gcp-accesscontextmanager-service-perimeter-identities-resources
Service perimeter policy exposes protected resource names, allowed identities, and ingress/egress rules.
gcphigh
service: gcp:accesscontextmanager
emits CanReadData
Where it sits
| location | accesscontextmanager.accessPolicies.servicePerimeters.get.{status,spec}.{resources[],accessLevels[],ingressPolicies[],egressPolicies[]} |
|---|
| location kind | policy_document |
|---|
| data kinds | pii sensitive_data |
|---|
| emits edge | CanReadData |
|---|
| service | Access Context Manager / VPC-SC (gcp:accesscontextmanager) |
|---|
Collection recipe
| access mode | read_api |
|---|
| operation | accesscontextmanager.accessPolicies.servicePerimeters.get |
|---|
| response path | {status,spec}.{resources[],accessLevels[],ingressPolicies[],egressPolicies[]} |
|---|
| encoding | json |
|---|
| params | {"name": "\u003cresource-name\u003e"} |
|---|
Required permissions
accesscontextmanager.servicePerimeters.get
References