Define access policies using access levels

This page explains how to define Context-Aware Access policies using access levels.

An access level is a set of attributes assigned to requests based on their origin. Using information such as device type, IP address, and user identity, you can designate what level of access to grant. For example, you might assign a High_Trust level to connections from within your corporate network and a Medium_Trust level to external devices running approved operating systems.

An access policy is a container for all of your Access Context Manager resources, such as access levels and service perimeters.

For more information about access levels and access policies, see the Access Context Manager overview.

Limitations

When defining an access level, the following limitations apply:

  • You can't use an IP address as an attribute for Docker connections, nor can you use private IP addresses when connecting to private clusters using kubectl or a managed Looker instance.
  • Data Studio is always allowed unrestricted access to the Google Cloud APIs, regardless of Access Context Manager policies.
  • Device attributes aren't available for non-Google OAuth client applications.
  • You can't use a scoped access level.

Define your policy using access levels

Console

Create a basic access level:

  1. In the Google Cloud console, open the Access Context Manager page.

    Go to the Access Context Manager page

  2. If you are prompted, select a project.

  3. On the Access Context Manager page, click New.

  4. In the New Access Level pane, do the following:

    1. In the Access level title field, enter a title for the access level. The title must be at most 50 characters, start with a letter, and can contain only numbers, letters, underscores, and spaces.

    2. In the Conditions section, click the add button for the type of attribute you want to add, and then provide the values you want applied to that attribute.

      For a complete list of the attributes that you can add, see access level attributes.

      For example, if you want the access level to consider where a request is coming from within your network, you would select the IP Subnetworks attribute.

      Repeat this step to add multiple attributes to the same condition. When a condition has multiple attributes, all of the attributes must be met by the access request.

      An access level condition can include one of each type of attribute. Some attributes include additional options, such as the Device Policy attribute.

      Access levels support conditions based on user identity. However, to add identities to a condition, you must create or update the access level using the gcloud CLI or the API.

    3. Use the When condition is met, return option to specify whether you want the condition to require that a request meet all specified attributes (TRUE) or whether the request must meet anything but those attributes (FALSE).

      For example, if you want to deny requests from a certain IP address range of your network, specify the IP address range using the IP Subnetworks attribute and then set the condition to FALSE.

    4. Optionally, click Add another condition to add an additional condition to your access level and then repeat the previous two steps.

      For example, if you want to deny access to a subset of IP addresses within a broader IP address range, create a new condition, specify the subset IP address range for the IP Subnetworks attribute, and set the condition to return FALSE.

      Repeat this step to add multiple conditions to the same access level.

    5. If you created more than one condition, use Combine condition with to specify whether you want the access level to require a request to meet at least one of the conditions (OR), or all of the conditions (AND).

    6. Click Save.

gcloud

If you don't have an access policy for your organization, create one before continuing.

Use the gcloud access-context-manager levels create command to create an access level:

gcloud access-context-manager levels create LEVEL_NAME OPTIONS \
    --policy=POLICY

Replace the following:

  • LEVEL_NAME: The unique name for the access level. It must begin with a letter and include only letters, numbers, and underscores. The name can be a maximum of 50 characters.

  • OPTIONS: The required options from the following table.

    Options
    basic-level-spec

    A YAML file that specifies one or more conditions for the access level.

    title

    A short title for the access level. The access level's title is displayed in the Google Cloud console.

    combine-function

    (Optional) Determines how conditions are combined.

    Valid values: AND, OR