v5.18.0/website/docs/r/compute_firewall.html.markdown - terraform-provider-google-beta - Git at Google

 ---
 # ----------------------------------------------------------------------------
 #
 #     ***     AUTO GENERATED CODE    ***    Type: MMv1     ***
 #
 # ----------------------------------------------------------------------------
 #
 #     This file is automatically generated by Magic Modules and manual
 #     changes will be clobbered when the file is regenerated.
 #
 #     Please read more about how to change this file in
 #     .github/CONTRIBUTING.md.
 #
 # ----------------------------------------------------------------------------
 subcategory: "Compute Engine"
 description: |-
   Each network has its own firewall controlling access to and from the
   instances.
 ---

 # google\_compute\_firewall

 Each network has its own firewall controlling access to and from the
 instances.

 All traffic to instances, even from other instances, is blocked by the
 firewall unless firewall rules are created to allow it.

 The default network has automatically created firewall rules that are
 shown in default firewall rules. No manually created network has
 automatically created firewall rules except for a default "allow" rule for
 outgoing traffic and a default "deny" for incoming traffic. For all
 networks except the default network, you must create any firewall rules
 you need.


 To get more information about Firewall, see:

 * [API documentation](https://cloud.google.com/compute/docs/reference/v1/firewalls)
 * How-to Guides
     * [Official Documentation](https://cloud.google.com/vpc/docs/firewalls)

 <div class = "oics-button" style="float: right; margin: 0 0 -15px">
   <a href="https://console.cloud.google.com/cloudshell/open?cloudshell_git_repo=https%3A%2F%2Fgithub.com%2Fterraform-google-modules%2Fdocs-examples.git&cloudshell_working_dir=firewall_basic&cloudshell_image=gcr.io%2Fcloudshell-images%2Fcloudshell%3Alatest&open_in_editor=main.tf&cloudshell_print=.%2Fmotd&cloudshell_tutorial=.%2Ftutorial.md" target="_blank">
     <img alt="Open in Cloud Shell" src="//gstatic.com/cloudssh/images/open-btn.svg" style="max-height: 44px; margin: 32px auto; max-width: 100%;">
   </a>
 </div>
 ## Example Usage - Firewall Basic


 ```hcl
 resource "google_compute_firewall" "default" {
   name    = "test-firewall"
   network = google_compute_network.default.name

   allow {
     protocol = "icmp"
   }

   allow {
     protocol = "tcp"
     ports    = ["80", "8080", "1000-2000"]
   }

   source_tags = ["web"]
 }

 resource "google_compute_network" "default" {
   name = "test-network"
 }
 ```
 ## Example Usage - Firewall With Target Tags


 ```hcl
 resource "google_compute_firewall" "rules" {
   project     = "my-project-name"
   name        = "my-firewall-rule"
   network     = "default"
   description = "Creates firewall rule targeting tagged instances"

   allow {
     protocol  = "tcp"
     ports     = ["80", "8080", "1000-2000"]
   }

   source_tags = ["foo"]
   target_tags = ["web"]
 }
 ```

 ## Argument Reference

 The following arguments are supported:


 * `name` -
   (Required)
   Name of the resource. Provided by the client when the resource is
   created. The name must be 1-63 characters long, and comply with
   RFC1035. Specifically, the name must be 1-63 characters long and match
   the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?` which means the
   first character must be a lowercase letter, and all following
   characters must be a dash, lowercase letter, or digit, except the last
   character, which cannot be a dash.

 * `network` -
   (Required)
   The name or self_link of the network to attach this firewall to.


 - - -


 * `allow` -
   (Optional)
   The list of ALLOW rules specified by this firewall. Each rule
   specifies a protocol and port-range tuple that describes a permitted
   connection.
   Structure is [documented below](#nested_allow).

 * `deny` -
   (Optional)
   The list of DENY rules specified by this firewall. Each rule specifies
   a protocol and port-range tuple that describes a denied connection.
   Structure is [documented below](#nested_deny).

 * `description` -
   (Optional)
   An optional description of this resource. Provide this property when
   you create the resource.

 * `destination_ranges` -
   (Optional)
   If destination ranges are specified, the firewall will apply only to
   traffic that has destination IP address in these ranges. These ranges
   must be expressed in CIDR format. IPv4 or IPv6 ranges are supported.

 * `direction` -
   (Optional)
   Direction of traffic to which this firewall applies; default is
   INGRESS. Note: For INGRESS traffic, one of `source_ranges`,
   `source_tags` or `source_service_accounts` is required.
   Possible values are: `INGRESS`, `EGRESS`.

 * `disabled` -
   (Optional)
   Denotes whether the firewall rule is disabled, i.e not applied to the
   network it is associated with. When set to true, the firewall rule is
   not enforced and the network behaves as if it did not exist. If this
   is unspecified, the firewall rule will be enabled.

 * `log_config` -
   (Optional)
   This field denotes the logging options for a particular firewall rule.
   If defined, logging is enabled, and logs will be exported to Cloud Logging.
   Structure is [documented below](#nested_log_config).

 * `priority` -
   (Optional)
   Priority for this rule. This is an integer between 0 and 65535, both
   inclusive. When not specified, the value assumed is 1000. Relative
   priorities determine precedence of conflicting rules. Lower value of
   priority implies higher precedence (eg, a rule with priority 0 has
   higher precedence than a rule with priority 1). DENY rules take
   precedence over ALLOW rules having equal priority.

 * `source_ranges` -
   (Optional)
   If source ranges are specified, the firewall will apply only to
   traffic that has source IP address in these ranges. These ranges must
   be expressed in CIDR format. One or both of sourceRanges and
   sourceTags may be set. If both properties are set, the firewall will
   apply to traffic that has source IP address within sourceRanges OR the
   source IP that belongs to a tag listed in the sourceTags property. The
   connection does not need to match both properties for the firewall to
   apply. IPv4 or IPv6 ranges are supported. For INGRESS traffic, one of
   `source_ranges`, `source_tags` or `source_service_accounts` is required.

 * `source_service_accounts` -
   (Optional)
   If source service accounts are specified, the firewall will apply only
   to traffic originating from an instance with a service account in this
   list. Source service accounts cannot be used to control traffic to an
   instance's external IP address because service accounts are associated
   with an instance, not an IP address. sourceRanges can be set at the
   same time as sourceServiceAccounts. If both are set, the firewall will
   apply to traffic that has source IP address within sourceRanges OR the
   source IP belongs to an instance with service account listed in
   sourceServiceAccount. The connection does not need to match both
   properties for the firewall to apply. sourceServiceAccounts cannot be
   used at the same time as sourceTags or targetTags. For INGRESS traffic,
   one of `source_ranges`, `source_tags` or `source_service_accounts` is required.

 * `source_tags` -
   (Optional)
   If source tags are specified, the firewall will apply only to traffic
   with source IP that belongs to a tag listed in source tags. Source
   tags cannot be used to control traffic to an instance's external IP
   address. Because tags are associated with an instance, not an IP
   address. One or both of sourceRanges and sourceTags may be set. If
   both properties are set, the firewall will apply to traffic that has
   source IP address within sourceRanges OR the source IP that belongs to
   a tag listed in the sourceTags property. The connection does not need
   to match both properties for the firewall to apply. For INGRESS traffic,
   one of `source_ranges`, `source_tags` or `source_service_accounts` is required.

 * `target_service_accounts` -
   (Optional)
   A list of service accounts indicating sets of instances located in the
   network that may make network connections as specified in allowed[].
   targetServiceAccounts cannot be used at the same time as targetTags or
   sourceTags. If neither targetServiceAccounts nor targetTags are
   specified, the firewall rule applies to all instances on the specified
   network.

 * `target_tags` -
   (Optional)
   A list of instance tags indicating sets of instances located in the
   network that may make network connections as specified in allowed[].
   If no targetTags are specified, the firewall rule applies to all
   instances on the specified network.

 * `project` - (Optional) The ID of the project in which the resource belongs.
     If it is not provided, the provider project is used.

 * `enable_logging` - (Optional, Deprecated) This field denotes whether to enable logging for a particular firewall rule.
 If logging is enabled, logs will be exported to Stackdriver. Deprecated in favor of `log_config`

 <a name="nested_allow"></a>The `allow` block supports:

 * `protocol` -
   (Required)
   The IP protocol to which this rule applies. The protocol type is
   required when creating a firewall rule. This value can either be
   one of the following well known protocol strings (tcp, udp,
   icmp, esp, ah, sctp, ipip, all), or the IP protocol number.

 * `ports` -
   (Optional)
   An optional list of ports to which this rule applies. This field
   is only applicable for UDP or TCP protocol. Each entry must be
   either an integer or a range. If not specified, this rule
   applies to connections through any port.
   Example inputs include: ["22"], ["80","443"], and
   ["12345-12349"].

 <a name="nested_deny"></a>The `deny` block supports:

 * `protocol` -
   (Required)
   The IP protocol to which this rule applies. The protocol type is
   required when creating a firewall rule. This value can either be
   one of the following well known protocol strings (tcp, udp,
   icmp, esp, ah, sctp, ipip, all), or the IP protocol number.

 * `ports` -
   (Optional)
   An optional list of ports to which this rule applies. This field
   is only applicable for UDP or TCP protocol. Each entry must be
   either an integer or a range. If not specified, this rule
   applies to connections through any port.
   Example inputs include: ["22"], ["80","443"], and
   ["12345-12349"].

 <a name="nested_log_config"></a>The `log_config` block supports:

 * `metadata` -
   (Required)
   This field denotes whether to include or exclude metadata for firewall logs.
   Possible values are: `EXCLUDE_ALL_METADATA`, `INCLUDE_ALL_METADATA`.

 ## Attributes Reference

 In addition to the arguments listed above, the following computed attributes are exported:

 * `id` - an identifier for the resource with format `projects/{{project}}/global/firewalls/{{name}}`

 * `creation_timestamp` -
   Creation timestamp in RFC3339 text format.
 * `self_link` - The URI of the created resource.


 ## Timeouts

 This resource provides the following
 [Timeouts](https://developer.hashicorp.com/terraform/plugin/sdkv2/resources/retries-and-customizable-timeouts) configuration options:

 - `create` - Default is 20 minutes.
 - `update` - Default is 20 minutes.
 - `delete` - Default is 20 minutes.

 ## Import


 Firewall can be imported using any of these accepted formats:

 * `projects/{{project}}/global/firewalls/{{name}}`
 * `{{project}}/{{name}}`
 * `{{name}}`


 In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Firewall using one of the formats above. For example:

 ```tf
 import {
   id = "projects/{{project}}/global/firewalls/{{name}}"
   to = google_compute_firewall.default
 }
 ```

 When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), Firewall can be imported using one of the formats above. For example:

 ```
 $ terraform import google_compute_firewall.default projects/{{project}}/global/firewalls/{{name}}
 $ terraform import google_compute_firewall.default {{project}}/{{name}}
 $ terraform import google_compute_firewall.default {{name}}
 ```

 ## User Project Overrides

 This resource supports [User Project Overrides](https://registry.terraform.io/providers/hashicorp/google/latest/docs/guides/provider_reference#user_project_override).
	---
	# ----------------------------------------------------------------------------
	#
	# * AUTO GENERATED CODE * Type: MMv1 ***
	#
	# ----------------------------------------------------------------------------
	#
	# This file is automatically generated by Magic Modules and manual
	# changes will be clobbered when the file is regenerated.
	#
	# Please read more about how to change this file in
	# .github/CONTRIBUTING.md.
	#
	# ----------------------------------------------------------------------------
	subcategory: "Compute Engine"
	description: \|-
	Each network has its own firewall controlling access to and from the
	instances.
	---

	# google\_compute\_firewall

	Each network has its own firewall controlling access to and from the
	instances.

	All traffic to instances, even from other instances, is blocked by the
	firewall unless firewall rules are created to allow it.

	The default network has automatically created firewall rules that are
	shown in default firewall rules. No manually created network has
	automatically created firewall rules except for a default "allow" rule for
	outgoing traffic and a default "deny" for incoming traffic. For all
	networks except the default network, you must create any firewall rules
	you need.


	To get more information about Firewall, see:

	* [API documentation](https://cloud.google.com/compute/docs/reference/v1/firewalls)
	* How-to Guides
	* [Official Documentation](https://cloud.google.com/vpc/docs/firewalls)

	<div class = "oics-button" style="float: right; margin: 0 0 -15px">
	<a href="https://console.cloud.google.com/cloudshell/open?cloudshell_git_repo=https%3A%2F%2Fgithub.com%2Fterraform-google-modules%2Fdocs-examples.git&cloudshell_working_dir=firewall_basic&cloudshell_image=gcr.io%2Fcloudshell-images%2Fcloudshell%3Alatest&open_in_editor=main.tf&cloudshell_print=.%2Fmotd&cloudshell_tutorial=.%2Ftutorial.md" target="_blank">
	<img alt="Open in Cloud Shell" src="//gstatic.com/cloudssh/images/open-btn.svg" style="max-height: 44px; margin: 32px auto; max-width: 100%;">
	</a>
	</div>
	## Example Usage - Firewall Basic


	```hcl
	resource "google_compute_firewall" "default" {
	name = "test-firewall"
	network = google_compute_network.default.name

	allow {
	protocol = "icmp"
	}

	allow {
	protocol = "tcp"
	ports = ["80", "8080", "1000-2000"]
	}

	source_tags = ["web"]
	}

	resource "google_compute_network" "default" {
	name = "test-network"
	}
	```
	## Example Usage - Firewall With Target Tags


	```hcl
	resource "google_compute_firewall" "rules" {
	project = "my-project-name"
	name = "my-firewall-rule"
	network = "default"
	description = "Creates firewall rule targeting tagged instances"

	allow {
	protocol = "tcp"
	ports = ["80", "8080", "1000-2000"]
	}

	source_tags = ["foo"]
	target_tags = ["web"]
	}
	```

	## Argument Reference

	The following arguments are supported:


	* `name` -
	(Required)
	Name of the resource. Provided by the client when the resource is
	created. The name must be 1-63 characters long, and comply with
	RFC1035. Specifically, the name must be 1-63 characters long and match
	the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?` which means the
	first character must be a lowercase letter, and all following
	characters must be a dash, lowercase letter, or digit, except the last
	character, which cannot be a dash.

	* `network` -
	(Required)
	The name or self_link of the network to attach this firewall to.


	- - -


	* `allow` -
	(Optional)
	The list of ALLOW rules specified by this firewall. Each rule
	specifies a protocol and port-range tuple that describes a permitted
	connection.
	Structure is [documented below](#nested_allow).

	* `deny` -
	(Optional)
	The list of DENY rules specified by this firewall. Each rule specifies
	a protocol and port-range tuple that describes a denied connection.
	Structure is [documented below](#nested_deny).

	* `description` -
	(Optional)
	An optional description of this resource. Provide this property when
	you create the resource.

	* `destination_ranges` -
	(Optional)
	If destination ranges are specified, the firewall will apply only to
	traffic that has destination IP address in these ranges. These ranges
	must be expressed in CIDR format. IPv4 or IPv6 ranges are supported.

	* `direction` -
	(Optional)
	Direction of traffic to which this firewall applies; default is
	INGRESS. Note: For INGRESS traffic, one of `source_ranges`,
	`source_tags` or `source_service_accounts` is required.
	Possible values are: `INGRESS`, `EGRESS`.

	* `disabled` -
	(Optional)
	Denotes whether the firewall rule is disabled, i.e not applied to the
	network it is associated with. When set to true, the firewall rule is
	not enforced and the network behaves as if it did not exist. If this
	is unspecified, the firewall rule will be enabled.

	* `log_config` -
	(Optional)
	This field denotes the logging options for a particular firewall rule.
	If defined, logging is enabled, and logs will be exported to Cloud Logging.
	Structure is [documented below](#nested_log_config).

	* `priority` -
	(Optional)
	Priority for this rule. This is an integer between 0 and 65535, both
	inclusive. When not specified, the value assumed is 1000. Relative
	priorities determine precedence of conflicting rules. Lower value of
	priority implies higher precedence (eg, a rule with priority 0 has
	higher precedence than a rule with priority 1). DENY rules take
	precedence over ALLOW rules having equal priority.

	* `source_ranges` -
	(Optional)
	If source ranges are specified, the firewall will apply only to
	traffic that has source IP address in these ranges. These ranges must
	be expressed in CIDR format. One or both of sourceRanges and
	sourceTags may be set. If both properties are set, the firewall will
	apply to traffic that has source IP address within sourceRanges OR the
	source IP that belongs to a tag listed in the sourceTags property. The
	connection does not need to match both properties for the firewall to
	apply. IPv4 or IPv6 ranges are supported. For INGRESS traffic, one of
	`source_ranges`, `source_tags` or `source_service_accounts` is required.

	* `source_service_accounts` -
	(Optional)
	If source service accounts are specified, the firewall will apply only
	to traffic originating from an instance with a service account in this
	list. Source service accounts cannot be used to control traffic to an
	instance's external IP address because service accounts are associated
	with an instance, not an IP address. sourceRanges can be set at the
	same time as sourceServiceAccounts. If both are set, the firewall will
	apply to traffic that has source IP address within sourceRanges OR the
	source IP belongs to an instance with service account listed in
	sourceServiceAccount. The connection does not need to match both
	properties for the firewall to apply. sourceServiceAccounts cannot be
	used at the same time as sourceTags or targetTags. For INGRESS traffic,
	one of `source_ranges`, `source_tags` or `source_service_accounts` is required.

	* `source_tags` -
	(Optional)
	If source tags are specified, the firewall will apply only to traffic
	with source IP that belongs to a tag listed in source tags. Source
	tags cannot be used to control traffic to an instance's external IP
	address. Because tags are associated with an instance, not an IP
	address. One or both of sourceRanges and sourceTags may be set. If
	both properties are set, the firewall will apply to traffic that has
	source IP address within sourceRanges OR the source IP that belongs to
	a tag listed in the sourceTags property. The connection does not need
	to match both properties for the firewall to apply. For INGRESS traffic,
	one of `source_ranges`, `source_tags` or `source_service_accounts` is required.

	* `target_service_accounts` -
	(Optional)
	A list of service accounts indicating sets of instances located in the
	network that may make network connections as specified in allowed[].
	targetServiceAccounts cannot be used at the same time as targetTags or
	sourceTags. If neither targetServiceAccounts nor targetTags are
	specified, the firewall rule applies to all instances on the specified
	network.

	* `target_tags` -
	(Optional)
	A list of instance tags indicating sets of instances located in the
	network that may make network connections as specified in allowed[].
	If no targetTags are specified, the firewall rule applies to all
	instances on the specified network.

	* `project` - (Optional) The ID of the project in which the resource belongs.
	If it is not provided, the provider project is used.

	* `enable_logging` - (Optional, Deprecated) This field denotes whether to enable logging for a particular firewall rule.
	If logging is enabled, logs will be exported to Stackdriver. Deprecated in favor of `log_config`

	<a name="nested_allow"></a>The `allow` block supports:

	* `protocol` -
	(Required)
	The IP protocol to which this rule applies. The protocol type is
	required when creating a firewall rule. This value can either be
	one of the following well known protocol strings (tcp, udp,
	icmp, esp, ah, sctp, ipip, all), or the IP protocol number.

	* `ports` -
	(Optional)
	An optional list of ports to which this rule applies. This field
	is only applicable for UDP or TCP protocol. Each entry must be
	either an integer or a range. If not specified, this rule
	applies to connections through any port.
	Example inputs include: ["22"], ["80","443"], and
	["12345-12349"].

	<a name="nested_deny"></a>The `deny` block supports:

	* `protocol` -
	(Required)
	The IP protocol to which this rule applies. The protocol type is
	required when creating a firewall rule. This value can either be
	one of the following well known protocol strings (tcp, udp,
	icmp, esp, ah, sctp, ipip, all), or the IP protocol number.

	* `ports` -
	(Optional)
	An optional list of ports to which this rule applies. This field
	is only applicable for UDP or TCP protocol. Each entry must be
	either an integer or a range. If not specified, this rule
	applies to connections through any port.
	Example inputs include: ["22"], ["80","443"], and
	["12345-12349"].

	<a name="nested_log_config"></a>The `log_config` block supports:

	* `metadata` -
	(Required)
	This field denotes whether to include or exclude metadata for firewall logs.
	Possible values are: `EXCLUDE_ALL_METADATA`, `INCLUDE_ALL_METADATA`.

	## Attributes Reference

	In addition to the arguments listed above, the following computed attributes are exported:

	* `id` - an identifier for the resource with format `projects/{{project}}/global/firewalls/{{name}}`

	* `creation_timestamp` -
	Creation timestamp in RFC3339 text format.
	* `self_link` - The URI of the created resource.


	## Timeouts

	This resource provides the following
	[Timeouts](https://developer.hashicorp.com/terraform/plugin/sdkv2/resources/retries-and-customizable-timeouts) configuration options:

	- `create` - Default is 20 minutes.
	- `update` - Default is 20 minutes.
	- `delete` - Default is 20 minutes.

	## Import


	Firewall can be imported using any of these accepted formats:

	* `projects/{{project}}/global/firewalls/{{name}}`
	* `{{project}}/{{name}}`
	* `{{name}}`


	In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Firewall using one of the formats above. For example:

	```tf
	import {
	id = "projects/{{project}}/global/firewalls/{{name}}"
	to = google_compute_firewall.default
	}
	```

	When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), Firewall can be imported using one of the formats above. For example:

	```
	$ terraform import google_compute_firewall.default projects/{{project}}/global/firewalls/{{name}}
	$ terraform import google_compute_firewall.default {{project}}/{{name}}
	$ terraform import google_compute_firewall.default {{name}}
	```

	## User Project Overrides

	This resource supports [User Project Overrides](https://registry.terraform.io/providers/hashicorp/google/latest/docs/guides/provider_reference#user_project_override).