Define access policies using access levels

Console

Create a basic access level:

1. In the Google Cloud console, open the Access Context Manager page.

   Go to the Access Context Manager page

2. If you are prompted, select a project.

3. On the Access Context Manager page, click New.

4. In the New Access Level pane, do the following:

   1. In the Access level title field, enter a title for the access level. The title must be at most 50 characters, start with a letter, and can contain only numbers, letters, underscores, and spaces.

   2. In the Conditions section, click the add button for the type of attribute you want to add, and then provide the values you want applied to that attribute.

      For a complete list of the attributes that you can add, see access level attributes.

      For example, if you want the access level to consider where a request is coming from within your network, you would select the IP Subnetworks attribute.

      Repeat this step to add multiple attributes to the same condition. When a condition has multiple attributes, all of the attributes must be met by the access request.

      An access level condition can include one of each type of attribute. Some attributes include additional options, such as the Device Policy attribute.

      Access levels support conditions based on user identity. However, to add identities to a condition, you must create or update the access level using the gcloud CLI or the API.

   3. Use the When condition is met, return option to specify whether you want the condition to require that a request meet all specified attributes (TRUE) or whether the request must meet anything but those attributes (FALSE).

      For example, if you want to deny requests from a certain IP address range of your network, specify the IP address range using the IP Subnetworks attribute and then set the condition to FALSE.

   4. Optionally, click Add another condition to add an additional condition to your access level and then repeat the previous two steps.

      For example, if you want to deny access to a subset of IP addresses within a broader IP address range, create a new condition, specify the subset IP address range for the IP Subnetworks attribute, and set the condition to return FALSE.

      Repeat this step to add multiple conditions to the same access level.

   5. If you created more than one condition, use Combine condition with to specify whether you want the access level to require a request to meet at least one of the conditions (OR), or all of the conditions (AND).

   6. Click Save.

gcloud

If you don't have an access policy for your organization, create one before continuing.

Use the gcloud access-context-manager levels create command to create an access level:

gcloud access-context-manager levels create LEVEL_NAME OPTIONS \
    --policy=POLICY

Replace the following:

• LEVEL_NAME: The unique name for the access level. It must begin with a letter and include only letters, numbers, and underscores. The name can be a maximum of 50 characters.

• OPTIONS: The required options from the following table.

  Options
  basic-level-spec	A YAML file that specifies one or more conditions for the access level.
  title	A short title for the access level. The access level's title is displayed in the Google Cloud console.
  combine-function	(Optional) Determines how conditions are combined. Valid values: AND, OR
  description	(Optional) A long-form description of the access level.

• POLICY: The ID of your organization's access policy. If you have a default policy set, this parameter is optional.

Optionally, you can include any of the gcloud flags.

basic-level-spec YAML file

When you use the gcloud CLI to create an access level, you must provide a YAML file for the basic-level-spec option. The YAML file defines one or more conditions for the access level. Conditions must contain at least one attribute. When a condition contains more than one attribute, they are combined as either an AND operation (all must be true) or as a NAND operation (none can be true), depending on whether the negate attribute is included in the condition.

For a complete list of the attributes that you can include in your YAML file, see access level attributes.

For more information about access levels and YAML, refer to the example YAML for an access level.

Example command

gcloud access-context-manager levels create Device_Trust \
    --basic-level-spec=corpdevspec.yaml \
    --combine-function=AND \
    --description='Access level that conforms to corporate spec.' \
    --title='Device_Trust Extended' \
    --policy=1521580097614100

API

If you don't have an access policy for your organization, create one before continuing.

To create an access level, call accessLevels.create.

POST https://accesscontextmanager.googleapis.com/v1/accessPolicies/POLICY/accessLevels

POLICY is the ID of your organization's access policy.

Request body

The request body must include an AccessLevel resource that specifies the conditions you want for the new access level. Each Condition has one or more attributes that are evaluated as an AND operation (all must be true) or as a NAND operation (none can be true) depending on whether the negate field is set to true. The resulting evaluation determines whether the condition is met or not.

Response body

If successful, the response body for the call contains an Operation resource that provides details about the POST operation.

Console

1. In the Google Cloud console, open the Access Context Manager.

   Go to the Access Context Manager page

2. If you are prompted, select project.

3. At the top of the Chrome Enterprise Premium page, click New.

4. In the New Access Level pane, in the Conditions section, click Add attribute and then click IP Subnetworks.

5. In the IP Subnetworks box, select either Public IP or Private IP.

   • If you select Public IP, enter one or more IPv4 or IPv6 ranges formatted as CIDR blocks.

     In this example, to limit access to only the auditors, enter 203.0.113.0/25 in the IP Subnetworks box.

   • If you select Private IP, click Select VPC networks. You can specify VPC networks using one of the three options available in the Import options list.

     • Option 1:

       1. Select Browse for VPC networks in your organization and select the VPC networks.

       2. Click Add selected VPC networks.

       3. Click Select IP subnets and select the subnets.

       4. Click Add IP subnets.

     • Option 2:

       1. Select Manually enter VPC network address and enter one or more VPC networks.

       2. Click Add VPC network.

       3. Click Select IP subnets and select the subnets.

       4. Click Add IP subnets.

     • Option 3:

       1. Select Upload CSV file (overwrites existing networks).

          If you use a CSV file to add VPC networks and subnets to an access level, Access Context Manager overwrites the previously selected VPC networks and subnets.

       2. Click Browse and upload the CSV file. In the CSV file, you must specify the VPC networks and subnets in the following format:

          VPC_NETWORK_NAME_1       | IP_RANGE_1       | IP_RANGE_2       | ...
          VPC_NETWORK_NAME_2       | .                | .                | ...
          .                        | .                | .                | ...
          .                        | .                | .                | ...
          

       3. Click Import networks.

          Using the CSV file, Access Context Manager populates the VPC network names and subnet information in the VPC network address and IP subnetworks boxes respectively.

     For information about the VPC network name and private IP address format, see Use internal IP address in access levels.

6. Click Save.

gcloud

1. Create a YAML file for an access level that includes one or more IPv4 or IPv6 ranges formatted as CIDR blocks.

   In this example, to limit access to only the auditors, you would enter the following into the YAML file:

   - ipSubnetworks:
     - 203.0.113.0/25
   

   If you want to use a private IP address, you need to enter the following information in the YAML file:

   - vpcNetworkSources:
     - vpcSubnetwork:
         network: VPC_NETWORK_NAME
         vpcIpSubnetworks:
         - IP_RANGE
   

   Replace VPC_NETWORK_NAME and IP_RANGE with the values described in the Use internal IP address in access levels section.

2. Save the file. In this example, the file is named CONDITIONS.yaml.

3. Create the access level.

   gcloud access-context-manager levels create NAME \
      --title TITLE \
      --basic-level-spec CONDITIONS.yaml \
      --policy=POLICY

   Replace the following:

   • NAME: The unique name for the access level. It must begin with a letter and include only letters, numbers, and underscores.

   • TITLE: A human-readable title. It must be unique to the policy.

   • POLICY: The ID of your organization's access policy. If you have a default policy set, this parameter is optional.

   You should see output similar to the following:

   Create request issued for: NAME
   Waiting for operation [accessPolicies/POLICY/accessLevels/NAME/create/1521594488380943] to complete...done.
   Created level NAME.
   

API

1. Craft a request body to create an AccessLevel resource that includes one or more IPv4 or IPv6 ranges formatted as CIDR blocks.

   In this example, to limit access to only the auditors, you would enter the following into the request body:

   {
    "name": "NAME",
    "title": "TITLE",
    "basic": {
      "conditions": [
        {
          "ipSubnetworks": [
            "203.0.113.0/25"
          ]
        }
      ]
    }
   }

   Replace the following:

   • NAME: The unique name for the access level. It must begin with a letter and include only letters, numbers, and underscores.

   • TITLE: A human-readable title. It must be unique to the policy.

   If you want to use a private IP address, you need to enter the following information in the request body:

   {
    "name": "NAME",
    "title": "TITLE",
    "basic": {
      "conditions": [
        {
          "vpcNetworkSources": [
           {
             "vpcSubnetwork": {
               "network": VPC_NETWORK_NAME,
               "vpcIpSubnetworks": [
                 IP_RANGE
               ]
             }
           }
          ]
        }
      ]
    }
   }

   Replace VPC_NETWORK_NAME and IP_RANGE with the values described in the Use internal IP address in access levels section.

2. Create the access level by calling accessLevels.create.

   POST https://accesscontextmanager.googleapis.com/v1/accessPolicies/POLICY/accessLevels
   

   POLICY is the ID of your organization's access policy.

Console

1. In the Google Cloud console, open the Access Context Manager page.

   Go to the Access Context Manager page

2. If you are prompted, select a project.

3. At the top of the Chrome Enterprise Premium page, click New.

4. In the New Access Level pane, in the Conditions section, click Add attribute and then click Device Policy.

5. Add the device policy attributes:

   1. Click Add OS Policy and then click Chrome OS Policy.

   2. In the Minimum version box, enter the minimum version of ChromeOS you want to allow.

   3. Repeat steps 1 and 2 for Windows OS Policy.

6. Click Save.

gcloud

1. Create a YAML file for an access level that includes a device policy with OS constraints.

   In this example, to allow only devices with a minimum acceptable version of ChromeOS and Windows, you would enter the following into the YAML file:

   - devicePolicy:
       osConstraints:
         - osType: DESKTOP_CHROME_OS
           minimumVersion: 11316.165.0
         - osType: DESKTOP_WINDOWS
           minimumVersion: 10.0.1809
   

2. Save the file. In this example, the file is named CONDITIONS.yaml.

3. Create the access level.

   gcloud access-context-manager levels create NAME \
      --title TITLE \
      --basic-level-spec CONDITIONS.yaml \
      --policy=POLICY

   Replace the following:

   • NAME: The unique name for the access level. It must begin with a letter and include only letters, numbers, and underscores.

   • TITLE: A human-readable title. It must be unique to the policy.

   • POLICY: The ID of your organization's access policy. If you have a default policy set, this parameter is optional.

   You should see output similar to the following:

   Create request issued for: NAME
   Waiting for operation [accessPolicies/POLICY/accessLevels/NAME/create/1521594488380943] to complete...done.
   Created level NAME.
   

API

1. Craft a request body to create an AccessLevel resource that includes a device policy with OS constraints.

   In this example, to allow only devices with a minimum acceptable version of ChromeOS and Windows, you would enter the following into the request body:

   {
    "name": "NAME",
    "title": "TITLE",
    "basic": {
      "conditions": [
        {
          "devicePolicy": {
            "osConstraints": [
              {
                "osType": "DESKTOP_CHROME_OS",
                "minimumVersion": "11316.165.0"
              },
              {
                "osType": "DESKTOP_WINDOWS",
                "minimumVersion": "10.0.1809"
              }
            ]
          {
        }
      ]
    }
   }

   Replace the following:

   • NAME: The unique name for the access level. It must begin with a letter and include only letters, numbers, and underscores.

   • TITLE: A human-readable title. It must be unique to the policy.

2. Create the access level by calling accessLevels.create.

   POST https://accesscontextmanager.googleapis.com/v1/accessPolicies/POLICY/accessLevels
   

   POLICY is the ID of your organization's access policy.

Console

1. In the Google Cloud console, open the Access Context Manager page.

   Go to the Access Context Manager page

2. If you are prompted, select a project.

3. Click Create access level.

4. In the New access level pane, select Advanced mode. You must have a Chrome Enterprise Premium license to use this mode.

5. In the Conditions section, enter the following expression in the CEL expression box.

   certificateBindingState(origin, device) == CertificateBindingState.CERT_MATCHES_EXISTING_DEVICE
   

6. Click Save.

gcloud

1. Create a YAML file for an access level that includes certificate enforcement.

   expression: "certificateBindingState(origin, device) == CertificateBindingState.CERT_MATCHES_EXISTING_DEVICE"
   

2. Save the file. In this example, the file is named CONDITIONS.yaml.

3. Create the access level.

   gcloud access-context-manager levels create NAME \
      --title TITLE \
      --basic-level-spec CONDITIONS.yaml \
      --policy=POLICY

Replace the following:

• NAME: The unique name for the access level. The name must begin with a letter and include only letters, numbers, and underscores.

• TITLE: A human-readable title. It must be unique to the policy.

• POLICY: The ID of your organization's access policy. If you have a default policy set, this parameter is optional.

You should see output similar to the following:

Create request issued for: NAME
Waiting for operation [accessPolicies/POLICY/accessLevels/NAME/create/1234] to complete...done.
Created level NAME.

API

1. Create a request body file for an access level that includes a device policy with OS constraints.

   {
    "name": "require_certificate",
    "title": "Certificate-Based Access",
    "description": "An example certificate-based access level.",
    "custom": {
      "expr": {
        "expression": "certificateBindingState(origin, device) == CertificateBindingState.CERT_MATCHES_EXISTING_DEVICE",
        "title": "Require a valid certificate",
        "description": "Permits requests from a device with a valid mTLS certificate."
       }
     }
   }

2. Create the access level by calling accessLevels.create.

   POST https://accesscontextmanager.googleapis.com/v1/accessPolicies/POLICY/accessLevels
   

   POLICY is the ID of your organization's access policy.