
.TH "GCLOUD_ACCESS\-CONTEXT\-MANAGER_CLOUD\-BINDINGS_CREATE" 1



.SH "NAME"
.HP
gcloud access\-context\-manager cloud\-bindings create \- create cloud access bindings for a specific group



.SH "SYNOPSIS"
.HP
\f5gcloud access\-context\-manager cloud\-bindings create\fR \fB\-\-group\-key\fR=\fIGROUP_KEY\fR [\fB\-\-binding\-file\fR=\fIYAML_FILE\fR] [\fB\-\-dry\-run\-level\fR=[\fIDRY_RUN_LEVEL\fR,...]] [\fB\-\-level\fR=[\fILEVEL\fR,...]] [\fB\-\-organization\fR=\fIORGANIZATION\fR] [\fB\-\-session\-length\fR=\fISESSION_LENGTH\fR] [\fB\-\-session\-reauth\-method\fR=\fISESSION_REAUTH_METHOD\fR;\ default="login"] [\fIGCLOUD_WIDE_FLAG\ ...\fR]



.SH "DESCRIPTION"

Create a new cloud access binding. The access level and/or session settings will
be globally bound with the group.

To apply access level and/or session settings to a specific application, specify
the restricted application in the 'binding\-file'. In such case, the access
level and/or session settings specified in the yaml file will be bound with the
group and the restricted applications.



.SH "EXAMPLES"

To create a new cloud access binding, run:

.RS 2m
$ gcloud access\-context\-manager cloud\-bindings create \e
    \-\-group\-key=my\-group\-key \e
    \-\-level=accessPolicies/123/accessLevels/abc
.RE

To create a new cloud access binding for particular applications using a yaml
file, run:

.RS 2m
$ gcloud access\-context\-manager cloud\-bindings create \e
    \-\-group\-key=my\-group\-key \-\-organization='1234567890' \e
    \-\-binding\-file='binding.yaml'
.RE

To create a new global cloud access binding, and for particular applications
using a yaml file, run:

.RS 2m
$ gcloud access\-context\-manager cloud\-bindings create \e
    \-\-group\-key=my\-group\-key \e
    \-\-level=accessPolicies/123/accessLevels/abc \e
    \-\-organization='1234567890' \-\-binding\-file='binding.yaml'
.RE

To create a new cloud access binding for the dry run access level, run:

.RS 2m
$ gcloud access\-context\-manager cloud\-bindings create \e
    \-\-group\-key=my\-group\-key \e
    \-\-level=accessPolicies/123/accessLevels/abc \e
    \-\-dry\-run\-level=accessPolicies/123/accessLevels/def
.RE

To create a new cloud access binding with global session settings, specify your
session length using an ISO duration string and the \f5session\-length\fR flag.
For example:

.RS 2m
$ gcloud access\-context\-manager cloud\-bindings create \e
    \-\-group\-key=my\-group\-key \-\-organization='1234567890' \e
    \-\-session\-length=2h
.RE

To set a particular session reauth method for these session settings, run:

.RS 2m
$ gcloud access\-context\-manager cloud\-bindings create \e
    \-\-group\-key=my\-group\-key \-\-organization='1234567890' \e
    \-\-session\-length=2h \-\-session\-reauth\-method=LOGIN
.RE

To create session settings for a particular application, supply a YAML file and
run:

.RS 2m
$ gcloud access\-context\-manager cloud\-bindings create \e
    \-\-group\-key=my\-group\-key \-\-organization='1234567890' \e
    \-\-binding\-file='binding.yaml'
.RE

Global and per\-app session settings can be set on the same group, along with
access levels. For example:

.RS 2m
$ gcloud access\-context\-manager cloud\-bindings create \e
    \-\-group\-key=my\-group\-key \-\-organization='1234567890' \e
    \-\-session\-length=2h \-\-session\-reauth\-method=LOGIN \e
    \-\-level=accessPolicies/123/accessLevels/abc \e
    \-\-dry\-run\-level=accessPolicies/123/accessLevels/def \e
    \-\-binding\-file='binding.yaml'
.RE



.SH "REQUIRED FLAGS"

.RS 2m
.TP 2m
\fB\-\-group\-key\fR=\fIGROUP_KEY\fR

Google Group ID whose members are subject to the restrictions of this binding.


.RE
.sp

.SH "OPTIONAL FLAGS"

.RS 2m
.TP 2m
\fB\-\-binding\-file\fR=\fIYAML_FILE\fR

Path to the file that contains a Google Cloud Platform user access binding.

This file contains a YAML\-compliant object representing a GcpUserAccessBinding
(as described in the API reference) containing ScopedAccessSettings only. No
other binding fields are allowed.

.TP 2m
\fB\-\-dry\-run\-level\fR=[\fIDRY_RUN_LEVEL\fR,...]

The dry run access level that binds to the given group. The dry run access level
will be evaluated but won't be enforced. Denial on dry run access level will be
logged. The input must be the full identifier of an access level, such as
\f5accessPolicies/123/accessLevels/new\-def\fR.

.TP 2m
\fB\-\-level\fR=[\fILEVEL\fR,...]

The access level that binds to the given group. The input must be the full
identifier of an access level, such as
\f5accessPolicies/123/accessLevels/abc\fR.

.TP 2m
\fB\-\-organization\fR=\fIORGANIZATION\fR

Parent organization for this binding.

.TP 2m
\fB\-\-session\-length\fR=\fISESSION_LENGTH\fR

The maximum lifetime of a user session provided as an ISO 8601 duration string.
Must be at least one hour or zero seconds, and no more than twenty\-four hours.
Granularity is limited to seconds.

When \-\-session\-length=0 then users in the group attached to this binding will
have infinite session length, effectively disabling the session settings.

A session begins when a user signs in successfully. If a user signs out before
the end of the session lifetime, a new login creates a new session with a fresh
lifetime. When a session expires, the user is asked to re\-authenticate in
accordance with session\-method.

Setting \-\-session\-reauth\-method when \-\-session\-length is empty raises an
error.

.TP 2m
\fB\-\-session\-reauth\-method\fR=\fISESSION_REAUTH_METHOD\fR; default="login"

Specifies the type of re\-authentication challenge given to the user when their
session expires. Defaults to \-\-session\-reauth\-method=login if unspecified
and \-\-session\-length is set. Cannot be used when \-\-session\-length is empty
or 0.

\fISESSION_REAUTH_METHOD\fR must be one of:

.RS 2m
.TP 2m
\fBlogin\fR
The user must complete a regular login.

.TP 2m
\fBpassword\fR
The user will only be required to enter their password.

.TP 2m
\fBsecurity\-key\fR
The user must re\-autheticate using their security key. Before enabling this
session reauth method, ensure a security key is properly configured for the
user. For help configuring your security key, see
https://support.google.com/a/answer/2537800?hl=en#zippy=%2Cview\-add\-or\-remove\-security\-keys

.RE
.sp



.RE
.sp

.SH "GCLOUD WIDE FLAGS"

These flags are available to all commands: \-\-access\-token\-file, \-\-account,
\-\-billing\-project, \-\-configuration, \-\-flags\-file, \-\-flatten,
\-\-format, \-\-help, \-\-impersonate\-service\-account, \-\-log\-http,
\-\-project, \-\-quiet, \-\-trace\-token, \-\-user\-output\-enabled,
\-\-verbosity.

Run \fB$ gcloud help\fR for details.



.SH "API REFERENCE"

This command uses the \fBaccesscontextmanager/v1\fR API. The full documentation
for this API can be found at:
https://cloud.google.com/access\-context\-manager/docs/reference/rest/



.SH "NOTES"

This variant is also available:

.RS 2m
$ gcloud alpha access\-context\-manager cloud\-bindings create
.RE


