# coding=utf-8
# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
# *** Do not edit by hand unless you're certain you know what you are doing! ***

import copy
import warnings
import pulumi
import pulumi.runtime
from typing import Any, Mapping, Optional, Sequence, Union, overload
from .. import _utilities
from . import outputs
from ._inputs import *

__all__ = ['RegionSecurityPolicyRuleArgs', 'RegionSecurityPolicyRule']

@pulumi.input_type
class RegionSecurityPolicyRuleArgs:
    def __init__(__self__, *,
                 action: pulumi.Input[str],
                 priority: pulumi.Input[int],
                 region: pulumi.Input[str],
                 security_policy: pulumi.Input[str],
                 description: Optional[pulumi.Input[str]] = None,
                 match: Optional[pulumi.Input['RegionSecurityPolicyRuleMatchArgs']] = None,
                 network_match: Optional[pulumi.Input['RegionSecurityPolicyRuleNetworkMatchArgs']] = None,
                 preview: Optional[pulumi.Input[bool]] = None,
                 project: Optional[pulumi.Input[str]] = None):
        """
        The set of arguments for constructing a RegionSecurityPolicyRule resource.
        :param pulumi.Input[str] action: The Action to perform when the rule is matched. The following are the valid actions:
               * allow: allow access to target.
               * deny(STATUS): deny access to target, returns the HTTP response code specified. Valid values for STATUS are 403, 404, and 502.
               * rate_based_ban: limit client traffic to the configured threshold and ban the client if the traffic exceeds the threshold. Configure parameters for this action in RateLimitOptions. Requires rateLimitOptions to be set.
               * redirect: redirect to a different target. This can either be an internal reCAPTCHA redirect, or an external URL-based redirect via a 302 response. Parameters for this action can be configured via redirectOptions. This action is only supported in Global Security Policies of type CLOUD_ARMOR.
               * throttle: limit client traffic to the configured threshold. Configure parameters for this action in rateLimitOptions. Requires rateLimitOptions to be set for this.
        :param pulumi.Input[int] priority: An integer indicating the priority of a rule in the list.
               The priority must be a positive value between 0 and 2147483647.
               Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
        :param pulumi.Input[str] region: The Region in which the created Region Security Policy rule should reside.
        :param pulumi.Input[str] security_policy: The name of the security policy this rule belongs to.
               
               
               - - -
        :param pulumi.Input[str] description: An optional description of this resource. Provide this property when you create the resource.
        :param pulumi.Input['RegionSecurityPolicyRuleMatchArgs'] match: A match condition that incoming traffic is evaluated against.
               If it evaluates to true, the corresponding 'action' is enforced.
               Structure is documented below.
        :param pulumi.Input['RegionSecurityPolicyRuleNetworkMatchArgs'] network_match: A match condition that incoming packets are evaluated against for CLOUD_ARMOR_NETWORK security policies. If it matches, the corresponding 'action' is enforced.
               The match criteria for a rule consists of built-in match fields (like 'srcIpRanges') and potentially multiple user-defined match fields ('userDefinedFields').
               Field values may be extracted directly from the packet or derived from it (e.g. 'srcRegionCodes'). Some fields may not be present in every packet (e.g. 'srcPorts'). A user-defined field is only present if the base header is found in the packet and the entire field is in bounds.
               Each match field may specify which values can match it, listing one or more ranges, prefixes, or exact values that are considered a match for the field. A field value must be present in order to match a specified match field. If no match values are specified for a match field, then any field value is considered to match it, and it's not required to be present. For strings specifying '*' is also equivalent to match all.
               For a packet to match a rule, all specified match fields must match the corresponding field values derived from the packet.
               Example:
               networkMatch: srcIpRanges: - "192.0.2.0/24" - "198.51.100.0/24" userDefinedFields: - name: "ipv4_fragment_offset" values: - "1-0x1fff"
               The above match condition matches packets with a source IP in 192.0.2.0/24 or 198.51.100.0/24 and a user-defined field named "ipv4_fragment_offset" with a value between 1 and 0x1fff inclusive
               Structure is documented below.
        :param pulumi.Input[bool] preview: If set to true, the specified action is not enforced.
        :param pulumi.Input[str] project: The ID of the project in which the resource belongs.
               If it is not provided, the provider project is used.
        """
        pulumi.set(__self__, "action", action)
        pulumi.set(__self__, "priority", priority)
        pulumi.set(__self__, "region", region)
        pulumi.set(__self__, "security_policy", security_policy)
        if description is not None:
            pulumi.set(__self__, "description", description)
        if match is not None:
            pulumi.set(__self__, "match", match)
        if network_match is not None:
            pulumi.set(__self__, "network_match", network_match)
        if preview is not None:
            pulumi.set(__self__, "preview", preview)
        if project is not None:
            pulumi.set(__self__, "project", project)

    @property
    @pulumi.getter
    def action(self) -> pulumi.Input[str]:
        """
        The Action to perform when the rule is matched. The following are the valid actions:
        * allow: allow access to target.
        * deny(STATUS): deny access to target, returns the HTTP response code specified. Valid values for STATUS are 403, 404, and 502.
        * rate_based_ban: limit client traffic to the configured threshold and ban the client if the traffic exceeds the threshold. Configure parameters for this action in RateLimitOptions. Requires rateLimitOptions to be set.
        * redirect: redirect to a different target. This can either be an internal reCAPTCHA redirect, or an external URL-based redirect via a 302 response. Parameters for this action can be configured via redirectOptions. This action is only supported in Global Security Policies of type CLOUD_ARMOR.
        * throttle: limit client traffic to the configured threshold. Configure parameters for this action in rateLimitOptions. Requires rateLimitOptions to be set for this.
        """
        return pulumi.get(self, "action")

    @action.setter
    def action(self, value: pulumi.Input[str]):
        pulumi.set(self, "action", value)

    @property
    @pulumi.getter
    def priority(self) -> pulumi.Input[int]:
        """
        An integer indicating the priority of a rule in the list.
        The priority must be a positive value between 0 and 2147483647.
        Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
        """
        return pulumi.get(self, "priority")

    @priority.setter
    def priority(self, value: pulumi.Input[int]):
        pulumi.set(self, "priority", value)

    @property
    @pulumi.getter
    def region(self) -> pulumi.Input[str]:
        """
        The Region in which the created Region Security Policy rule should reside.
        """
        return pulumi.get(self, "region")

    @region.setter
    def region(self, value: pulumi.Input[str]):
        pulumi.set(self, "region", value)

    @property
    @pulumi.getter(name="securityPolicy")
    def security_policy(self) -> pulumi.Input[str]:
        """
        The name of the security policy this rule belongs to.


        - - -
        """
        return pulumi.get(self, "security_policy")

    @security_policy.setter
    def security_policy(self, value: pulumi.Input[str]):
        pulumi.set(self, "security_policy", value)

    @property
    @pulumi.getter
    def description(self) -> Optional[pulumi.Input[str]]:
        """
        An optional description of this resource. Provide this property when you create the resource.
        """
        return pulumi.get(self, "description")

    @description.setter
    def description(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "description", value)

    @property
    @pulumi.getter
    def match(self) -> Optional[pulumi.Input['RegionSecurityPolicyRuleMatchArgs']]:
        """
        A match condition that incoming traffic is evaluated against.
        If it evaluates to true, the corresponding 'action' is enforced.
        Structure is documented below.
        """
        return pulumi.get(self, "match")

    @match.setter
    def match(self, value: Optional[pulumi.Input['RegionSecurityPolicyRuleMatchArgs']]):
        pulumi.set(self, "match", value)

    @property
    @pulumi.getter(name="networkMatch")
    def network_match(self) -> Optional[pulumi.Input['RegionSecurityPolicyRuleNetworkMatchArgs']]:
        """
        A match condition that incoming packets are evaluated against for CLOUD_ARMOR_NETWORK security policies. If it matches, the corresponding 'action' is enforced.
        The match criteria for a rule consists of built-in match fields (like 'srcIpRanges') and potentially multiple user-defined match fields ('userDefinedFields').
        Field values may be extracted directly from the packet or derived from it (e.g. 'srcRegionCodes'). Some fields may not be present in every packet (e.g. 'srcPorts'). A user-defined field is only present if the base header is found in the packet and the entire field is in bounds.
        Each match field may specify which values can match it, listing one or more ranges, prefixes, or exact values that are considered a match for the field. A field value must be present in order to match a specified match field. If no match values are specified for a match field, then any field value is considered to match it, and it's not required to be present. For strings specifying '*' is also equivalent to match all.
        For a packet to match a rule, all specified match fields must match the corresponding field values derived from the packet.
        Example:
        networkMatch: srcIpRanges: - "192.0.2.0/24" - "198.51.100.0/24" userDefinedFields: - name: "ipv4_fragment_offset" values: - "1-0x1fff"
        The above match condition matches packets with a source IP in 192.0.2.0/24 or 198.51.100.0/24 and a user-defined field named "ipv4_fragment_offset" with a value between 1 and 0x1fff inclusive
        Structure is documented below.
        """
        return pulumi.get(self, "network_match")

    @network_match.setter
    def network_match(self, value: Optional[pulumi.Input['RegionSecurityPolicyRuleNetworkMatchArgs']]):
        pulumi.set(self, "network_match", value)

    @property
    @pulumi.getter
    def preview(self) -> Optional[pulumi.Input[bool]]:
        """
        If set to true, the specified action is not enforced.
        """
        return pulumi.get(self, "preview")

    @preview.setter
    def preview(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "preview", value)

    @property
    @pulumi.getter
    def project(self) -> Optional[pulumi.Input[str]]:
        """
        The ID of the project in which the resource belongs.
        If it is not provided, the provider project is used.
        """
        return pulumi.get(self, "project")

    @project.setter
    def project(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "project", value)


@pulumi.input_type
class _RegionSecurityPolicyRuleState:
    def __init__(__self__, *,
                 action: Optional[pulumi.Input[str]] = None,
                 description: Optional[pulumi.Input[str]] = None,
                 match: Optional[pulumi.Input['RegionSecurityPolicyRuleMatchArgs']] = None,
                 network_match: Optional[pulumi.Input['RegionSecurityPolicyRuleNetworkMatchArgs']] = None,
                 preview: Optional[pulumi.Input[bool]] = None,
                 priority: Optional[pulumi.Input[int]] = None,
                 project: Optional[pulumi.Input[str]] = None,
                 region: Optional[pulumi.Input[str]] = None,
                 security_policy: Optional[pulumi.Input[str]] = None):
        """
        Input properties used for looking up and filtering RegionSecurityPolicyRule resources.
        :param pulumi.Input[str] action: The Action to perform when the rule is matched. The following are the valid actions:
               * allow: allow access to target.
               * deny(STATUS): deny access to target, returns the HTTP response code specified. Valid values for STATUS are 403, 404, and 502.
               * rate_based_ban: limit client traffic to the configured threshold and ban the client if the traffic exceeds the threshold. Configure parameters for this action in RateLimitOptions. Requires rateLimitOptions to be set.
               * redirect: redirect to a different target. This can either be an internal reCAPTCHA redirect, or an external URL-based redirect via a 302 response. Parameters for this action can be configured via redirectOptions. This action is only supported in Global Security Policies of type CLOUD_ARMOR.
               * throttle: limit client traffic to the configured threshold. Configure parameters for this action in rateLimitOptions. Requires rateLimitOptions to be set for this.
        :param pulumi.Input[str] description: An optional description of this resource. Provide this property when you create the resource.
        :param pulumi.Input['RegionSecurityPolicyRuleMatchArgs'] match: A match condition that incoming traffic is evaluated against.
               If it evaluates to true, the corresponding 'action' is enforced.
               Structure is documented below.
        :param pulumi.Input['RegionSecurityPolicyRuleNetworkMatchArgs'] network_match: A match condition that incoming packets are evaluated against for CLOUD_ARMOR_NETWORK security policies. If it matches, the corresponding 'action' is enforced.
               The match criteria for a rule consists of built-in match fields (like 'srcIpRanges') and potentially multiple user-defined match fields ('userDefinedFields').
               Field values may be extracted directly from the packet or derived from it (e.g. 'srcRegionCodes'). Some fields may not be present in every packet (e.g. 'srcPorts'). A user-defined field is only present if the base header is found in the packet and the entire field is in bounds.
               Each match field may specify which values can match it, listing one or more ranges, prefixes, or exact values that are considered a match for the field. A field value must be present in order to match a specified match field. If no match values are specified for a match field, then any field value is considered to match it, and it's not required to be present. For strings specifying '*' is also equivalent to match all.
               For a packet to match a rule, all specified match fields must match the corresponding field values derived from the packet.
               Example:
               networkMatch: srcIpRanges: - "192.0.2.0/24" - "198.51.100.0/24" userDefinedFields: - name: "ipv4_fragment_offset" values: - "1-0x1fff"
               The above match condition matches packets with a source IP in 192.0.2.0/24 or 198.51.100.0/24 and a user-defined field named "ipv4_fragment_offset" with a value between 1 and 0x1fff inclusive
               Structure is documented below.
        :param pulumi.Input[bool] preview: If set to true, the specified action is not enforced.
        :param pulumi.Input[int] priority: An integer indicating the priority of a rule in the list.
               The priority must be a positive value between 0 and 2147483647.
               Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
        :param pulumi.Input[str] project: The ID of the project in which the resource belongs.
               If it is not provided, the provider project is used.
        :param pulumi.Input[str] region: The Region in which the created Region Security Policy rule should reside.
        :param pulumi.Input[str] security_policy: The name of the security policy this rule belongs to.
               
               
               - - -
        """
        if action is not None:
            pulumi.set(__self__, "action", action)
        if description is not None:
            pulumi.set(__self__, "description", description)
        if match is not None:
            pulumi.set(__self__, "match", match)
        if network_match is not None:
            pulumi.set(__self__, "network_match", network_match)
        if preview is not None:
            pulumi.set(__self__, "preview", preview)
        if priority is not None:
            pulumi.set(__self__, "priority", priority)
        if project is not None:
            pulumi.set(__self__, "project", project)
        if region is not None:
            pulumi.set(__self__, "region", region)
        if security_policy is not None:
            pulumi.set(__self__, "security_policy", security_policy)

    @property
    @pulumi.getter
    def action(self) -> Optional[pulumi.Input[str]]:
        """
        The Action to perform when the rule is matched. The following are the valid actions:
        * allow: allow access to target.
        * deny(STATUS): deny access to target, returns the HTTP response code specified. Valid values for STATUS are 403, 404, and 502.
        * rate_based_ban: limit client traffic to the configured threshold and ban the client if the traffic exceeds the threshold. Configure parameters for this action in RateLimitOptions. Requires rateLimitOptions to be set.
        * redirect: redirect to a different target. This can either be an internal reCAPTCHA redirect, or an external URL-based redirect via a 302 response. Parameters for this action can be configured via redirectOptions. This action is only supported in Global Security Policies of type CLOUD_ARMOR.
        * throttle: limit client traffic to the configured threshold. Configure parameters for this action in rateLimitOptions. Requires rateLimitOptions to be set for this.
        """
        return pulumi.get(self, "action")

    @action.setter
    def action(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "action", value)

    @property
    @pulumi.getter
    def description(self) -> Optional[pulumi.Input[str]]:
        """
        An optional description of this resource. Provide this property when you create the resource.
        """
        return pulumi.get(self, "description")

    @description.setter
    def description(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "description", value)

    @property
    @pulumi.getter
    def match(self) -> Optional[pulumi.Input['RegionSecurityPolicyRuleMatchArgs']]:
        """
        A match condition that incoming traffic is evaluated against.
        If it evaluates to true, the corresponding 'action' is enforced.
        Structure is documented below.
        """
        return pulumi.get(self, "match")

    @match.setter
    def match(self, value: Optional[pulumi.Input['RegionSecurityPolicyRuleMatchArgs']]):
        pulumi.set(self, "match", value)

    @property
    @pulumi.getter(name="networkMatch")
    def network_match(self) -> Optional[pulumi.Input['RegionSecurityPolicyRuleNetworkMatchArgs']]:
        """
        A match condition that incoming packets are evaluated against for CLOUD_ARMOR_NETWORK security policies. If it matches, the corresponding 'action' is enforced.
        The match criteria for a rule consists of built-in match fields (like 'srcIpRanges') and potentially multiple user-defined match fields ('userDefinedFields').
        Field values may be extracted directly from the packet or derived from it (e.g. 'srcRegionCodes'). Some fields may not be present in every packet (e.g. 'srcPorts'). A user-defined field is only present if the base header is found in the packet and the entire field is in bounds.
        Each match field may specify which values can match it, listing one or more ranges, prefixes, or exact values that are considered a match for the field. A field value must be present in order to match a specified match field. If no match values are specified for a match field, then any field value is considered to match it, and it's not required to be present. For strings specifying '*' is also equivalent to match all.
        For a packet to match a rule, all specified match fields must match the corresponding field values derived from the packet.
        Example:
        networkMatch: srcIpRanges: - "192.0.2.0/24" - "198.51.100.0/24" userDefinedFields: - name: "ipv4_fragment_offset" values: - "1-0x1fff"
        The above match condition matches packets with a source IP in 192.0.2.0/24 or 198.51.100.0/24 and a user-defined field named "ipv4_fragment_offset" with a value between 1 and 0x1fff inclusive
        Structure is documented below.
        """
        return pulumi.get(self, "network_match")

    @network_match.setter
    def network_match(self, value: Optional[pulumi.Input['RegionSecurityPolicyRuleNetworkMatchArgs']]):
        pulumi.set(self, "network_match", value)

    @property
    @pulumi.getter
    def preview(self) -> Optional[pulumi.Input[bool]]:
        """
        If set to true, the specified action is not enforced.
        """
        return pulumi.get(self, "preview")

    @preview.setter
    def preview(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "preview", value)

    @property
    @pulumi.getter
    def priority(self) -> Optional[pulumi.Input[int]]:
        """
        An integer indicating the priority of a rule in the list.
        The priority must be a positive value between 0 and 2147483647.
        Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
        """
        return pulumi.get(self, "priority")

    @priority.setter
    def priority(self, value: Optional[pulumi.Input[int]]):
        pulumi.set(self, "priority", value)

    @property
    @pulumi.getter
    def project(self) -> Optional[pulumi.Input[str]]:
        """
        The ID of the project in which the resource belongs.
        If it is not provided, the provider project is used.
        """
        return pulumi.get(self, "project")

    @project.setter
    def project(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "project", value)

    @property
    @pulumi.getter
    def region(self) -> Optional[pulumi.Input[str]]:
        """
        The Region in which the created Region Security Policy rule should reside.
        """
        return pulumi.get(self, "region")

    @region.setter
    def region(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "region", value)

    @property
    @pulumi.getter(name="securityPolicy")
    def security_policy(self) -> Optional[pulumi.Input[str]]:
        """
        The name of the security policy this rule belongs to.


        - - -
        """
        return pulumi.get(self, "security_policy")

    @security_policy.setter
    def security_policy(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "security_policy", value)


class RegionSecurityPolicyRule(pulumi.CustomResource):
    @overload
    def __init__(__self__,
                 resource_name: str,
                 opts: Optional[pulumi.ResourceOptions] = None,
                 action: Optional[pulumi.Input[str]] = None,
                 description: Optional[pulumi.Input[str]] = None,
                 match: Optional[pulumi.Input[pulumi.InputType['RegionSecurityPolicyRuleMatchArgs']]] = None,
                 network_match: Optional[pulumi.Input[pulumi.InputType['RegionSecurityPolicyRuleNetworkMatchArgs']]] = None,
                 preview: Optional[pulumi.Input[bool]] = None,
                 priority: Optional[pulumi.Input[int]] = None,
                 project: Optional[pulumi.Input[str]] = None,
                 region: Optional[pulumi.Input[str]] = None,
                 security_policy: Optional[pulumi.Input[str]] = None,
                 __props__=None):
        """
        ## Example Usage
        ### Region Security Policy Rule Basic

        ```python
        import pulumi
        import pulumi_gcp as gcp

        default = gcp.compute.RegionSecurityPolicy("default",
            region="us-west2",
            description="basic region security policy",
            type="CLOUD_ARMOR",
            opts=pulumi.ResourceOptions(provider=google_beta))
        policy_rule = gcp.compute.RegionSecurityPolicyRule("policyRule",
            region="us-west2",
            security_policy=default.name,
            description="new rule",
            priority=100,
            match=gcp.compute.RegionSecurityPolicyRuleMatchArgs(
                versioned_expr="SRC_IPS_V1",
                config=gcp.compute.RegionSecurityPolicyRuleMatchConfigArgs(
                    src_ip_ranges=["10.10.0.0/16"],
                ),
            ),
            action="allow",
            preview=True,
            opts=pulumi.ResourceOptions(provider=google_beta))
        ```
        ### Region Security Policy Rule Multiple Rules

        ```python
        import pulumi
        import pulumi_gcp as gcp

        default = gcp.compute.RegionSecurityPolicy("default",
            region="us-west2",
            description="basic region security policy",
            type="CLOUD_ARMOR",
            opts=pulumi.ResourceOptions(provider=google_beta))
        policy_rule_one = gcp.compute.RegionSecurityPolicyRule("policyRuleOne",
            region="us-west2",
            security_policy=default.name,
            description="new rule one",
            priority=100,
            match=gcp.compute.RegionSecurityPolicyRuleMatchArgs(
                versioned_expr="SRC_IPS_V1",
                config=gcp.compute.RegionSecurityPolicyRuleMatchConfigArgs(
                    src_ip_ranges=["10.10.0.0/16"],
                ),
            ),
            action="allow",
            preview=True,
            opts=pulumi.ResourceOptions(provider=google_beta))
        policy_rule_two = gcp.compute.RegionSecurityPolicyRule("policyRuleTwo",
            region="us-west2",
            security_policy=default.name,
            description="new rule two",
            priority=101,
            match=gcp.compute.RegionSecurityPolicyRuleMatchArgs(
                versioned_expr="SRC_IPS_V1",
                config=gcp.compute.RegionSecurityPolicyRuleMatchConfigArgs(
                    src_ip_ranges=[
                        "192.168.0.0/16",
                        "10.0.0.0/8",
                    ],
                ),
            ),
            action="allow",
            preview=True,
            opts=pulumi.ResourceOptions(provider=google_beta))
        ```
        ### Region Security Policy Rule With Network Match

        ```python
        import pulumi
        import pulumi_gcp as gcp

        # First activate advanced network DDoS protection for the desired region
        policyddosprotection = gcp.compute.RegionSecurityPolicy("policyddosprotection",
            region="us-west2",
            description="policy for activating network DDoS protection for the desired region",
            type="CLOUD_ARMOR_NETWORK",
            ddos_protection_config=gcp.compute.RegionSecurityPolicyDdosProtectionConfigArgs(
                ddos_protection="ADVANCED_PREVIEW",
            ),
            opts=pulumi.ResourceOptions(provider=google_beta))
        edge_sec_service = gcp.compute.NetworkEdgeSecurityService("edgeSecService",
            region="us-west2",
            description="linking policy to edge security service",
            security_policy=policyddosprotection.self_link,
            opts=pulumi.ResourceOptions(provider=google_beta))
        # Add the desired policy and custom rule.
        policynetworkmatch = gcp.compute.RegionSecurityPolicy("policynetworkmatch",
            region="us-west2",
            description="region security policy for network match",
            type="CLOUD_ARMOR_NETWORK",
            user_defined_fields=[gcp.compute.RegionSecurityPolicyUserDefinedFieldArgs(
                name="SIG1_AT_0",
                base="TCP",
                offset=8,
                size=2,
                mask="0x8F00",
            )],
            opts=pulumi.ResourceOptions(provider=google_beta,
                depends_on=[edge_sec_service]))
        policy_rule_network_match = gcp.compute.RegionSecurityPolicyRule("policyRuleNetworkMatch",
            region="us-west2",
            security_policy=policynetworkmatch.name,
            description="custom rule for network match",
            priority=100,
            network_match=gcp.compute.RegionSecurityPolicyRuleNetworkMatchArgs(
                src_ip_ranges=["10.10.0.0/16"],
                user_defined_fields=[gcp.compute.RegionSecurityPolicyRuleNetworkMatchUserDefinedFieldArgs(
                    name="SIG1_AT_0",
                    values=["0x8F00"],
                )],
            ),
            action="allow",
            preview=True,
            opts=pulumi.ResourceOptions(provider=google_beta))
        ```

        ## Import

        RegionSecurityPolicyRule can be imported using any of these accepted formats

        ```sh
         $ pulumi import gcp:compute/regionSecurityPolicyRule:RegionSecurityPolicyRule default projects/{{project}}/regions/{{region}}/securityPolicies/{{security_policy}}/priority/{{priority}}
        ```

        ```sh
         $ pulumi import gcp:compute/regionSecurityPolicyRule:RegionSecurityPolicyRule default {{project}}/{{region}}/{{security_policy}}/{{priority}}
        ```

        ```sh
         $ pulumi import gcp:compute/regionSecurityPolicyRule:RegionSecurityPolicyRule default {{region}}/{{security_policy}}/{{priority}}
        ```

        ```sh
         $ pulumi import gcp:compute/regionSecurityPolicyRule:RegionSecurityPolicyRule default {{security_policy}}/{{priority}}
        ```

        :param str resource_name: The name of the resource.
        :param pulumi.ResourceOptions opts: Options for the resource.
        :param pulumi.Input[str] action: The Action to perform when the rule is matched. The following are the valid actions:
               * allow: allow access to target.
               * deny(STATUS): deny access to target, returns the HTTP response code specified. Valid values for STATUS are 403, 404, and 502.
               * rate_based_ban: limit client traffic to the configured threshold and ban the client if the traffic exceeds the threshold. Configure parameters for this action in RateLimitOptions. Requires rateLimitOptions to be set.
               * redirect: redirect to a different target. This can either be an internal reCAPTCHA redirect, or an external URL-based redirect via a 302 response. Parameters for this action can be configured via redirectOptions. This action is only supported in Global Security Policies of type CLOUD_ARMOR.
               * throttle: limit client traffic to the configured threshold. Configure parameters for this action in rateLimitOptions. Requires rateLimitOptions to be set for this.
        :param pulumi.Input[str] description: An optional description of this resource. Provide this property when you create the resource.
        :param pulumi.Input[pulumi.InputType['RegionSecurityPolicyRuleMatchArgs']] match: A match condition that incoming traffic is evaluated against.
               If it evaluates to true, the corresponding 'action' is enforced.
               Structure is documented below.
        :param pulumi.Input[pulumi.InputType['RegionSecurityPolicyRuleNetworkMatchArgs']] network_match: A match condition that incoming packets are evaluated against for CLOUD_ARMOR_NETWORK security policies. If it matches, the corresponding 'action' is enforced.
               The match criteria for a rule consists of built-in match fields (like 'srcIpRanges') and potentially multiple user-defined match fields ('userDefinedFields').
               Field values may be extracted directly from the packet or derived from it (e.g. 'srcRegionCodes'). Some fields may not be present in every packet (e.g. 'srcPorts'). A user-defined field is only present if the base header is found in the packet and the entire field is in bounds.
               Each match field may specify which values can match it, listing one or more ranges, prefixes, or exact values that are considered a match for the field. A field value must be present in order to match a specified match field. If no match values are specified for a match field, then any field value is considered to match it, and it's not required to be present. For strings specifying '*' is also equivalent to match all.
               For a packet to match a rule, all specified match fields must match the corresponding field values derived from the packet.
               Example:
               networkMatch: srcIpRanges: - "192.0.2.0/24" - "198.51.100.0/24" userDefinedFields: - name: "ipv4_fragment_offset" values: - "1-0x1fff"
               The above match condition matches packets with a source IP in 192.0.2.0/24 or 198.51.100.0/24 and a user-defined field named "ipv4_fragment_offset" with a value between 1 and 0x1fff inclusive
               Structure is documented below.
        :param pulumi.Input[bool] preview: If set to true, the specified action is not enforced.
        :param pulumi.Input[int] priority: An integer indicating the priority of a rule in the list.
               The priority must be a positive value between 0 and 2147483647.
               Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
        :param pulumi.Input[str] project: The ID of the project in which the resource belongs.
               If it is not provided, the provider project is used.
        :param pulumi.Input[str] region: The Region in which the created Region Security Policy rule should reside.
        :param pulumi.Input[str] security_policy: The name of the security policy this rule belongs to.
               
               
               - - -
        """
        ...
    @overload
    def __init__(__self__,
                 resource_name: str,
                 args: RegionSecurityPolicyRuleArgs,
                 opts: Optional[pulumi.ResourceOptions] = None):
        """
        ## Example Usage
        ### Region Security Policy Rule Basic

        ```python
        import pulumi
        import pulumi_gcp as gcp

        default = gcp.compute.RegionSecurityPolicy("default",
            region="us-west2",
            description="basic region security policy",
            type="CLOUD_ARMOR",
            opts=pulumi.ResourceOptions(provider=google_beta))
        policy_rule = gcp.compute.RegionSecurityPolicyRule("policyRule",
            region="us-west2",
            security_policy=default.name,
            description="new rule",
            priority=100,
            match=gcp.compute.RegionSecurityPolicyRuleMatchArgs(
                versioned_expr="SRC_IPS_V1",
                config=gcp.compute.RegionSecurityPolicyRuleMatchConfigArgs(
                    src_ip_ranges=["10.10.0.0/16"],
                ),
            ),
            action="allow",
            preview=True,
            opts=pulumi.ResourceOptions(provider=google_beta))
        ```
        ### Region Security Policy Rule Multiple Rules

        ```python
        import pulumi
        import pulumi_gcp as gcp

        default = gcp.compute.RegionSecurityPolicy("default",
            region="us-west2",
            description="basic region security policy",
            type="CLOUD_ARMOR",
            opts=pulumi.ResourceOptions(provider=google_beta))
        policy_rule_one = gcp.compute.RegionSecurityPolicyRule("policyRuleOne",
            region="us-west2",
            security_policy=default.name,
            description="new rule one",
            priority=100,
            match=gcp.compute.RegionSecurityPolicyRuleMatchArgs(
                versioned_expr="SRC_IPS_V1",
                config=gcp.compute.RegionSecurityPolicyRuleMatchConfigArgs(
                    src_ip_ranges=["10.10.0.0/16"],
                ),
            ),
            action="allow",
            preview=True,
            opts=pulumi.ResourceOptions(provider=google_beta))
        policy_rule_two = gcp.compute.RegionSecurityPolicyRule("policyRuleTwo",
            region="us-west2",
            security_policy=default.name,
            description="new rule two",
            priority=101,
            match=gcp.compute.RegionSecurityPolicyRuleMatchArgs(
                versioned_expr="SRC_IPS_V1",
                config=gcp.compute.RegionSecurityPolicyRuleMatchConfigArgs(
                    src_ip_ranges=[
                        "192.168.0.0/16",
                        "10.0.0.0/8",
                    ],
                ),
            ),
            action="allow",
            preview=True,
            opts=pulumi.ResourceOptions(provider=google_beta))
        ```
        ### Region Security Policy Rule With Network Match

        ```python
        import pulumi
        import pulumi_gcp as gcp

        # First activate advanced network DDoS protection for the desired region
        policyddosprotection = gcp.compute.RegionSecurityPolicy("policyddosprotection",
            region="us-west2",
            description="policy for activating network DDoS protection for the desired region",
            type="CLOUD_ARMOR_NETWORK",
            ddos_protection_config=gcp.compute.RegionSecurityPolicyDdosProtectionConfigArgs(
                ddos_protection="ADVANCED_PREVIEW",
            ),
            opts=pulumi.ResourceOptions(provider=google_beta))
        edge_sec_service = gcp.compute.NetworkEdgeSecurityService("edgeSecService",
            region="us-west2",
            description="linking policy to edge security service",
            security_policy=policyddosprotection.self_link,
            opts=pulumi.ResourceOptions(provider=google_beta))
        # Add the desired policy and custom rule.
        policynetworkmatch = gcp.compute.RegionSecurityPolicy("policynetworkmatch",
            region="us-west2",
            description="region security policy for network match",
            type="CLOUD_ARMOR_NETWORK",
            user_defined_fields=[gcp.compute.RegionSecurityPolicyUserDefinedFieldArgs(
                name="SIG1_AT_0",
                base="TCP",
                offset=8,
                size=2,
                mask="0x8F00",
            )],
            opts=pulumi.ResourceOptions(provider=google_beta,
                depends_on=[edge_sec_service]))
        policy_rule_network_match = gcp.compute.RegionSecurityPolicyRule("policyRuleNetworkMatch",
            region="us-west2",
            security_policy=policynetworkmatch.name,
            description="custom rule for network match",
            priority=100,
            network_match=gcp.compute.RegionSecurityPolicyRuleNetworkMatchArgs(
                src_ip_ranges=["10.10.0.0/16"],
                user_defined_fields=[gcp.compute.RegionSecurityPolicyRuleNetworkMatchUserDefinedFieldArgs(
                    name="SIG1_AT_0",
                    values=["0x8F00"],
                )],
            ),
            action="allow",
            preview=True,
            opts=pulumi.ResourceOptions(provider=google_beta))
        ```

        ## Import

        RegionSecurityPolicyRule can be imported using any of these accepted formats

        ```sh
         $ pulumi import gcp:compute/regionSecurityPolicyRule:RegionSecurityPolicyRule default projects/{{project}}/regions/{{region}}/securityPolicies/{{security_policy}}/priority/{{priority}}
        ```

        ```sh
         $ pulumi import gcp:compute/regionSecurityPolicyRule:RegionSecurityPolicyRule default {{project}}/{{region}}/{{security_policy}}/{{priority}}
        ```

        ```sh
         $ pulumi import gcp:compute/regionSecurityPolicyRule:RegionSecurityPolicyRule default {{region}}/{{security_policy}}/{{priority}}
        ```

        ```sh
         $ pulumi import gcp:compute/regionSecurityPolicyRule:RegionSecurityPolicyRule default {{security_policy}}/{{priority}}
        ```

        :param str resource_name: The name of the resource.
        :param RegionSecurityPolicyRuleArgs args: The arguments to use to populate this resource's properties.
        :param pulumi.ResourceOptions opts: Options for the resource.
        """
        ...
    def __init__(__self__, resource_name: str, *args, **kwargs):
        resource_args, opts = _utilities.get_resource_args_opts(RegionSecurityPolicyRuleArgs, pulumi.ResourceOptions, *args, **kwargs)
        if resource_args is not None:
            __self__._internal_init(resource_name, opts, **resource_args.__dict__)
        else:
            __self__._internal_init(resource_name, *args, **kwargs)

    def _internal_init(__self__,
                 resource_name: str,
                 opts: Optional[pulumi.ResourceOptions] = None,
                 action: Optional[pulumi.Input[str]] = None,
                 description: Optional[pulumi.Input[str]] = None,
                 match: Optional[pulumi.Input[pulumi.InputType['RegionSecurityPolicyRuleMatchArgs']]] = None,
                 network_match: Optional[pulumi.Input[pulumi.InputType['RegionSecurityPolicyRuleNetworkMatchArgs']]] = None,
                 preview: Optional[pulumi.Input[bool]] = None,
                 priority: Optional[pulumi.Input[int]] = None,
                 project: Optional[pulumi.Input[str]] = None,
                 region: Optional[pulumi.Input[str]] = None,
                 security_policy: Optional[pulumi.Input[str]] = None,
                 __props__=None):
        opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
        if not isinstance(opts, pulumi.ResourceOptions):
            raise TypeError('Expected resource options to be a ResourceOptions instance')
        if opts.id is None:
            if __props__ is not None:
                raise TypeError('__props__ is only valid when passed in combination with a valid opts.id to get an existing resource')
            __props__ = RegionSecurityPolicyRuleArgs.__new__(RegionSecurityPolicyRuleArgs)

            if action is None and not opts.urn:
                raise TypeError("Missing required property 'action'")
            __props__.__dict__["action"] = action
            __props__.__dict__["description"] = description
            __props__.__dict__["match"] = match
            __props__.__dict__["network_match"] = network_match
            __props__.__dict__["preview"] = preview
            if priority is None and not opts.urn:
                raise TypeError("Missing required property 'priority'")
            __props__.__dict__["priority"] = priority
            __props__.__dict__["project"] = project
            if region is None and not opts.urn:
                raise TypeError("Missing required property 'region'")
            __props__.__dict__["region"] = region
            if security_policy is None and not opts.urn:
                raise TypeError("Missing required property 'security_policy'")
            __props__.__dict__["security_policy"] = security_policy
        super(RegionSecurityPolicyRule, __self__).__init__(
            'gcp:compute/regionSecurityPolicyRule:RegionSecurityPolicyRule',
            resource_name,
            __props__,
            opts)

    @staticmethod
    def get(resource_name: str,
            id: pulumi.Input[str],
            opts: Optional[pulumi.ResourceOptions] = None,
            action: Optional[pulumi.Input[str]] = None,
            description: Optional[pulumi.Input[str]] = None,
            match: Optional[pulumi.Input[pulumi.InputType['RegionSecurityPolicyRuleMatchArgs']]] = None,
            network_match: Optional[pulumi.Input[pulumi.InputType['RegionSecurityPolicyRuleNetworkMatchArgs']]] = None,
            preview: Optional[pulumi.Input[bool]] = None,
            priority: Optional[pulumi.Input[int]] = None,
            project: Optional[pulumi.Input[str]] = None,
            region: Optional[pulumi.Input[str]] = None,
            security_policy: Optional[pulumi.Input[str]] = None) -> 'RegionSecurityPolicyRule':
        """
        Get an existing RegionSecurityPolicyRule resource's state with the given name, id, and optional extra
        properties used to qualify the lookup.

        :param str resource_name: The unique name of the resulting resource.
        :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
        :param pulumi.ResourceOptions opts: Options for the resource.
        :param pulumi.Input[str] action: The Action to perform when the rule is matched. The following are the valid actions:
               * allow: allow access to target.
               * deny(STATUS): deny access to target, returns the HTTP response code specified. Valid values for STATUS are 403, 404, and 502.
               * rate_based_ban: limit client traffic to the configured threshold and ban the client if the traffic exceeds the threshold. Configure parameters for this action in RateLimitOptions. Requires rateLimitOptions to be set.
               * redirect: redirect to a different target. This can either be an internal reCAPTCHA redirect, or an external URL-based redirect via a 302 response. Parameters for this action can be configured via redirectOptions. This action is only supported in Global Security Policies of type CLOUD_ARMOR.
               * throttle: limit client traffic to the configured threshold. Configure parameters for this action in rateLimitOptions. Requires rateLimitOptions to be set for this.
        :param pulumi.Input[str] description: An optional description of this resource. Provide this property when you create the resource.
        :param pulumi.Input[pulumi.InputType['RegionSecurityPolicyRuleMatchArgs']] match: A match condition that incoming traffic is evaluated against.
               If it evaluates to true, the corresponding 'action' is enforced.
               Structure is documented below.
        :param pulumi.Input[pulumi.InputType['RegionSecurityPolicyRuleNetworkMatchArgs']] network_match: A match condition that incoming packets are evaluated against for CLOUD_ARMOR_NETWORK security policies. If it matches, the corresponding 'action' is enforced.
               The match criteria for a rule consists of built-in match fields (like 'srcIpRanges') and potentially multiple user-defined match fields ('userDefinedFields').
               Field values may be extracted directly from the packet or derived from it (e.g. 'srcRegionCodes'). Some fields may not be present in every packet (e.g. 'srcPorts'). A user-defined field is only present if the base header is found in the packet and the entire field is in bounds.
               Each match field may specify which values can match it, listing one or more ranges, prefixes, or exact values that are considered a match for the field. A field value must be present in order to match a specified match field. If no match values are specified for a match field, then any field value is considered to match it, and it's not required to be present. For strings specifying '*' is also equivalent to match all.
               For a packet to match a rule, all specified match fields must match the corresponding field values derived from the packet.
               Example:
               networkMatch: srcIpRanges: - "192.0.2.0/24" - "198.51.100.0/24" userDefinedFields: - name: "ipv4_fragment_offset" values: - "1-0x1fff"
               The above match condition matches packets with a source IP in 192.0.2.0/24 or 198.51.100.0/24 and a user-defined field named "ipv4_fragment_offset" with a value between 1 and 0x1fff inclusive
               Structure is documented below.
        :param pulumi.Input[bool] preview: If set to true, the specified action is not enforced.
        :param pulumi.Input[int] priority: An integer indicating the priority of a rule in the list.
               The priority must be a positive value between 0 and 2147483647.
               Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
        :param pulumi.Input[str] project: The ID of the project in which the resource belongs.
               If it is not provided, the provider project is used.
        :param pulumi.Input[str] region: The Region in which the created Region Security Policy rule should reside.
        :param pulumi.Input[str] security_policy: The name of the security policy this rule belongs to.
               
               
               - - -
        """
        opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))

        __props__ = _RegionSecurityPolicyRuleState.__new__(_RegionSecurityPolicyRuleState)

        __props__.__dict__["action"] = action
        __props__.__dict__["description"] = description
        __props__.__dict__["match"] = match
        __props__.__dict__["network_match"] = network_match
        __props__.__dict__["preview"] = preview
        __props__.__dict__["priority"] = priority
        __props__.__dict__["project"] = project
        __props__.__dict__["region"] = region
        __props__.__dict__["security_policy"] = security_policy
        return RegionSecurityPolicyRule(resource_name, opts=opts, __props__=__props__)

    @property
    @pulumi.getter
    def action(self) -> pulumi.Output[str]:
        """
        The Action to perform when the rule is matched. The following are the valid actions:
        * allow: allow access to target.
        * deny(STATUS): deny access to target, returns the HTTP response code specified. Valid values for STATUS are 403, 404, and 502.
        * rate_based_ban: limit client traffic to the configured threshold and ban the client if the traffic exceeds the threshold. Configure parameters for this action in RateLimitOptions. Requires rateLimitOptions to be set.
        * redirect: redirect to a different target. This can either be an internal reCAPTCHA redirect, or an external URL-based redirect via a 302 response. Parameters for this action can be configured via redirectOptions. This action is only supported in Global Security Policies of type CLOUD_ARMOR.
        * throttle: limit client traffic to the configured threshold. Configure parameters for this action in rateLimitOptions. Requires rateLimitOptions to be set for this.
        """
        return pulumi.get(self, "action")

    @property
    @pulumi.getter
    def description(self) -> pulumi.Output[Optional[str]]:
        """
        An optional description of this resource. Provide this property when you create the resource.
        """
        return pulumi.get(self, "description")

    @property
    @pulumi.getter
    def match(self) -> pulumi.Output[Optional['outputs.RegionSecurityPolicyRuleMatch']]:
        """
        A match condition that incoming traffic is evaluated against.
        If it evaluates to true, the corresponding 'action' is enforced.
        Structure is documented below.
        """
        return pulumi.get(self, "match")

    @property
    @pulumi.getter(name="networkMatch")
    def network_match(self) -> pulumi.Output[Optional['outputs.RegionSecurityPolicyRuleNetworkMatch']]:
        """
        A match condition that incoming packets are evaluated against for CLOUD_ARMOR_NETWORK security policies. If it matches, the corresponding 'action' is enforced.
        The match criteria for a rule consists of built-in match fields (like 'srcIpRanges') and potentially multiple user-defined match fields ('userDefinedFields').
        Field values may be extracted directly from the packet or derived from it (e.g. 'srcRegionCodes'). Some fields may not be present in every packet (e.g. 'srcPorts'). A user-defined field is only present if the base header is found in the packet and the entire field is in bounds.
        Each match field may specify which values can match it, listing one or more ranges, prefixes, or exact values that are considered a match for the field. A field value must be present in order to match a specified match field. If no match values are specified for a match field, then any field value is considered to match it, and it's not required to be present. For strings specifying '*' is also equivalent to match all.
        For a packet to match a rule, all specified match fields must match the corresponding field values derived from the packet.
        Example:
        networkMatch: srcIpRanges: - "192.0.2.0/24" - "198.51.100.0/24" userDefinedFields: - name: "ipv4_fragment_offset" values: - "1-0x1fff"
        The above match condition matches packets with a source IP in 192.0.2.0/24 or 198.51.100.0/24 and a user-defined field named "ipv4_fragment_offset" with a value between 1 and 0x1fff inclusive
        Structure is documented below.
        """
        return pulumi.get(self, "network_match")

    @property
    @pulumi.getter
    def preview(self) -> pulumi.Output[Optional[bool]]:
        """
        If set to true, the specified action is not enforced.
        """
        return pulumi.get(self, "preview")

    @property
    @pulumi.getter
    def priority(self) -> pulumi.Output[int]:
        """
        An integer indicating the priority of a rule in the list.
        The priority must be a positive value between 0 and 2147483647.
        Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
        """
        return pulumi.get(self, "priority")

    @property
    @pulumi.getter
    def project(self) -> pulumi.Output[str]:
        """
        The ID of the project in which the resource belongs.
        If it is not provided, the provider project is used.
        """
        return pulumi.get(self, "project")

    @property
    @pulumi.getter
    def region(self) -> pulumi.Output[str]:
        """
        The Region in which the created Region Security Policy rule should reside.
        """
        return pulumi.get(self, "region")

    @property
    @pulumi.getter(name="securityPolicy")
    def security_policy(self) -> pulumi.Output[str]:
        """
        The name of the security policy this rule belongs to.


        - - -
        """
        return pulumi.get(self, "security_policy")

