [\fB\-\-async\fR] [\fIGCLOUD_WIDE_FLAG\ ...\fR]



.SH "DESCRIPTION"

When a Service Perimeter with the specified name does not exist, a new Service
Perimeter will be created. In this case, the newly created Service Perimeter
will not have any enforcement mode configuration, and, therefore, all policy
violations will be logged.

When a perimeter with the specified name does exist, a dry\-run mode
configuration will be created for it. The behavior of the enforcement mode
configuration, if present, will not be impacted in this case. Requests that
violate the existing enforcement mode configuration of the Service Perimeter
will continue being denied. Requests that only violate the policy in the
dry\-run mode configuration will be logged but will not be denied.



.SH "EXAMPLES"

To create a dry\-run configuration for an existing Service Perimeter:

.RS 2m
$ gcloud access\-context\-manager perimeters dry\-run create \e
    my\-perimeter \-\-resources="projects/0123456789" \e
    \-\-access\-levels="accessPolicies/a_policy/accessLevels/a_level" \e
    \-\-restricted\-services="storage.googleapis.com"
.RE

To create a dry\-run configuration for a new Service Perimeter:

.RS 2m
$ gcloud access\-context\-manager perimeters dry\-run create \e
    my\-perimeter \-\-perimeter\-title="My New Perimeter" \e
    \-\-perimeter\-description="Perimeter description" \e
    \-\-perimeter\-type="regular" \e
    \-\-perimeter\-resources="projects/0123456789" \e
    \-\-perimeter\-access\-levels="accessPolicies/a_policy/accessLevels/\e
a_level" \-\-perimeter\-restricted\-services="storage.googleapis.com"
.RE



.SH "POSITIONAL ARGUMENTS"

.RS 2m
.TP 2m

Perimeter resource \- The service perimeter to update. The arguments in this
group can be used to specify the attributes of this resource.

This must be specified.


.RS 2m
.TP 2m
\fIPERIMETER\fR

ID of the perimeter or fully qualified identifier for the perimeter.

To set the \f5perimeter\fR attribute:
.RS 2m
.IP "\(bu" 2m
provide the argument \f5perimeter\fR on the command line.
.RE
.sp

This positional argument must be specified if any of the other arguments in this
group are specified.

.TP 2m
\fB\-\-policy\fR=\fIPOLICY\fR

The ID of the access policy.

To set the \f5policy\fR attribute:
.RS 2m
.IP "\(bu" 2m
provide the argument \f5perimeter\fR on the command line with a fully specified
name;
.IP "\(bu" 2m
provide the argument \f5\-\-policy\fR on the command line;
.IP "\(bu" 2m
set the property \f5access_context_manager/policy\fR.
.RE
.sp


.RE
.RE
.sp

.SH "REQUIRED FLAGS"

.RS 2m
.TP 2m

Exactly one of these must be specified:


.RS 2m
.TP 2m

Arguments for creating dry\-run spec for an **existing** Service Perimeter.


.TP 2m
\fB\-\-access\-levels\fR=[\fIaccess_levels\fR,...]

Comma\-separated list of IDs for access levels (in the same policy) that an
intra\-perimeter request must satisfy to be allowed.

.TP 2m
\fB\-\-egress\-policies\fR=\fIYAML_FILE\fR

Path to a file containing a list of Egress Policies. This file contains a list
of YAML\-compliant objects representing Egress Policies described in the API
reference. For more information about the alpha version, see:
https://cloud.google.com/access\-context\-manager/docs/reference/rest/v1alpha/accessPolicies.servicePerimeters
For more information about non\-alpha versions, see:
https://cloud.google.com/access\-context\-manager/docs/reference/rest/v1/accessPolicies.servicePerimeters

.TP 2m
\fB\-\-ingress\-policies\fR=\fIYAML_FILE\fR

Path to a file containing a list of Ingress Policies. This file contains a list
of YAML\-compliant objects representing Ingress Policies described in the API
reference. For more information about the alpha version, see:
https://cloud.google.com/access\-context\-manager/docs/reference/rest/v1alpha/accessPolicies.servicePerimeters
For more information about non\-alpha versions, see:
https://cloud.google.com/access\-context\-manager/docs/reference/rest/v1/accessPolicies.servicePerimeters

.TP 2m
\fB\-\-resources\fR=[\fIresources\fR,...]

Comma\-separated list of resources (currently only projects, in the form
\f5projects/<projectnumber>\fR) in this perimeter.

.TP 2m
\fB\-\-restricted\-services\fR=[\fIrestricted_services\fR,...]

Comma\-separated list of services to which the perimeter boundary \fBdoes\fR
apply (for example, \f5storage.googleapis.com\fR).

.TP 2m
\fB\-\-enable\-vpc\-accessible\-services\fR

Whether to restrict API calls within the perimeter to those in the
\f5vpc\-allowed\-services\fR list.

.TP 2m
\fB\-\-vpc\-allowed\-services\fR=[\fIvpc_allowed_services\fR,...]

Comma\-separated list of APIs accessible from within the Service Perimeter. In
order to include all restricted services, use reference "RESTRICTED\-SERVICES".
Requires vpc\-accessible\-services be enabled.

.TP 2m

Arguments for creating a dry\-run spec for a new Service Perimeter.


.TP 2m
\fB\-\-perimeter\-title\fR=\fIPERIMETER_TITLE\fR

Short human\-readable title for the Service Perimeter.

This flag argument must be specified if any of the other arguments in this group
are specified.

.TP 2m
\fB\-\-perimeter\-type\fR=\fIPERIMETER_TYPE\fR

Type of the perimeter.

.RS 2m
A *regular* perimeter allows resources within this service perimeter
to import and export data amongst themselves. A project may belong
to at most one regular service perimeter.
.RE

.RS 2m
A *bridge* perimeter allows resources in different regular service
perimeters to import and export data between each other. A project
may belong to multiple bridge service perimeters (only if it also
belongs to a regular service perimeter). Both restricted and
unrestricted service lists, as well as access level lists, must be
empty.
.RE

This flag argument must be specified if any of the other arguments in this group
are specified.

.TP 2m
\fB\-\-perimeter\-access\-levels\fR=[\fIaccess_levels\fR,...]

Comma\-separated list of IDs for access levels (in the same policy) that an
intra\-perimeter request must satisfy to be allowed.

.TP 2m
\fB\-\-perimeter\-description\fR=\fIPERIMETER_DESCRIPTION\fR

Long\-form description of Service Perimeter.

.TP 2m
\fB\-\-perimeter\-egress\-policies\fR=\fIYAML_FILE\fR

Path to a file containing a list of Egress Policies. This file contains a list
of YAML\-compliant objects representing Egress Policies described in the API
reference. For more information about the alpha version, see:
https://cloud.google.com/access\-context\-manager/docs/reference/rest/v1alpha/accessPolicies.servicePerimeters
For more information about non\-alpha versions, see:
https://cloud.google.com/access\-context\-manager/docs/reference/rest/v1/accessPolicies.servicePerimeters

.TP 2m
\fB\-\-perimeter\-ingress\-policies\fR=\fIYAML_FILE\fR

Path to a file containing a list of Ingress Policies. This file contains a list
of YAML\-compliant objects representing Ingress Policies described in the API
reference. For more information about the alpha version, see:
https://cloud.google.com/access\-context\-manager/docs/reference/rest/v1alpha/accessPolicies.servicePerimeters
For more information about non\-alpha versions, see:
https://cloud.google.com/access\-context\-manager/docs/reference/rest/v1/accessPolicies.servicePerimeters

.TP 2m
\fB\-\-perimeter\-resources\fR=[\fIresources\fR,...]

Comma\-separated list of resources (currently only projects, in the form
\f5projects/<projectnumber>\fR) in this perimeter.

.TP 2m
\fB\-\-perimeter\-restricted\-services\fR=[\fIrestricted_services\fR,...]

Comma\-separated list of services to which the perimeter boundary \fBdoes\fR
apply (for example, \f5storage.googleapis.com\fR).

.TP 2m
\fB\-\-perimeter\-enable\-vpc\-accessible\-services\fR

Whether to restrict API calls within the perimeter to those in the
\f5vpc\-allowed\-services\fR list.

.TP 2m
\fB\-\-perimeter\-vpc\-allowed\-services\fR=[\fIvpc_allowed_services\fR,...]

Comma\-separated list of APIs accessible from within the Service Perimeter. In
order to include all restricted services, use reference "RESTRICTED\-SERVICES".
Requires vpc\-accessible\-services be enabled.


.RE
.RE
.sp

.SH "OPTIONAL FLAGS"

.RS 2m
.TP 2m
\fB\-\-async\fR

Return immediately, without waiting for the operation in progress to complete.


.RE
.sp

.SH "GCLOUD WIDE FLAGS"

These flags are available to all commands: \-\-access\-token\-file, \-\-account,
\-\-billing\-project, \-\-configuration, \-\-flags\-file, \-\-flatten,
\-\-format, \-\-help, \-\-impersonate\-service\-account, \-\-log\-http,
\-\-project, \-\-quiet, \-\-trace\-token, \-\-user\-output\-enabled,
\-\-verbosity.

Run \fB$ gcloud help\fR for details.



.SH "NOTES"

These variants are also available:

.RS 2m
$ gcloud alpha access\-context\-manager perimeters dry\-run create
.RE

.RS 2m
$ gcloud beta access\-context\-manager perimeters dry\-run create
.RE


