v5.18.0/website/docs/r/compute_region_security_policy_rule.html.markdown - terraform-provider-google-beta - Git at Google

 ---
 # ----------------------------------------------------------------------------
 #
 #     ***     AUTO GENERATED CODE    ***    Type: MMv1     ***
 #
 # ----------------------------------------------------------------------------
 #
 #     This file is automatically generated by Magic Modules and manual
 #     changes will be clobbered when the file is regenerated.
 #
 #     Please read more about how to change this file in
 #     .github/CONTRIBUTING.md.
 #
 # ----------------------------------------------------------------------------
 subcategory: "Compute Engine"
 description: |-
   A rule for the RegionSecurityPolicy.
 ---

 # google\_compute\_region\_security\_policy\_rule

 A rule for the RegionSecurityPolicy.

 ~> **Warning:** This resource is in beta, and should be used with the terraform-provider-google-beta provider.
 See [Provider Versions](https://terraform.io/docs/providers/google/guides/provider_versions.html) for more details on beta resources.

 To get more information about RegionSecurityPolicyRule, see:

 * [API documentation](https://cloud.google.com/compute/docs/reference/rest/beta/regionSecurityPolicies/addRule)
 * How-to Guides
     * [Creating region security policy rules](https://cloud.google.com/armor/docs/configure-security-policies)

 <div class = "oics-button" style="float: right; margin: 0 0 -15px">
   <a href="https://console.cloud.google.com/cloudshell/open?cloudshell_git_repo=https%3A%2F%2Fgithub.com%2Fterraform-google-modules%2Fdocs-examples.git&cloudshell_working_dir=region_security_policy_rule_basic&cloudshell_image=gcr.io%2Fcloudshell-images%2Fcloudshell%3Alatest&open_in_editor=main.tf&cloudshell_print=.%2Fmotd&cloudshell_tutorial=.%2Ftutorial.md" target="_blank">
     <img alt="Open in Cloud Shell" src="//gstatic.com/cloudssh/images/open-btn.svg" style="max-height: 44px; margin: 32px auto; max-width: 100%;">
   </a>
 </div>
 ## Example Usage - Region Security Policy Rule Basic


 ```hcl
 resource "google_compute_region_security_policy" "default" {
   provider    = google-beta

   region      = "us-west2"
   name        = "policyruletest"
   description = "basic region security policy"
   type        = "CLOUD_ARMOR"
 }

 resource "google_compute_region_security_policy_rule" "policy_rule" {
   provider = google-beta

   region          = "us-west2"
   security_policy = google_compute_region_security_policy.default.name
   description     = "new rule"
   priority        = 100
   match {
     versioned_expr = "SRC_IPS_V1"
     config {
       src_ip_ranges = ["10.10.0.0/16"]
     }
   }
   action          = "allow"
   preview         = true
 }
 ```
 <div class = "oics-button" style="float: right; margin: 0 0 -15px">
   <a href="https://console.cloud.google.com/cloudshell/open?cloudshell_git_repo=https%3A%2F%2Fgithub.com%2Fterraform-google-modules%2Fdocs-examples.git&cloudshell_working_dir=region_security_policy_rule_multiple_rules&cloudshell_image=gcr.io%2Fcloudshell-images%2Fcloudshell%3Alatest&open_in_editor=main.tf&cloudshell_print=.%2Fmotd&cloudshell_tutorial=.%2Ftutorial.md" target="_blank">
     <img alt="Open in Cloud Shell" src="//gstatic.com/cloudssh/images/open-btn.svg" style="max-height: 44px; margin: 32px auto; max-width: 100%;">
   </a>
 </div>
 ## Example Usage - Region Security Policy Rule Multiple Rules


 ```hcl
 resource "google_compute_region_security_policy" "default" {
   provider    = google-beta

   region      = "us-west2"
   name        = "policywithmultiplerules"
   description = "basic region security policy"
   type        = "CLOUD_ARMOR"
 }

 resource "google_compute_region_security_policy_rule" "policy_rule_one" {
   provider = google-beta

   region          = "us-west2"
   security_policy = google_compute_region_security_policy.default.name
   description     = "new rule one"
   priority        = 100
   match {
     versioned_expr = "SRC_IPS_V1"
     config {
       src_ip_ranges = ["10.10.0.0/16"]
     }
   }
   action          = "allow"
   preview         = true
 }

 resource "google_compute_region_security_policy_rule" "policy_rule_two" {
   provider = google-beta

   region          = "us-west2"
   security_policy = google_compute_region_security_policy.default.name
   description     = "new rule two"
   priority        = 101
   match {
     versioned_expr = "SRC_IPS_V1"
     config {
       src_ip_ranges = ["192.168.0.0/16", "10.0.0.0/8"]
     }
   }
   action          = "allow"
   preview         = true
 }
 ```
 ## Example Usage - Region Security Policy Rule With Network Match


 ```hcl
 # First activate advanced network DDoS protection for the desired region
 resource "google_compute_region_security_policy" "policyddosprotection" {
   provider    = google-beta

   region      = "us-west2"
   name        = "policyddosprotection"
   description = "policy for activating network DDoS protection for the desired region"
   type        = "CLOUD_ARMOR_NETWORK"
   ddos_protection_config {
     ddos_protection = "ADVANCED_PREVIEW"
   }
 }

 resource "google_compute_network_edge_security_service" "edge_sec_service" {
   provider        = google-beta

   region          = "us-west2"
   name            = "edgesecservice"
   description     = "linking policy to edge security service"
   security_policy = google_compute_region_security_policy.policyddosprotection.self_link
 }

 # Add the desired policy and custom rule.
 resource "google_compute_region_security_policy" "policynetworkmatch" {
   provider    = google-beta

   region      = "us-west2"
   name        = "policyfornetworkmatch"
   description = "region security policy for network match"
   type        = "CLOUD_ARMOR_NETWORK"
   user_defined_fields {
     name = "SIG1_AT_0"
     base = "TCP"
     offset = 8
     size = 2
     mask = "0x8F00"
   }
   depends_on  = [google_compute_network_edge_security_service.edge_sec_service]
 }

 resource "google_compute_region_security_policy_rule" "policy_rule_network_match" {
   provider        = google-beta

   region          = "us-west2"
   security_policy = google_compute_region_security_policy.policynetworkmatch.name
   description     = "custom rule for network match"
   priority        = 100
   network_match {
     src_ip_ranges = ["10.10.0.0/16"]
     user_defined_fields {
       name = "SIG1_AT_0"
       values = ["0x8F00"]
     }
   }
   action          = "allow"
   preview         = true
 }
 ```

 ## Argument Reference

 The following arguments are supported:


 * `priority` -
   (Required)
   An integer indicating the priority of a rule in the list.
   The priority must be a positive value between 0 and 2147483647.
   Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.

 * `action` -
   (Required)
   The Action to perform when the rule is matched. The following are the valid actions:
   * allow: allow access to target.
   * deny(STATUS): deny access to target, returns the HTTP response code specified. Valid values for STATUS are 403, 404, and 502.
   * rate_based_ban: limit client traffic to the configured threshold and ban the client if the traffic exceeds the threshold. Configure parameters for this action in RateLimitOptions. Requires rateLimitOptions to be set.
   * redirect: redirect to a different target. This can either be an internal reCAPTCHA redirect, or an external URL-based redirect via a 302 response. Parameters for this action can be configured via redirectOptions. This action is only supported in Global Security Policies of type CLOUD_ARMOR.
   * throttle: limit client traffic to the configured threshold. Configure parameters for this action in rateLimitOptions. Requires rateLimitOptions to be set for this.

 * `region` -
   (Required)
   The Region in which the created Region Security Policy rule should reside.

 * `security_policy` -
   (Required)
   The name of the security policy this rule belongs to.


 - - -


 * `description` -
   (Optional)
   An optional description of this resource. Provide this property when you create the resource.

 * `match` -
   (Optional)
   A match condition that incoming traffic is evaluated against.
   If it evaluates to true, the corresponding 'action' is enforced.
   Structure is [documented below](#nested_match).

 * `preview` -
   (Optional)
   If set to true, the specified action is not enforced.

 * `network_match` -
   (Optional)
   A match condition that incoming packets are evaluated against for CLOUD_ARMOR_NETWORK security policies. If it matches, the corresponding 'action' is enforced.
   The match criteria for a rule consists of built-in match fields (like 'srcIpRanges') and potentially multiple user-defined match fields ('userDefinedFields').
   Field values may be extracted directly from the packet or derived from it (e.g. 'srcRegionCodes'). Some fields may not be present in every packet (e.g. 'srcPorts'). A user-defined field is only present if the base header is found in the packet and the entire field is in bounds.
   Each match field may specify which values can match it, listing one or more ranges, prefixes, or exact values that are considered a match for the field. A field value must be present in order to match a specified match field. If no match values are specified for a match field, then any field value is considered to match it, and it's not required to be present. For strings specifying '*' is also equivalent to match all.
   For a packet to match a rule, all specified match fields must match the corresponding field values derived from the packet.
   Example:
   networkMatch: srcIpRanges: - "192.0.2.0/24" - "198.51.100.0/24" userDefinedFields: - name: "ipv4_fragment_offset" values: - "1-0x1fff"
   The above match condition matches packets with a source IP in 192.0.2.0/24 or 198.51.100.0/24 and a user-defined field named "ipv4_fragment_offset" with a value between 1 and 0x1fff inclusive
   Structure is [documented below](#nested_network_match).

 * `project` - (Optional) The ID of the project in which the resource belongs.
     If it is not provided, the provider project is used.


 <a name="nested_match"></a>The `match` block supports:

 * `versioned_expr` -
   (Optional)
   Preconfigured versioned expression. If this field is specified, config must also be specified.
   Available preconfigured expressions along with their requirements are: SRC_IPS_V1 - must specify the corresponding srcIpRange field in config.
   Possible values are: `SRC_IPS_V1`.

 * `config` -
   (Optional)
   The configuration options available when specifying versionedExpr.
   This field must be specified if versionedExpr is specified and cannot be specified if versionedExpr is not specified.
   Structure is [documented below](#nested_config).


 <a name="nested_config"></a>The `config` block supports:

 * `src_ip_ranges` -
   (Optional)
   CIDR IP address range. Maximum number of srcIpRanges allowed is 10.

 <a name="nested_network_match"></a>The `network_match` block supports:

 * `user_defined_fields` -
   (Optional)
   User-defined fields. Each element names a defined field and lists the matching values for that field.
   Structure is [documented below](#nested_user_defined_fields).

 * `src_ip_ranges` -
   (Optional)
   Source IPv4/IPv6 addresses or CIDR prefixes, in standard text format.

 * `dest_ip_ranges` -
   (Optional)
   Destination IPv4/IPv6 addresses or CIDR prefixes, in standard text format.

 * `ip_protocols` -
   (Optional)
   IPv4 protocol / IPv6 next header (after extension headers). Each element can be an 8-bit unsigned decimal number (e.g. "6"), range (e.g. "253-254"), or one of the following protocol names: "tcp", "udp", "icmp", "esp", "ah", "ipip", or "sctp".

 * `src_ports` -
   (Optional)
   Source port numbers for TCP/UDP/SCTP. Each element can be a 16-bit unsigned decimal number (e.g. "80") or range (e.g. "0-1023").

 * `dest_ports` -
   (Optional)
   Destination port numbers for TCP/UDP/SCTP. Each element can be a 16-bit unsigned decimal number (e.g. "80") or range (e.g. "0-1023").

 * `src_region_codes` -
   (Optional)
   Two-letter ISO 3166-1 alpha-2 country code associated with the source IP address.

 * `src_asns` -
   (Optional)
   BGP Autonomous System Number associated with the source IP address.


 <a name="nested_user_defined_fields"></a>The `user_defined_fields` block supports:

 * `name` -
   (Optional)
   Name of the user-defined field, as given in the definition.

 * `values` -
   (Optional)
   Matching values of the field. Each element can be a 32-bit unsigned decimal or hexadecimal (starting with "0x") number (e.g. "64") or range (e.g. "0x400-0x7ff").

 ## Attributes Reference

 In addition to the arguments listed above, the following computed attributes are exported:

 * `id` - an identifier for the resource with format `projects/{{project}}/regions/{{region}}/securityPolicies/{{security_policy}}/priority/{{priority}}`


 ## Timeouts

 This resource provides the following
 [Timeouts](https://developer.hashicorp.com/terraform/plugin/sdkv2/resources/retries-and-customizable-timeouts) configuration options:

 - `create` - Default is 20 minutes.
 - `update` - Default is 20 minutes.
 - `delete` - Default is 20 minutes.

 ## Import


 RegionSecurityPolicyRule can be imported using any of these accepted formats:

 * `projects/{{project}}/regions/{{region}}/securityPolicies/{{security_policy}}/priority/{{priority}}`
 * `{{project}}/{{region}}/{{security_policy}}/{{priority}}`
 * `{{region}}/{{security_policy}}/{{priority}}`
 * `{{security_policy}}/{{priority}}`


 In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RegionSecurityPolicyRule using one of the formats above. For example:

 ```tf
 import {
   id = "projects/{{project}}/regions/{{region}}/securityPolicies/{{security_policy}}/priority/{{priority}}"
   to = google_compute_region_security_policy_rule.default
 }
 ```

 When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), RegionSecurityPolicyRule can be imported using one of the formats above. For example:

 ```
 $ terraform import google_compute_region_security_policy_rule.default projects/{{project}}/regions/{{region}}/securityPolicies/{{security_policy}}/priority/{{priority}}
 $ terraform import google_compute_region_security_policy_rule.default {{project}}/{{region}}/{{security_policy}}/{{priority}}
 $ terraform import google_compute_region_security_policy_rule.default {{region}}/{{security_policy}}/{{priority}}
 $ terraform import google_compute_region_security_policy_rule.default {{security_policy}}/{{priority}}
 ```

 ## User Project Overrides

 This resource supports [User Project Overrides](https://registry.terraform.io/providers/hashicorp/google/latest/docs/guides/provider_reference#user_project_override).
	---
	# ----------------------------------------------------------------------------
	#
	# * AUTO GENERATED CODE * Type: MMv1 ***
	#
	# ----------------------------------------------------------------------------
	#
	# This file is automatically generated by Magic Modules and manual
	# changes will be clobbered when the file is regenerated.
	#
	# Please read more about how to change this file in
	# .github/CONTRIBUTING.md.
	#
	# ----------------------------------------------------------------------------
	subcategory: "Compute Engine"
	description: \|-
	A rule for the RegionSecurityPolicy.
	---

	# google\_compute\_region\_security\_policy\_rule

	A rule for the RegionSecurityPolicy.

	~> Warning: This resource is in beta, and should be used with the terraform-provider-google-beta provider.
	See [Provider Versions](https://terraform.io/docs/providers/google/guides/provider_versions.html) for more details on beta resources.

	To get more information about RegionSecurityPolicyRule, see:

	* [API documentation](https://cloud.google.com/compute/docs/reference/rest/beta/regionSecurityPolicies/addRule)
	* How-to Guides
	* [Creating region security policy rules](https://cloud.google.com/armor/docs/configure-security-policies)

	<div class = "oics-button" style="float: right; margin: 0 0 -15px">
	<a href="https://console.cloud.google.com/cloudshell/open?cloudshell_git_repo=https%3A%2F%2Fgithub.com%2Fterraform-google-modules%2Fdocs-examples.git&cloudshell_working_dir=region_security_policy_rule_basic&cloudshell_image=gcr.io%2Fcloudshell-images%2Fcloudshell%3Alatest&open_in_editor=main.tf&cloudshell_print=.%2Fmotd&cloudshell_tutorial=.%2Ftutorial.md" target="_blank">
	<img alt="Open in Cloud Shell" src="//gstatic.com/cloudssh/images/open-btn.svg" style="max-height: 44px; margin: 32px auto; max-width: 100%;">
	</a>
	</div>
	## Example Usage - Region Security Policy Rule Basic


	```hcl
	resource "google_compute_region_security_policy" "default" {
	provider = google-beta

	region = "us-west2"
	name = "policyruletest"
	description = "basic region security policy"
	type = "CLOUD_ARMOR"
	}

	resource "google_compute_region_security_policy_rule" "policy_rule" {
	provider = google-beta

	region = "us-west2"
	security_policy = google_compute_region_security_policy.default.name
	description = "new rule"
	priority = 100
	match {
	versioned_expr = "SRC_IPS_V1"
	config {
	src_ip_ranges = ["10.10.0.0/16"]
	}
	}
	action = "allow"
	preview = true
	}
	```
	<div class = "oics-button" style="float: right; margin: 0 0 -15px">
	<a href="https://console.cloud.google.com/cloudshell/open?cloudshell_git_repo=https%3A%2F%2Fgithub.com%2Fterraform-google-modules%2Fdocs-examples.git&cloudshell_working_dir=region_security_policy_rule_multiple_rules&cloudshell_image=gcr.io%2Fcloudshell-images%2Fcloudshell%3Alatest&open_in_editor=main.tf&cloudshell_print=.%2Fmotd&cloudshell_tutorial=.%2Ftutorial.md" target="_blank">
	<img alt="Open in Cloud Shell" src="//gstatic.com/cloudssh/images/open-btn.svg" style="max-height: 44px; margin: 32px auto; max-width: 100%;">
	</a>
	</div>
	## Example Usage - Region Security Policy Rule Multiple Rules


	```hcl
	resource "google_compute_region_security_policy" "default" {
	provider = google-beta

	region = "us-west2"
	name = "policywithmultiplerules"
	description = "basic region security policy"
	type = "CLOUD_ARMOR"
	}

	resource "google_compute_region_security_policy_rule" "policy_rule_one" {
	provider = google-beta

	region = "us-west2"
	security_policy = google_compute_region_security_policy.default.name
	description = "new rule one"
	priority = 100
	match {
	versioned_expr = "SRC_IPS_V1"
	config {
	src_ip_ranges = ["10.10.0.0/16"]
	}
	}
	action = "allow"
	preview = true
	}

	resource "google_compute_region_security_policy_rule" "policy_rule_two" {
	provider = google-beta

	region = "us-west2"
	security_policy = google_compute_region_security_policy.default.name
	description = "new rule two"
	priority = 101
	match {
	versioned_expr = "SRC_IPS_V1"
	config {
	src_ip_ranges = ["192.168.0.0/16", "10.0.0.0/8"]
	}
	}
	action = "allow"
	preview = true
	}
	```
	## Example Usage - Region Security Policy Rule With Network Match


	```hcl
	# First activate advanced network DDoS protection for the desired region
	resource "google_compute_region_security_policy" "policyddosprotection" {
	provider = google-beta

	region = "us-west2"
	name = "policyddosprotection"
	description = "policy for activating network DDoS protection for the desired region"
	type = "CLOUD_ARMOR_NETWORK"
	ddos_protection_config {
	ddos_protection = "ADVANCED_PREVIEW"
	}
	}

	resource "google_compute_network_edge_security_service" "edge_sec_service" {
	provider = google-beta

	region = "us-west2"
	name = "edgesecservice"
	description = "linking policy to edge security service"
	security_policy = google_compute_region_security_policy.policyddosprotection.self_link
	}

	# Add the desired policy and custom rule.
	resource "google_compute_region_security_policy" "policynetworkmatch" {
	provider = google-beta

	region = "us-west2"
	name = "policyfornetworkmatch"
	description = "region security policy for network match"
	type = "CLOUD_ARMOR_NETWORK"
	user_defined_fields {
	name = "SIG1_AT_0"
	base = "TCP"
	offset = 8
	size = 2
	mask = "0x8F00"
	}
	depends_on = [google_compute_network_edge_security_service.edge_sec_service]
	}

	resource "google_compute_region_security_policy_rule" "policy_rule_network_match" {
	provider = google-beta

	region = "us-west2"
	security_policy = google_compute_region_security_policy.policynetworkmatch.name
	description = "custom rule for network match"
	priority = 100
	network_match {
	src_ip_ranges = ["10.10.0.0/16"]
	user_defined_fields {
	name = "SIG1_AT_0"
	values = ["0x8F00"]
	}
	}
	action = "allow"
	preview = true
	}
	```

	## Argument Reference

	The following arguments are supported:


	* `priority` -
	(Required)
	An integer indicating the priority of a rule in the list.
	The priority must be a positive value between 0 and 2147483647.
	Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.

	* `action` -
	(Required)
	The Action to perform when the rule is matched. The following are the valid actions:
	* allow: allow access to target.
	* deny(STATUS): deny access to target, returns the HTTP response code specified. Valid values for STATUS are 403, 404, and 502.
	* rate_based_ban: limit client traffic to the configured threshold and ban the client if the traffic exceeds the threshold. Configure parameters for this action in RateLimitOptions. Requires rateLimitOptions to be set.
	* redirect: redirect to a different target. This can either be an internal reCAPTCHA redirect, or an external URL-based redirect via a 302 response. Parameters for this action can be configured via redirectOptions. This action is only supported in Global Security Policies of type CLOUD_ARMOR.
	* throttle: limit client traffic to the configured threshold. Configure parameters for this action in rateLimitOptions. Requires rateLimitOptions to be set for this.

	* `region` -
	(Required)
	The Region in which the created Region Security Policy rule should reside.

	* `security_policy` -
	(Required)
	The name of the security policy this rule belongs to.


	- - -


	* `description` -
	(Optional)
	An optional description of this resource. Provide this property when you create the resource.

	* `match` -
	(Optional)
	A match condition that incoming traffic is evaluated against.
	If it evaluates to true, the corresponding 'action' is enforced.
	Structure is [documented below](#nested_match).

	* `preview` -
	(Optional)
	If set to true, the specified action is not enforced.

	* `network_match` -
	(Optional)
	A match condition that incoming packets are evaluated against for CLOUD_ARMOR_NETWORK security policies. If it matches, the corresponding 'action' is enforced.
	The match criteria for a rule consists of built-in match fields (like 'srcIpRanges') and potentially multiple user-defined match fields ('userDefinedFields').
	Field values may be extracted directly from the packet or derived from it (e.g. 'srcRegionCodes'). Some fields may not be present in every packet (e.g. 'srcPorts'). A user-defined field is only present if the base header is found in the packet and the entire field is in bounds.
	Each match field may specify which values can match it, listing one or more ranges, prefixes, or exact values that are considered a match for the field. A field value must be present in order to match a specified match field. If no match values are specified for a match field, then any field value is considered to match it, and it's not required to be present. For strings specifying '*' is also equivalent to match all.
	For a packet to match a rule, all specified match fields must match the corresponding field values derived from the packet.
	Example:
	networkMatch: srcIpRanges: - "192.0.2.0/24" - "198.51.100.0/24" userDefinedFields: - name: "ipv4_fragment_offset" values: - "1-0x1fff"
	The above match condition matches packets with a source IP in 192.0.2.0/24 or 198.51.100.0/24 and a user-defined field named "ipv4_fragment_offset" with a value between 1 and 0x1fff inclusive
	Structure is [documented below](#nested_network_match).

	* `project` - (Optional) The ID of the project in which the resource belongs.
	If it is not provided, the provider project is used.


	<a name="nested_match"></a>The `match` block supports:

	* `versioned_expr` -
	(Optional)
	Preconfigured versioned expression. If this field is specified, config must also be specified.
	Available preconfigured expressions along with their requirements are: SRC_IPS_V1 - must specify the corresponding srcIpRange field in config.
	Possible values are: `SRC_IPS_V1`.

	* `config` -
	(Optional)
	The configuration options available when specifying versionedExpr.
	This field must be specified if versionedExpr is specified and cannot be specified if versionedExpr is not specified.
	Structure is [documented below](#nested_config).


	<a name="nested_config"></a>The `config` block supports:

	* `src_ip_ranges` -
	(Optional)
	CIDR IP address range. Maximum number of srcIpRanges allowed is 10.

	<a name="nested_network_match"></a>The `network_match` block supports:

	* `user_defined_fields` -
	(Optional)
	User-defined fields. Each element names a defined field and lists the matching values for that field.
	Structure is [documented below](#nested_user_defined_fields).

	* `src_ip_ranges` -
	(Optional)
	Source IPv4/IPv6 addresses or CIDR prefixes, in standard text format.

	* `dest_ip_ranges` -
	(Optional)
	Destination IPv4/IPv6 addresses or CIDR prefixes, in standard text format.

	* `ip_protocols` -
	(Optional)
	IPv4 protocol / IPv6 next header (after extension headers). Each element can be an 8-bit unsigned decimal number (e.g. "6"), range (e.g. "253-254"), or one of the following protocol names: "tcp", "udp", "icmp", "esp", "ah", "ipip", or "sctp".

	* `src_ports` -
	(Optional)
	Source port numbers for TCP/UDP/SCTP. Each element can be a 16-bit unsigned decimal number (e.g. "80") or range (e.g. "0-1023").

	* `dest_ports` -
	(Optional)
	Destination port numbers for TCP/UDP/SCTP. Each element can be a 16-bit unsigned decimal number (e.g. "80") or range (e.g. "0-1023").

	* `src_region_codes` -
	(Optional)
	Two-letter ISO 3166-1 alpha-2 country code associated with the source IP address.

	* `src_asns` -
	(Optional)
	BGP Autonomous System Number associated with the source IP address.


	<a name="nested_user_defined_fields"></a>The `user_defined_fields` block supports:

	* `name` -
	(Optional)
	Name of the user-defined field, as given in the definition.

	* `values` -
	(Optional)
	Matching values of the field. Each element can be a 32-bit unsigned decimal or hexadecimal (starting with "0x") number (e.g. "64") or range (e.g. "0x400-0x7ff").

	## Attributes Reference

	In addition to the arguments listed above, the following computed attributes are exported:

	* `id` - an identifier for the resource with format `projects/{{project}}/regions/{{region}}/securityPolicies/{{security_policy}}/priority/{{priority}}`


	## Timeouts

	This resource provides the following
	[Timeouts](https://developer.hashicorp.com/terraform/plugin/sdkv2/resources/retries-and-customizable-timeouts) configuration options:

	- `create` - Default is 20 minutes.
	- `update` - Default is 20 minutes.
	- `delete` - Default is 20 minutes.

	## Import


	RegionSecurityPolicyRule can be imported using any of these accepted formats:

	* `projects/{{project}}/regions/{{region}}/securityPolicies/{{security_policy}}/priority/{{priority}}`
	* `{{project}}/{{region}}/{{security_policy}}/{{priority}}`
	* `{{region}}/{{security_policy}}/{{priority}}`
	* `{{security_policy}}/{{priority}}`


	In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import RegionSecurityPolicyRule using one of the formats above. For example:

	```tf
	import {
	id = "projects/{{project}}/regions/{{region}}/securityPolicies/{{security_policy}}/priority/{{priority}}"
	to = google_compute_region_security_policy_rule.default
	}
	```

	When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), RegionSecurityPolicyRule can be imported using one of the formats above. For example:

	```
	$ terraform import google_compute_region_security_policy_rule.default projects/{{project}}/regions/{{region}}/securityPolicies/{{security_policy}}/priority/{{priority}}
	$ terraform import google_compute_region_security_policy_rule.default {{project}}/{{region}}/{{security_policy}}/{{priority}}
	$ terraform import google_compute_region_security_policy_rule.default {{region}}/{{security_policy}}/{{priority}}
	$ terraform import google_compute_region_security_policy_rule.default {{security_policy}}/{{priority}}
	```

	## User Project Overrides

	This resource supports [User Project Overrides](https://registry.terraform.io/providers/hashicorp/google/latest/docs/guides/provider_reference#user_project_override).