48 lines
1.3 KiB
YAML
48 lines
1.3 KiB
YAML
# Copyright 2023 Google LLC
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# https://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
---
|
|
# Terraform will be unable to decode this file if it does not contain valid YAML
|
|
# You can retain `---` (start of the document) to indicate an empty document.
|
|
|
|
# Deny all egress (egress traffic is allowed by default)
|
|
deny-all:
|
|
deny:
|
|
- ports: []
|
|
protocol: all
|
|
direction: EGRESS
|
|
priority: 65535
|
|
destination_ranges:
|
|
- 0.0.0.0/0
|
|
|
|
# Allow access to GCP APIs via Private Google Access
|
|
# https://cloud.google.com/vpc/docs/access-apis-external-ip#config
|
|
gcp-pga-apis:
|
|
allow:
|
|
- ports: [443]
|
|
protocol: tcp
|
|
direction: EGRESS
|
|
priority: 500
|
|
destination_ranges:
|
|
- 199.36.153.8/30
|
|
|
|
# Allow egress to internal networks
|
|
internal-egress:
|
|
allow:
|
|
- ports: []
|
|
protocol: tcp
|
|
direction: EGRESS
|
|
destination_ranges:
|
|
- 10.0.0.0/16
|