Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Dengan Access Context Manager, Anda dapat melakukan pembaruan massal pada resource yang termasuk dalam
kebijakan akses organisasi, seperti
tingkat akses dan perimeter layanan. Perubahan pada resource Anda hanya diterapkan jika semua bagian operasi massal berhasil.
Topik ini hanya menjelaskan penggantian perimeter layanan secara massal. Untuk mengetahui informasi
selengkapnya tentang penggantian massal tingkat akses,
lihat dokumentasi Access Context Manager.
Mendapatkan daftar perimeter layanan
Karena operasi massal memengaruhi semua perimeter layanan untuk organisasi Anda,
Anda dapat memperoleh daftar lengkap perimeter. Selain itu, Anda dapat memformat daftar ini
sebagai YAML dan menggunakannya untuk membuat perubahan massal pada perimeter.
Saat mengganti semua konfigurasi perimeter layanan dengan perintah replace-all, Anda tidak boleh menetapkan kolom etag dalam perimeter. Etag kemungkinan akan berubah antara pengambilan dan pembaruan perimeter, sehingga menyebabkan perintah replace-all menampilkan error ketidakcocokan etag. Namun, Anda dapat
menetapkan etag untuk seluruh permintaan replace-all dengan parameter --etag
tingkat teratas jika ingin menerapkan pemeriksaan etag.
Daripada menghapus setiap properti etag dalam
perimeter secara manual, Anda dapat mengambil perimeter tanpa properti etag dengan menentukan
--format dengan semua kolom kecuali etag.
Untuk informasi selengkapnya tentang cara memformat file YAML, lihat
struktur JSON objek ServicePerimeterConfig Access Context Manager.
ETAG (opsional) adalah string yang mewakili versi
target kebijakan akses organisasi Anda. Jika Anda tidak menyertakan
tag, operasi massal akan menargetkan versi terbaru kebijakan akses organisasi Anda.
POST https://accesscontextmanager.googleapis.com/v1/accessPolicies/POLICY_NAME/servicePerimeters.replaceAll?alt=json
Dengan keterangan:
POLICY_NAME adalah nama kebijakan akses organisasi Anda.
Isi permintaan
Isi permintaan harus menyertakan daftar
objek ServicePerimeterConfig yang menentukan
perubahan yang ingin Anda buat.
Secara opsional, untuk menargetkan versi kebijakan akses organisasi Anda
tertentu, Anda dapat menyertakan etag. Jika Anda tidak menyertakan etag, operasi massal akan menargetkan versi terbaru kebijakan akses organisasi Anda.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-18 UTC."],[],[],null,["# Making bulk changes to service perimeters\n\nUsing Access Context Manager, you can make bulk updates to resources that belong to\nyour organization's [access policy](/access-context-manager/docs/overview#access-policies), such as\n[access levels](/access-context-manager/docs/overview#access-levels) and [service perimeters](/vpc-service-controls/docs/service-perimeters). Changes to your resources are applied only if all parts of the bulk operation are successful.\n\nThis topic describes only bulk replacement of service perimeters. For more\ninformation about bulk replacement of access levels,\n[refer to the Access Context Manager documentation](/access-context-manager/docs/bulk-operations).\n| **Note:** The Google Cloud console cannot be used for bulk operations.\n\nGet a list of service perimeters\n--------------------------------\n\nBecause bulk operations affect *all* service perimeters for your organization,\nyou can obtain a complete list of your perimeters. Also, you can format this list\nas YAML and use it to make bulk changes to your perimeters.\n\nTo get a formatted list of service perimeters, refer to\n[List service perimeters (formatted)](/vpc-service-controls/docs/manage-service-perimeters#formatted-list).\n\nWhen overriding all service perimeter configurations with the `replace-all`\ncommand, you must not set the `etag` fields within perimeters. Etags are likely\nto change between fetching and updating the perimeters, causing the\n`replace-all` command to return an etag mismatch error. However, you can\nset an `etag` for the entire `replace-all` request with the top-level `--etag`\nparameter if you want to enforce the etag check.\n\nInstead of manually removing each of the `etag` properties within the\nperimeters, you can fetch the perimeters without `etag` properties by specifying\na `--format` with all fields except `etag`. \n\n```bash\ngcloud access-context-manager perimeters list \\\n --policy=POLICY_NAME \\\n --format=\"json(name,title,description,perimeterType,status,spec,useExplicitDryRunSpec)\"\n```\n\nBulk replace service perimeters\n-------------------------------\n\nThe following section details how to bulk replace your service perimeters.\n**Warning:** Bulk replace operations affect *all* your service perimeters. If existing service perimeters aren't included in the operation, those service perimeters are deleted. \n\n### gcloud\n\nTo bulk replace all service perimeters, use the\n`replace-all` command. \n\n```bash\ngcloud access-context-manager perimeters replace-all POLICY_NAME \\\n --source-file=FILE \\\n --etag=ETAG \\\n```\n\nWhere:\n\n- \u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e is the name of your organization's access policy.\n This value is required only if you haven't set a\n [default access policy](/access-context-manager/docs/manage-access-policy#set-default).\n\n- \u003cvar translate=\"no\"\u003eFILE\u003c/var\u003e is the name of a .yaml file that defines\n the new settings for your existing service perimeters.\n\n For example: \n\n - name: accessPolicies/11271009391/servicePerimeters/storage_perimeter\n title: Storage Perimeter\n description: Perimeter to protect Storage resources.\n perimeterType: PERIMETER_TYPE_REGULAR\n status:\n restrictedServices:\n - storage.googleapis.com\n - name: accessPolicies/11271009391/servicePerimeters/bigquery_perimeter\n title: BigQuery Perimeter\n description: Perimeter to protect BigQuery resources.\n perimeterType: PERIMETER_TYPE_REGULAR\n status:\n restrictedServices:\n - bigquery.googleapis.com\n\n For more information about formatting the YAML file, refer to the\n JSON structure of Access Context Manager's\n [`ServicePerimeterConfig` object](/access-context-manager/docs/reference/rest/v1/accessPolicies.servicePerimeters#ServicePerimeterConfig).\n- \u003cvar translate=\"no\"\u003eETAG\u003c/var\u003e (optional) is a string that represents the target\n version of your organization's access policy. If you do not include an\n etag, the bulk operation targets the latest version of the your\n organization's access policy.\n\n To obtain the latest etag of your access policy,\n [`list` your access policies](/access-context-manager/docs/manage-access-policy#get_the_name_of_an_access_policy).\n\n### API\n\nTo bulk replace all service perimeters,\ncall [`servicePerimeters.replaceAll`](/access-context-manager/docs/reference/rest/v1/accessPolicies.servicePerimeters/replaceAll). \n\n```\nPOST https://accesscontextmanager.googleapis.com/v1/accessPolicies/POLICY_NAME/servicePerimeters.replaceAll?alt=json\n```\n\nWhere:\n\n- \u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e is the name of your organization's access policy.\n\n### Request body\n\nThe request body must include a list of\n[`ServicePerimeterConfig`](/access-context-manager/docs/reference/rest/v1/accessPolicies.servicePerimeters#ServicePerimeterConfig) objects that specify the\nchanges you want to make.\n\nOptionally, to target a specific version of your organization's access\npolicy, you can include an etag. If you do not include an etag, the bulk\noperation targets the latest version of your organization's access policy.\n\nFor example: \n\n```json\n{\n \"servicePerimeters\": [\n object (ServicePerimeterConfig),\n object (ServicePerimeterConfig),\n ...\n ]\n \"etag\": string\n}\n```\n\n### Response body\n\nIf successful, the response body for the call contains an\n[`Operation`](/access-context-manager/docs/reference/rest/Shared.Types/Operation) resource that provides details about the\npost operation.\n\nExample response: \n\n {\n \"name\": \"operations/accessPolicies/11271009391/replacePerimeters/1583523447707087\",\n \"done\": true,\n \"response\": {\n \"@type\": \"type.googleapis.com/google.identity.accesscontextmanager.v1.ReplaceServicePerimetersResponse\",\n \"servicePerimeters\": [\n {\n \"name\": \"accessPolicies/11271009391/servicePerimeters/storage_perimeter\",\n \"title\": \"Storage Perimeter\",\n \"description\": \"Perimeter to protect Storage resources.\",\n \"status\": {\n \"accessLevels\": [\n \"accessPolicies/11271009391/accessLevels/corpnet_access\"\n ],\n \"restrictedServices\": [\n \"bigtable.googleapis.com\"\n ]\n }\n },\n {\n \"name\": \"accessPolicies/11271009391/servicePerimeters/storage_perimeter\",\n \"title\": \"BigQuery Perimeter\",\n \"description\": \"Perimeter to protect BigQuery resources.\",\n \"status\": {\n \"accessLevels\": [\n \"accessPolicies/11271009391/accessLevels/prodnet_access\"\n ],\n \"restrictedServices\": [\n \"bigtable.googleapis.com\"\n ]\n }\n }\n ]\n }\n }"]]
