Gcp/networksecurity

@swamp/gcp/networksecurityv2026.07.21.4· 6d agoMODELS

01README

Google Cloud networksecurity infrastructure models

02Release Notes

Added: sacattachments, sacrealms
Updated: locations, addressgroups, authzpolicies, mirroringendpointgroupassociations

03Models26

@swamp/gcp/networksecurity/addressgroupsv2026.07.21.3addressgroups.ts

Global Arguments

Argument	Type	Required	Description
accessToken?	string	no	GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
credentialsJson?	string	no	GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault.
project?	string	no	GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables.
scopes?	string	no	Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes.
capacity?	number	no	Required. Capacity of the Address Group
description?	string	no	Optional. Free-text description of the resource.
items?	array	no	Optional. List of items.
labels?	record	no	Optional. Set of label tags associated with the AddressGroup resource.
name?	string	no	Required. Name of the AddressGroup resource. It matches pattern `projects/*/locations/{location}/addressGroups/`.
purpose?	array	no	Optional. List of supported purposes of the Address Group.
type?	enum	no	Required. The type of the Address Group. Possible values are "IPv4" or "IPV6".
addressGroupId?	string	no	Required. Short name of the AddressGroup resource to be created. This value should be 1-63 characters long, containing only letters, numbers, hyphens, and underscores, and should not start with a number. E.g. "authz_policy".
requestId?	string	no	Optional. An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. The server will guarantee that for at least 60 minutes since the first request. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID w
parent?	string	no	The parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)

fn create()

Create a addressGroups

fn get(identifier: string)

Get a addressGroups

Argument	Type	Required	Description
identifier	string	yes	The name of the addressGroups

fn update(identifier?: string)

Update addressGroups attributes

Argument	Type	Required	Description
identifier?	string	no	Target a specific addressGroups by name (e.g. one discovered by list)

fn delete(identifier: string)

Delete the addressGroups

Argument	Type	Required	Description
identifier	string	yes	The name of the addressGroups

fn sync(identifier?: string)

Sync addressGroups state from GCP

Argument	Type	Required	Description
identifier?	string	no	Target a specific addressGroups by name (e.g. one discovered by list)

fn list(pageSize?: number, returnPartialSuccess?: boolean, maxPages?: number)

List addressGroups resources

Argument	Type	Required	Description
pageSize?	number	no	Maximum number of AddressGroups to return per call.
returnPartialSuccess?	boolean	no	Optional. If true, allow partial responses for multi-regional Aggregated List requests.
maxPages?	number	no	Maximum number of pages to fetch (default: 10)

fn add_items(items?: any, requestId?: any)

add items

Argument	Type	Required	Description
items?	any	no
requestId?	any	no

fn clone_items(requestId?: any, sourceAddressGroup?: any)

clone items

Argument	Type	Required	Description
requestId?	any	no
sourceAddressGroup?	any	no

fn list_references()

list references

fn test_iam_permissions(permissions?: any)

test iam permissions

Argument	Type	Required	Description
permissions?	any	no

Resources

state(infinite)— AddressGroup is a resource that specifies how a collection of IP/DNS used in ...

@swamp/gcp/networksecurity/authorizationpoliciesv2026.07.21.3authorizationpolicies.ts

Global Arguments

Argument	Type	Required	Description
accessToken?	string	no	GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
credentialsJson?	string	no	GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault.
project?	string	no	GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables.
scopes?	string	no	Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes.
action?	enum	no	Required. The action to take when a rule match is found. Possible values are "ALLOW" or "DENY".
description?	string	no	Optional. Free-text description of the resource.
labels?	record	no	Optional. Set of label tags associated with the AuthorizationPolicy resource.
name?	string	no	Required. Name of the AuthorizationPolicy resource. It matches pattern `projects/{project}/locations/{location}/authorizationPolicies/`.
rules?	array	no	Optional. List of rules to match. Note that at least one of the rules must match in order for the action specified in the 'action' field to be taken. A rule is a match if there is a matching source and destination. If left blank, the action specified in the `action` field will be applied on every request.
authorizationPolicyId?	string	no	Required. Short name of the AuthorizationPolicy resource to be created. This value should be 1-63 characters long, containing only letters, numbers, hyphens, and underscores, and should not start with a number. E.g. "authz_policy".
location?	string	no	The location for this resource (e.g., 'us', 'us-central1', 'europe-west1')

fn create()

Create a authorizationPolicies

fn get(identifier: string)

Get a authorizationPolicies

Argument	Type	Required	Description
identifier	string	yes	The name of the authorizationPolicies

fn update(identifier?: string)

Update authorizationPolicies attributes

Argument	Type	Required	Description
identifier?	string	no	Target a specific authorizationPolicies by name (e.g. one discovered by list)

fn delete(identifier: string)

Delete the authorizationPolicies

Argument	Type	Required	Description
identifier	string	yes	The name of the authorizationPolicies

fn sync(identifier?: string)

Sync authorizationPolicies state from GCP

Argument	Type	Required	Description
identifier?	string	no	Target a specific authorizationPolicies by name (e.g. one discovered by list)

fn list(pageSize?: number, maxPages?: number)

List authorizationPolicies resources

Argument	Type	Required	Description
pageSize?	number	no	Maximum number of AuthorizationPolicies to return per call.
maxPages?	number	no	Maximum number of pages to fetch (default: 10)

fn get_iam_policy()

get iam policy

fn set_iam_policy(policy?: any, updateMask?: any)

set iam policy

Argument	Type	Required	Description
policy?	any	no
updateMask?	any	no

fn test_iam_permissions(permissions?: any)

test iam permissions

Argument	Type	Required	Description
permissions?	any	no

Resources

state(infinite)— AuthorizationPolicy is a resource that specifies how a server should authoriz...

@swamp/gcp/networksecurity/authzpoliciesv2026.07.21.4authzpolicies.ts

Global Arguments

Argument	Type	Required	Description
accessToken?	string	no	GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
credentialsJson?	string	no	GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault.
project?	string	no	GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables.
scopes?	string	no	Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes.
action?	enum	no	Required. Can be one of `ALLOW`, `DENY`, `CUSTOM`. When the action is `CUSTOM`, `customProvider` must be specified. When the action is `ALLOW`, only requests matching the policy will be allowed. When the action is `DENY`, only requests matching the policy will be denied. When a request arrives, the policies are evaluated in the following order: 1. If there is a `CUSTOM` policy that matches the request, the `CUSTOM` policy is evaluated using the custom authorization providers and the request is d
customProvider?	object	no	Optional. Required if the action is `CUSTOM`. Allows delegating authorization decisions to Cloud IAP or to Service Extensions. One of `cloudIap` or `authzExtension` must be specified.
description?	string	no	Optional. A human-readable description of the resource.
httpRules?	array	no	Optional. A list of authorization HTTP rules to match against the incoming request. A policy match occurs when at least one HTTP rule matches the request or when no HTTP rules are specified in the policy. At least one HTTP Rule is required for Allow or Deny Action. Limited to 5 rules.
labels?	record	no	Optional. Set of labels associated with the `AuthzPolicy` resource. The format must comply with [the following requirements](/compute/docs/labeling-resources#requirements).
name?	string	no	Required. Identifier. Name of the `AuthzPolicy` resource in the following format: `projects/{project}/locations/{location}/authzPolicies/{authz_policy}`.
networkRules?	array	no	Optional. A list of authorization network rules to match against the incoming request. A policy match occurs when at least one network rule matches the request. At least one network rule is required for Allow or Deny Action if no HTTP rules are provided. Network rules are mutually exclusive with HTTP rules. Limited to 5 rules.
policyProfile?	enum	no	Optional. Immutable. Defines the type of authorization being performed. If not specified, `REQUEST_AUTHZ` is applied. This field cannot be changed once AuthzPolicy is created.
target?	object	no	Required. Specifies the set of resources to which this policy should be applied to.
authzPolicyId?	string	no	Required. User-provided ID of the `AuthzPolicy` resource to be created.
requestId?	string	no	Optional. An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server can ignore the request if it has already been completed. The server guarantees that for at least 60 minutes since the first request. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received,
location?	string	no	The location for this resource (e.g., 'us', 'us-central1', 'europe-west1')

fn create()

Create a authzPolicies

fn get(identifier: string)

Get a authzPolicies

Argument	Type	Required	Description
identifier	string	yes	The name of the authzPolicies

fn update(identifier?: string)

Update authzPolicies attributes

Argument	Type	Required	Description
identifier?	string	no	Target a specific authzPolicies by name (e.g. one discovered by list)

fn delete(identifier: string)

Delete the authzPolicies

Argument	Type	Required	Description
identifier	string	yes	The name of the authzPolicies

fn sync(identifier?: string)

Sync authzPolicies state from GCP

Argument	Type	Required	Description
identifier?	string	no	Target a specific authzPolicies by name (e.g. one discovered by list)

fn list(filter?: string, orderBy?: string, pageSize?: number, maxPages?: number)

List authzPolicies resources

Argument	Type	Required	Description
filter?	string	no	Optional. Filtering results.
orderBy?	string	no	Optional. Hint for how to order the results.
pageSize?	number	no	Optional. Requested page size. The server might return fewer items than requested. If unspecified, the server picks an appropriate default.
maxPages?	number	no	Maximum number of pages to fetch (default: 10)

fn get_iam_policy()

get iam policy

fn set_iam_policy(policy?: any, updateMask?: any)

set iam policy

Argument	Type	Required	Description
policy?	any	no
updateMask?	any	no

fn test_iam_permissions(permissions?: any)

test iam permissions

Argument	Type	Required	Description
permissions?	any	no

Resources

state(infinite)— `AuthzPolicy` is a resource that allows to forward traffic to a callout backe...

@swamp/gcp/networksecurity/backendauthenticationconfigsv2026.07.21.2backendauthenticationconfigs.ts

Global Arguments

Argument	Type	Required	Description
accessToken?	string	no	GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
credentialsJson?	string	no	GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault.
project?	string	no	GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables.
scopes?	string	no	Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes.
clientCertificate?	string	no	Optional. A reference to a certificatemanager.googleapis.com.Certificate resource. This is a relative resource path following the form "projects/{project}/locations/{location}/certificates/{certificate}". Used by a BackendService to negotiate mTLS when the backend connection uses TLS and the backend requests a client certificate. Must have a CLIENT_AUTH scope.
description?	string	no	Optional. Free-text description of the resource.
labels?	record	no	Set of label tags associated with the resource.
name?	string	no	Required. Name of the BackendAuthenticationConfig resource. It matches the pattern `projects/*/locations/{location}/backendAuthenticationConfigs/{backend_authentication_config}`
trustConfig?	string	no	Optional. A reference to a TrustConfig resource from the certificatemanager.googleapis.com namespace. This is a relative resource path following the form "projects/{project}/locations/{location}/trustConfigs/{trust_config}". A BackendService uses the chain of trust represented by this TrustConfig, if specified, to validate the server certificates presented by the backend. Required unless wellKnownRoots is set to PUBLIC_ROOTS.
wellKnownRoots?	enum	no	Well known roots to use for server certificate validation.
backendAuthenticationConfigId?	string	no	Required. Short name of the BackendAuthenticationConfig resource to be created. This value should be 1-63 characters long, containing only letters, numbers, hyphens, and underscores, and should not start with a number. E.g. "backend-auth-config".
location?	string	no	The location for this resource (e.g., 'us', 'us-central1', 'europe-west1')

fn create()

Create a backendAuthenticationConfigs

fn get(identifier: string)

Get a backendAuthenticationConfigs

Argument	Type	Required	Description
identifier	string	yes	The name of the backendAuthenticationConfigs

fn update(identifier?: string)

Update backendAuthenticationConfigs attributes

Argument	Type	Required	Description
identifier?	string	no	Target a specific backendAuthenticationConfigs by name (e.g. one discovered by list)

fn delete(identifier: string)

Delete the backendAuthenticationConfigs

Argument	Type	Required	Description
identifier	string	yes	The name of the backendAuthenticationConfigs

fn sync(identifier?: string)

Sync backendAuthenticationConfigs state from GCP

Argument	Type	Required	Description
identifier?	string	no	Target a specific backendAuthenticationConfigs by name (e.g. one discovered by list)

fn list(pageSize?: number, maxPages?: number)

List backendAuthenticationConfigs resources

Argument	Type	Required	Description
pageSize?	number	no	Maximum number of BackendAuthenticationConfigs to return per call.
maxPages?	number	no	Maximum number of pages to fetch (default: 10)

Resources

state(infinite)— BackendAuthenticationConfig message groups the TrustConfig together with othe...

@swamp/gcp/networksecurity/clienttlspoliciesv2026.07.21.3clienttlspolicies.ts

Global Arguments

Argument	Type	Required	Description
accessToken?	string	no	GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
credentialsJson?	string	no	GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault.
project?	string	no	GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables.
scopes?	string	no	Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes.
clientCertificate?	object	no	Optional. Defines a mechanism to provision client identity (public and private keys) for peer to peer authentication. The presence of this dictates mTLS.
description?	string	no	Optional. Free-text description of the resource.
labels?	record	no	Optional. Set of label tags associated with the resource.
name?	string	no	Required. Name of the ClientTlsPolicy resource. It matches the pattern `projects/{project}/locations/{location}/clientTlsPolicies/{client_tls_policy}`
serverValidationCa?	array	no	Optional. Defines the mechanism to obtain the Certificate Authority certificate to validate the server certificate. If empty, client does not validate the server certificate.
sni?	string	no	Optional. Server Name Indication string to present to the server during TLS handshake. E.g: "secure.example.com".
clientTlsPolicyId?	string	no	Required. Short name of the ClientTlsPolicy resource to be created. This value should be 1-63 characters long, containing only letters, numbers, hyphens, and underscores, and should not start with a number. E.g. "client_mtls_policy".
location?	string	no	The location for this resource (e.g., 'us', 'us-central1', 'europe-west1')

fn create()

Create a clientTlsPolicies

fn get(identifier: string)

Get a clientTlsPolicies

Argument	Type	Required	Description
identifier	string	yes	The name of the clientTlsPolicies

fn update(identifier?: string)

Update clientTlsPolicies attributes

Argument	Type	Required	Description
identifier?	string	no	Target a specific clientTlsPolicies by name (e.g. one discovered by list)

fn delete(identifier: string)

Delete the clientTlsPolicies

Argument	Type	Required	Description
identifier	string	yes	The name of the clientTlsPolicies

fn sync(identifier?: string)

Sync clientTlsPolicies state from GCP

Argument	Type	Required	Description
identifier?	string	no	Target a specific clientTlsPolicies by name (e.g. one discovered by list)

fn list(pageSize?: number, maxPages?: number)

List clientTlsPolicies resources

Argument	Type	Required	Description
pageSize?	number	no	Maximum number of ClientTlsPolicies to return per call.
maxPages?	number	no	Maximum number of pages to fetch (default: 10)

fn get_iam_policy()

get iam policy

fn set_iam_policy(policy?: any, updateMask?: any)

set iam policy

Argument	Type	Required	Description
policy?	any	no
updateMask?	any	no

fn test_iam_permissions(permissions?: any)

test iam permissions

Argument	Type	Required	Description
permissions?	any	no

Resources

state(infinite)— ClientTlsPolicy is a resource that specifies how a client should authenticate...

@swamp/gcp/networksecurity/dnsthreatdetectorsv2026.07.21.2dnsthreatdetectors.ts

Global Arguments

Argument	Type	Required	Description
accessToken?	string	no	GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
credentialsJson?	string	no	GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault.
project?	string	no	GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables.
scopes?	string	no	Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes.
excludedNetworks?	array	no	Optional. A list of network resource names which aren't monitored by this DnsThreatDetector. Example: `projects/PROJECT_ID/global/networks/NETWORK_NAME`.
labels?	record	no	Optional. Any labels associated with the DnsThreatDetector, listed as key value pairs.
name?	string	no	Immutable. Identifier. Name of the DnsThreatDetector resource.
provider?	enum	no	Required. The provider used for DNS threat analysis.
dnsThreatDetectorId?	string	no	Optional. The ID of the requesting DnsThreatDetector object. If this field is not supplied, the service generates an identifier.
location?	string	no	The location for this resource (e.g., 'us', 'us-central1', 'europe-west1')

fn create()

Create a dnsThreatDetectors

fn get(identifier: string)

Get a dnsThreatDetectors

Argument	Type	Required	Description
identifier	string	yes	The name of the dnsThreatDetectors

fn update(identifier?: string)

Update dnsThreatDetectors attributes

Argument	Type	Required	Description
identifier?	string	no	Target a specific dnsThreatDetectors by name (e.g. one discovered by list)

fn delete(identifier: string)

Delete the dnsThreatDetectors

Argument	Type	Required	Description
identifier	string	yes	The name of the dnsThreatDetectors

fn sync(identifier?: string)

Sync dnsThreatDetectors state from GCP

Argument	Type	Required	Description
identifier?	string	no	Target a specific dnsThreatDetectors by name (e.g. one discovered by list)

fn list(pageSize?: number, maxPages?: number)

List dnsThreatDetectors resources

Argument	Type	Required	Description
pageSize?	number	no	Optional. The requested page size. The server may return fewer items than requested. If unspecified, the server picks an appropriate default.
maxPages?	number	no	Maximum number of pages to fetch (default: 10)

Resources

state(infinite)— A DNS threat detector sends DNS query logs to a _provider_ that then analyzes...

@swamp/gcp/networksecurity/firewallendpointassociationsv2026.07.21.2firewallendpointassociations.ts

Global Arguments

Argument	Type	Required	Description
accessToken?	string	no	GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
credentialsJson?	string	no	GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault.
project?	string	no	GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables.
scopes?	string	no	Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes.
disabled?	boolean	no	Optional. Whether the association is disabled. True indicates that traffic won't be intercepted
firewallEndpoint?	string	no	Required. The URL of the FirewallEndpoint that is being associated.
labels?	record	no	Optional. Labels as key value pairs
name?	string	no	Immutable. Identifier. name of resource
network?	string	no	Required. The URL of the network that is being associated.
tlsInspectionPolicy?	string	no	Optional. The URL of the TlsInspectionPolicy that is being associated.
firewallEndpointAssociationId?	string	no	Optional. Id of the requesting object. If auto-generating Id server-side, remove this field and firewall_endpoint_association_id from the method_signature of Create RPC.
requestId?	string	no	Optional. An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. The server will guarantee that for at least 60 minutes since the first request. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID w
location?	string	no	The location for this resource (e.g., 'us', 'us-central1', 'europe-west1')

fn create(waitForReady?: boolean)

Create a firewallEndpointAssociations

Argument	Type	Required	Description
waitForReady?	boolean	no	Wait for the resource to reach a ready state after creation (default: true)

fn get(identifier: string)

Get a firewallEndpointAssociations

Argument	Type	Required	Description
identifier	string	yes	The name of the firewallEndpointAssociations

fn update(identifier?: string, waitForReady?: boolean)

Update firewallEndpointAssociations attributes

Argument	Type	Required	Description
identifier?	string	no	Target a specific firewallEndpointAssociations by name (e.g. one discovered by list)
waitForReady?	boolean	no	Wait for the resource to reach a ready state after update (default: true)

fn delete(identifier: string)

Delete the firewallEndpointAssociations

Argument	Type	Required	Description
identifier	string	yes	The name of the firewallEndpointAssociations

fn sync(identifier?: string)

Sync firewallEndpointAssociations state from GCP

Argument	Type	Required	Description
identifier?	string	no	Target a specific firewallEndpointAssociations by name (e.g. one discovered by list)

fn list(filter?: string, orderBy?: string, pageSize?: number, maxPages?: number)

List firewallEndpointAssociations resources

Argument	Type	Required	Description
filter?	string	no	Optional. Filtering results
orderBy?	string	no	Hint for how to order the results
pageSize?	number	no	Optional. Requested page size. Server may return fewer items than requested. If unspecified, server will pick an appropriate default.
maxPages?	number	no	Maximum number of pages to fetch (default: 10)

Resources

state(infinite)— Message describing Association object

@swamp/gcp/networksecurity/firewallendpointsv2026.07.21.3firewallendpoints.ts

Global Arguments

Argument	Type	Required	Description
accessToken?	string	no	GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
credentialsJson?	string	no	GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault.
project?	string	no	GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables.
scopes?	string	no	Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes.
billingProjectId?	string	no	Optional. Project to charge for the deployed firewall endpoint. This field must be specified when creating the endpoint in the organization scope, and should be omitted otherwise.
description?	string	no	Optional. Description of the firewall endpoint. Max length 2048 characters.
endpointSettings?	object	no	Optional. Settings for the endpoint.
labels?	record	no	Optional. Labels as key value pairs
name?	string	no	Immutable. Identifier. Name of resource.
firewallEndpointId?	string	no	Required. Id of the requesting object. If auto-generating Id server-side, remove this field and firewall_endpoint_id from the method_signature of Create RPC.
requestId?	string	no	Optional. An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. The server will guarantee that for at least 60 minutes since the first request. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID w
parent?	string	no	The parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)

fn create(waitForReady?: boolean)

Create a firewallEndpoints

Argument	Type	Required	Description
waitForReady?	boolean	no	Wait for the resource to reach a ready state after creation (default: true)

fn get(identifier: string)

Get a firewallEndpoints

Argument	Type	Required	Description
identifier	string	yes	The name of the firewallEndpoints

fn update(identifier?: string, waitForReady?: boolean)

Update firewallEndpoints attributes

Argument	Type	Required	Description
identifier?	string	no	Target a specific firewallEndpoints by name (e.g. one discovered by list)
waitForReady?	boolean	no	Wait for the resource to reach a ready state after update (default: true)

fn delete(identifier: string)

Delete the firewallEndpoints

Argument	Type	Required	Description
identifier	string	yes	The name of the firewallEndpoints

fn sync(identifier?: string)

Sync firewallEndpoints state from GCP

Argument	Type	Required	Description
identifier?	string	no	Target a specific firewallEndpoints by name (e.g. one discovered by list)

fn list(filter?: string, orderBy?: string, pageSize?: number, maxPages?: number)

List firewallEndpoints resources

Argument	Type	Required	Description
filter?	string	no	Optional. Filtering results
orderBy?	string	no	Hint for how to order the results
pageSize?	number	no	Optional. Requested page size. Server may return fewer items than requested. If unspecified, server will pick an appropriate default.
maxPages?	number	no	Maximum number of pages to fetch (default: 10)

Resources

state(infinite)— Message describing Endpoint object.

@swamp/gcp/networksecurity/gatewaysecuritypoliciesv2026.07.21.2gatewaysecuritypolicies.ts

Global Arguments

Argument	Type	Required	Description
accessToken?	string	no	GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
credentialsJson?	string	no	GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault.
project?	string	no	GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables.
scopes?	string	no	Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes.
description?	string	no	Optional. Free-text description of the resource.
name?	string	no	Required. Name of the resource. Name is of the form projects/{project}/locations/{location}/gatewaySecurityPolicies/{gateway_security_policy} gateway_security_policy should match the pattern:(^[a-z]([a-z0-9-]{0,61}[a-z0-9])?$).
tlsInspectionPolicy?	string	no	Optional. Name of a TLS Inspection Policy resource that defines how TLS inspection will be performed for any rule(s) which enables it.
gatewaySecurityPolicyId?	string	no	Required. Short name of the GatewaySecurityPolicy resource to be created. This value should be 1-63 characters long, containing only letters, numbers, hyphens, and underscores, and should not start with a number. E.g. "gateway_security_policy1".
location?	string	no	The location for this resource (e.g., 'us', 'us-central1', 'europe-west1')

fn create()

Create a gatewaySecurityPolicies

fn get(identifier: string)

Get a gatewaySecurityPolicies

Argument	Type	Required	Description
identifier	string	yes	The name of the gatewaySecurityPolicies

fn update(identifier?: string)

Update gatewaySecurityPolicies attributes

Argument	Type	Required	Description
identifier?	string	no	Target a specific gatewaySecurityPolicies by name (e.g. one discovered by list)

fn delete(identifier: string)

Delete the gatewaySecurityPolicies

Argument	Type	Required	Description
identifier	string	yes	The name of the gatewaySecurityPolicies

fn sync(identifier?: string)

Sync gatewaySecurityPolicies state from GCP

Argument	Type	Required	Description
identifier?	string	no	Target a specific gatewaySecurityPolicies by name (e.g. one discovered by list)

fn list(pageSize?: number, maxPages?: number)

List gatewaySecurityPolicies resources

Argument	Type	Required	Description
pageSize?	number	no	Maximum number of GatewaySecurityPolicies to return per call.
maxPages?	number	no	Maximum number of pages to fetch (default: 10)

Resources

state(infinite)— The GatewaySecurityPolicy resource contains a collection of GatewaySecurityPo...

@swamp/gcp/networksecurity/gatewaysecuritypolicies-rulesv2026.07.21.2gatewaysecuritypolicies_rules.ts

Global Arguments

Argument	Type	Required	Description
accessToken?	string	no	GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
credentialsJson?	string	no	GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault.
project?	string	no	GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables.
scopes?	string	no	Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes.
applicationMatcher?	string	no	Optional. CEL expression for matching on L7/application level criteria.
basicProfile?	enum	no	Required. Profile which tells what the primitive action should be.
description?	string	no	Optional. Free-text description of the resource.
enabled?	boolean	no	Required. Whether the rule is enforced.
name?	string	no	Required. Immutable. Name of the resource. ame is the full resource name so projects/{project}/locations/{location}/gatewaySecurityPolicies/{gateway_security_policy}/rules/{rule} rule should match the pattern: (^[a-z]([a-z0-9-]{0,61}[a-z0-9])?$).
priority?	number	no	Required. Priority of the rule. Lower number corresponds to higher precedence.
sessionMatcher?	string	no	Required. CEL expression for matching on session criteria.
tlsInspectionEnabled?	boolean	no	Optional. Flag to enable TLS inspection of traffic matching on, can only be true if the parent GatewaySecurityPolicy references a TLSInspectionConfig.
gatewaySecurityPolicyRuleId?	string	no	The ID to use for the rule, which will become the final component of the rule's resource name. This value should be 4-63 characters, and valid characters are /a-z-/.
parent?	string	no	The parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
location?	string	no	The location for this resource (e.g., 'us', 'us-central1', 'europe-west1')

fn create()

Create a rules

fn get(identifier: string)

Get a rules

Argument	Type	Required	Description
identifier	string	yes	The name of the rules

fn update(identifier?: string)

Update rules attributes

Argument	Type	Required	Description
identifier?	string	no	Target a specific rules by name (e.g. one discovered by list)

fn delete(identifier: string)

Delete the rules

Argument	Type	Required	Description
identifier	string	yes	The name of the rules

fn sync(identifier?: string)

Sync rules state from GCP

Argument	Type	Required	Description
identifier?	string	no	Target a specific rules by name (e.g. one discovered by list)

fn list(pageSize?: number, maxPages?: number)

List rules resources

Argument	Type	Required	Description
pageSize?	number	no	Maximum number of GatewaySecurityPolicyRules to return per call.
maxPages?	number	no	Maximum number of pages to fetch (default: 10)

Resources

state(infinite)— The GatewaySecurityPolicyRule resource is in a nested collection within a Gat...

@swamp/gcp/networksecurity/interceptdeploymentgroupsv2026.07.21.2interceptdeploymentgroups.ts

Global Arguments

Argument	Type	Required	Description
accessToken?	string	no	GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
credentialsJson?	string	no	GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault.
project?	string	no	GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables.
scopes?	string	no	Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes.
description?	string	no	Optional. User-provided description of the deployment group. Used as additional context for the deployment group.
labels?	record	no	Optional. Labels are key/value pairs that help to organize and filter resources.
name?	string	no	Immutable. Identifier. The resource name of this deployment group, for example: `projects/123456789/locations/global/interceptDeploymentGroups/my-dg`. See https://google.aip.dev/122 for more details.
network?	string	no	Required. Immutable. The network that will be used for all child deployments, for example: `projects/{project}/global/networks/{network}`. See https://google.aip.dev/124.
interceptDeploymentGroupId?	string	no	Required. The ID to use for the new deployment group, which will become the final component of the deployment group's resource name.
requestId?	string	no	Optional. A unique identifier for this request. Must be a UUID4. This request is only idempotent if a `request_id` is provided. See https://google.aip.dev/155 for more details.
location?	string	no	The location for this resource (e.g., 'us', 'us-central1', 'europe-west1')

fn create(waitForReady?: boolean)

Create a interceptDeploymentGroups

Argument	Type	Required	Description
waitForReady?	boolean	no	Wait for the resource to reach a ready state after creation (default: true)

fn get(identifier: string)

Get a interceptDeploymentGroups

Argument	Type	Required	Description
identifier	string	yes	The name of the interceptDeploymentGroups

fn update(identifier?: string, waitForReady?: boolean)

Update interceptDeploymentGroups attributes

Argument	Type	Required	Description
identifier?	string	no	Target a specific interceptDeploymentGroups by name (e.g. one discovered by list)
waitForReady?	boolean	no	Wait for the resource to reach a ready state after update (default: true)

fn delete(identifier: string)

Delete the interceptDeploymentGroups

Argument	Type	Required	Description
identifier	string	yes	The name of the interceptDeploymentGroups

fn sync(identifier?: string)

Sync interceptDeploymentGroups state from GCP

Argument	Type	Required	Description
identifier?	string	no	Target a specific interceptDeploymentGroups by name (e.g. one discovered by list)

fn list(filter?: string, orderBy?: string, pageSize?: number, maxPages?: number)

List interceptDeploymentGroups resources

Argument	Type	Required	Description
filter?	string	no	Optional. Filter expression. See https://google.aip.dev/160#filtering for more details.
orderBy?	string	no	Optional. Sort expression. See https://google.aip.dev/132#ordering for more details.
pageSize?	number	no	Optional. Requested page size. Server may return fewer items than requested. If unspecified, server will pick an appropriate default. See https://google.aip.dev/158 for more details.
maxPages?	number	no	Maximum number of pages to fetch (default: 10)

Resources

state(infinite)— A deployment group aggregates many zonal intercept backends (deployments) int...

@swamp/gcp/networksecurity/interceptdeploymentsv2026.07.21.2interceptdeployments.ts

Global Arguments

Argument	Type	Required	Description
accessToken?	string	no	GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
credentialsJson?	string	no	GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault.
project?	string	no	GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables.
scopes?	string	no	Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes.
description?	string	no	Optional. User-provided description of the deployment. Used as additional context for the deployment.
forwardingRule?	string	no	Required. Immutable. The regional forwarding rule that fronts the interceptors, for example: `projects/123456789/regions/us-central1/forwardingRules/my-rule`. See https://google.aip.dev/124.
interceptDeploymentGroup?	string	no	Required. Immutable. The deployment group that this deployment is a part of, for example: `projects/123456789/locations/global/interceptDeploymentGroups/my-dg`. See https://google.aip.dev/124.
labels?	record	no	Optional. Labels are key/value pairs that help to organize and filter resources.
name?	string	no	Immutable. Identifier. The resource name of this deployment, for example: `projects/123456789/locations/us-central1-a/interceptDeployments/my-dep`. See https://google.aip.dev/122 for more details.
interceptDeploymentId?	string	no	Required. The ID to use for the new deployment, which will become the final component of the deployment's resource name.
requestId?	string	no	Optional. A unique identifier for this request. Must be a UUID4. This request is only idempotent if a `request_id` is provided. See https://google.aip.dev/155 for more details.
location?	string	no	The location for this resource (e.g., 'us', 'us-central1', 'europe-west1')

fn create(waitForReady?: boolean)

Create a interceptDeployments

Argument	Type	Required	Description
waitForReady?	boolean	no	Wait for the resource to reach a ready state after creation (default: true)

fn get(identifier: string)

Get a interceptDeployments

Argument	Type	Required	Description
identifier	string	yes	The name of the interceptDeployments

fn update(identifier?: string, waitForReady?: boolean)

Update interceptDeployments attributes

Argument	Type	Required	Description
identifier?	string	no	Target a specific interceptDeployments by name (e.g. one discovered by list)
waitForReady?	boolean	no	Wait for the resource to reach a ready state after update (default: true)

fn delete(identifier: string)

Delete the interceptDeployments

Argument	Type	Required	Description
identifier	string	yes	The name of the interceptDeployments

fn sync(identifier?: string)

Sync interceptDeployments state from GCP

Argument	Type	Required	Description
identifier?	string	no	Target a specific interceptDeployments by name (e.g. one discovered by list)

fn list(filter?: string, orderBy?: string, pageSize?: number, maxPages?: number)

List interceptDeployments resources

Argument	Type	Required	Description
filter?	string	no	Optional. Filter expression. See https://google.aip.dev/160#filtering for more details.
orderBy?	string	no	Optional. Sort expression. See https://google.aip.dev/132#ordering for more details.
pageSize?	number	no	Optional. Requested page size. Server may return fewer items than requested. If unspecified, server will pick an appropriate default. See https://google.aip.dev/158 for more details.
maxPages?	number	no	Maximum number of pages to fetch (default: 10)

Resources

state(infinite)— A deployment represents a zonal intercept backend ready to accept GENEVE-enca...

@swamp/gcp/networksecurity/interceptendpointgroupassociationsv2026.07.21.2interceptendpointgroupassociations.ts

Global Arguments

Argument	Type	Required	Description
accessToken?	string	no	GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
credentialsJson?	string	no	GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault.
project?	string	no	GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables.
scopes?	string	no	Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes.
interceptEndpointGroup?	string	no	Required. Immutable. The endpoint group that this association is connected to, for example: `projects/123456789/locations/global/interceptEndpointGroups/my-eg`. See https://google.aip.dev/124.
labels?	record	no	Optional. Labels are key/value pairs that help to organize and filter resources.
name?	string	no	Immutable. Identifier. The resource name of this endpoint group association, for example: `projects/123456789/locations/global/interceptEndpointGroupAssociations/my-eg-association`. See https://google.aip.dev/122 for more details.
network?	string	no	Required. Immutable. The VPC network that is associated. for example: `projects/123456789/global/networks/my-network`. See https://google.aip.dev/124.
interceptEndpointGroupAssociationId?	string	no	Optional. The ID to use for the new association, which will become the final component of the endpoint group's resource name. If not provided, the server will generate a unique ID.
requestId?	string	no	Optional. A unique identifier for this request. Must be a UUID4. This request is only idempotent if a `request_id` is provided. See https://google.aip.dev/155 for more details.
location?	string	no	The location for this resource (e.g., 'us', 'us-central1', 'europe-west1')

fn create(waitForReady?: boolean)

Create a interceptEndpointGroupAssociations

Argument	Type	Required	Description
waitForReady?	boolean	no	Wait for the resource to reach a ready state after creation (default: true)

fn get(identifier: string)

Get a interceptEndpointGroupAssociations

Argument	Type	Required	Description
identifier	string	yes	The name of the interceptEndpointGroupAssociations

fn update(identifier?: string, waitForReady?: boolean)

Update interceptEndpointGroupAssociations attributes

Argument	Type	Required	Description
identifier?	string	no	Target a specific interceptEndpointGroupAssociations by name (e.g. one discovered by list)
waitForReady?	boolean	no	Wait for the resource to reach a ready state after update (default: true)

fn delete(identifier: string)

Delete the interceptEndpointGroupAssociations

Argument	Type	Required	Description
identifier	string	yes	The name of the interceptEndpointGroupAssociations

fn sync(identifier?: string)

Sync interceptEndpointGroupAssociations state from GCP

Argument	Type	Required	Description
identifier?	string	no	Target a specific interceptEndpointGroupAssociations by name (e.g. one discovered by list)

fn list(filter?: string, orderBy?: string, pageSize?: number, maxPages?: number)

List interceptEndpointGroupAssociations resources

Argument	Type	Required	Description
filter?	string	no	Optional. Filter expression. See https://google.aip.dev/160#filtering for more details.
orderBy?	string	no	Optional. Sort expression. See https://google.aip.dev/132#ordering for more details.
pageSize?	number	no	Optional. Requested page size. Server may return fewer items than requested. If unspecified, server will pick an appropriate default. See https://google.aip.dev/158 for more details.
maxPages?	number	no	Maximum number of pages to fetch (default: 10)

Resources

state(infinite)— An endpoint group association represents a link between a network and an endp...

@swamp/gcp/networksecurity/interceptendpointgroupsv2026.07.21.3interceptendpointgroups.ts

Global Arguments

Argument	Type	Required	Description
accessToken?	string	no	GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
credentialsJson?	string	no	GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault.
project?	string	no	GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables.
scopes?	string	no	Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes.
description?	string	no	Optional. User-provided description of the endpoint group. Used as additional context for the endpoint group.
interceptDeploymentGroup?	string	no	Required. Immutable. The deployment group that this endpoint group is connected to, for example: `projects/123456789/locations/global/interceptDeploymentGroups/my-dg`. See https://google.aip.dev/124.
labels?	record	no	Optional. Labels are key/value pairs that help to organize and filter resources.
name?	string	no	Immutable. Identifier. The resource name of this endpoint group, for example: `projects/123456789/locations/global/interceptEndpointGroups/my-eg`. See https://google.aip.dev/122 for more details.
interceptEndpointGroupId?	string	no	Required. The ID to use for the endpoint group, which will become the final component of the endpoint group's resource name.
requestId?	string	no	Optional. A unique identifier for this request. Must be a UUID4. This request is only idempotent if a `request_id` is provided. See https://google.aip.dev/155 for more details.
location?	string	no	The location for this resource (e.g., 'us', 'us-central1', 'europe-west1')

fn create(waitForReady?: boolean)

Create a interceptEndpointGroups

Argument	Type	Required	Description
waitForReady?	boolean	no	Wait for the resource to reach a ready state after creation (default: true)

fn get(identifier: string)

Get a interceptEndpointGroups

Argument	Type	Required	Description
identifier	string	yes	The name of the interceptEndpointGroups

fn update(identifier?: string, waitForReady?: boolean)

Update interceptEndpointGroups attributes

Argument	Type	Required	Description
identifier?	string	no	Target a specific interceptEndpointGroups by name (e.g. one discovered by list)
waitForReady?	boolean	no	Wait for the resource to reach a ready state after update (default: true)

fn delete(identifier: string)

Delete the interceptEndpointGroups

Argument	Type	Required	Description
identifier	string	yes	The name of the interceptEndpointGroups

fn sync(identifier?: string)

Sync interceptEndpointGroups state from GCP

Argument	Type	Required	Description
identifier?	string	no	Target a specific interceptEndpointGroups by name (e.g. one discovered by list)

fn list(filter?: string, orderBy?: string, pageSize?: number, maxPages?: number)

List interceptEndpointGroups resources

Argument	Type	Required	Description
filter?	string	no	Optional. Filter expression. See https://google.aip.dev/160#filtering for more details.
orderBy?	string	no	Optional. Sort expression. See https://google.aip.dev/132#ordering for more details.
pageSize?	number	no	Optional. Requested page size. Server may return fewer items than requested. If unspecified, server will pick an appropriate default. See https://google.aip.dev/158 for more details.
maxPages?	number	no	Maximum number of pages to fetch (default: 10)

Resources

state(infinite)— An endpoint group is a consumer frontend for a deployment group (backend). In...

@swamp/gcp/networksecurity/locationsv2026.07.21.3locations.ts

Global Arguments

Argument	Type	Required	Description
accessToken?	string	no	GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
credentialsJson?	string	no	GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault.
project?	string	no	GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables.
scopes?	string	no	Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes.
name	string	yes	The resource that owns the locations collection, if applicable.

fn get(identifier: string)

Get a locations

Argument	Type	Required	Description
identifier	string	yes	The name of the locations

fn sync(identifier?: string)

Sync locations state from GCP

Argument	Type	Required	Description
identifier?	string	no	Target a specific locations by name (e.g. one discovered by list)

fn list(extraLocationTypes?: string, filter?: string, pageSize?: number, maxPages?: number)

List locations resources

Argument	Type	Required	Description
extraLocationTypes?	string	no	Optional. Do not use this field unless explicitly documented otherwise. This is primarily for internal usage.
filter?	string	no	A filter to narrow down results to a preferred subset. The filtering language accepts strings like `"displayName=tokyo"`, and is documented in more detail in [AIP-160](https://google.aip.dev/160).
pageSize?	number	no	The maximum number of results to return. If not set, the service selects a default.
maxPages?	number	no	Maximum number of pages to fetch (default: 10)

Resources

state(infinite)— A resource that represents a Google Cloud location.

@swamp/gcp/networksecurity/mirroringdeploymentgroupsv2026.07.21.2mirroringdeploymentgroups.ts

Global Arguments

Argument	Type	Required	Description
accessToken?	string	no	GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
credentialsJson?	string	no	GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault.
project?	string	no	GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables.
scopes?	string	no	Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes.
description?	string	no	Optional. User-provided description of the deployment group. Used as additional context for the deployment group.
labels?	record	no	Optional. Labels are key/value pairs that help to organize and filter resources.
name?	string	no	Immutable. Identifier. The resource name of this deployment group, for example: `projects/123456789/locations/global/mirroringDeploymentGroups/my-dg`. See https://google.aip.dev/122 for more details.
network?	string	no	Required. Immutable. The network that will be used for all child deployments, for example: `projects/{project}/global/networks/{network}`. See https://google.aip.dev/124.
mirroringDeploymentGroupId?	string	no	Required. The ID to use for the new deployment group, which will become the final component of the deployment group's resource name.
requestId?	string	no	Optional. A unique identifier for this request. Must be a UUID4. This request is only idempotent if a `request_id` is provided. See https://google.aip.dev/155 for more details.
location?	string	no	The location for this resource (e.g., 'us', 'us-central1', 'europe-west1')

fn create(waitForReady?: boolean)

Create a mirroringDeploymentGroups

Argument	Type	Required	Description
waitForReady?	boolean	no	Wait for the resource to reach a ready state after creation (default: true)

fn get(identifier: string)

Get a mirroringDeploymentGroups

Argument	Type	Required	Description
identifier	string	yes	The name of the mirroringDeploymentGroups

fn update(identifier?: string, waitForReady?: boolean)

Update mirroringDeploymentGroups attributes

Argument	Type	Required	Description
identifier?	string	no	Target a specific mirroringDeploymentGroups by name (e.g. one discovered by list)
waitForReady?	boolean	no	Wait for the resource to reach a ready state after update (default: true)

fn delete(identifier: string)

Delete the mirroringDeploymentGroups

Argument	Type	Required	Description
identifier	string	yes	The name of the mirroringDeploymentGroups

fn sync(identifier?: string)

Sync mirroringDeploymentGroups state from GCP

Argument	Type	Required	Description
identifier?	string	no	Target a specific mirroringDeploymentGroups by name (e.g. one discovered by list)

fn list(filter?: string, orderBy?: string, pageSize?: number, maxPages?: number)

List mirroringDeploymentGroups resources

Argument	Type	Required	Description
filter?	string	no	Optional. Filter expression. See https://google.aip.dev/160#filtering for more details.
orderBy?	string	no	Optional. Sort expression. See https://google.aip.dev/132#ordering for more details.
pageSize?	number	no	Optional. Requested page size. Server may return fewer items than requested. If unspecified, server will pick an appropriate default. See https://google.aip.dev/158 for more details.
maxPages?	number	no	Maximum number of pages to fetch (default: 10)

Resources

state(infinite)— A deployment group aggregates many zonal mirroring backends (deployments) int...

@swamp/gcp/networksecurity/mirroringdeploymentsv2026.07.21.2mirroringdeployments.ts

Global Arguments

Argument	Type	Required	Description
accessToken?	string	no	GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
credentialsJson?	string	no	GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault.
project?	string	no	GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables.
scopes?	string	no	Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes.
description?	string	no	Optional. User-provided description of the deployment. Used as additional context for the deployment.
forwardingRule?	string	no	Required. Immutable. The regional forwarding rule that fronts the mirroring collectors, for example: `projects/123456789/regions/us-central1/forwardingRules/my-rule`. See https://google.aip.dev/124.
labels?	record	no	Optional. Labels are key/value pairs that help to organize and filter resources.
mirroringDeploymentGroup?	string	no	Required. Immutable. The deployment group that this deployment is a part of, for example: `projects/123456789/locations/global/mirroringDeploymentGroups/my-dg`. See https://google.aip.dev/124.
name?	string	no	Immutable. Identifier. The resource name of this deployment, for example: `projects/123456789/locations/us-central1-a/mirroringDeployments/my-dep`. See https://google.aip.dev/122 for more details.
mirroringDeploymentId?	string	no	Required. The ID to use for the new deployment, which will become the final component of the deployment's resource name.
requestId?	string	no	Optional. A unique identifier for this request. Must be a UUID4. This request is only idempotent if a `request_id` is provided. See https://google.aip.dev/155 for more details.
location?	string	no	The location for this resource (e.g., 'us', 'us-central1', 'europe-west1')

fn create(waitForReady?: boolean)

Create a mirroringDeployments

Argument	Type	Required	Description
waitForReady?	boolean	no	Wait for the resource to reach a ready state after creation (default: true)

fn get(identifier: string)

Get a mirroringDeployments

Argument	Type	Required	Description
identifier	string	yes	The name of the mirroringDeployments

fn update(identifier?: string, waitForReady?: boolean)

Update mirroringDeployments attributes

Argument	Type	Required	Description
identifier?	string	no	Target a specific mirroringDeployments by name (e.g. one discovered by list)
waitForReady?	boolean	no	Wait for the resource to reach a ready state after update (default: true)

fn delete(identifier: string)

Delete the mirroringDeployments

Argument	Type	Required	Description
identifier	string	yes	The name of the mirroringDeployments

fn sync(identifier?: string)

Sync mirroringDeployments state from GCP

Argument	Type	Required	Description
identifier?	string	no	Target a specific mirroringDeployments by name (e.g. one discovered by list)

fn list(filter?: string, orderBy?: string, pageSize?: number, maxPages?: number)

List mirroringDeployments resources

Argument	Type	Required	Description
filter?	string	no	Optional. Filter expression. See https://google.aip.dev/160#filtering for more details.
orderBy?	string	no	Optional. Sort expression. See https://google.aip.dev/132#ordering for more details.
pageSize?	number	no	Optional. Requested page size. Server may return fewer items than requested. If unspecified, server will pick an appropriate default. See https://google.aip.dev/158 for more details.
maxPages?	number	no	Maximum number of pages to fetch (default: 10)

Resources

state(infinite)— A deployment represents a zonal mirroring backend ready to accept GENEVE-enca...

@swamp/gcp/networksecurity/mirroringendpointgroupassociationsv2026.07.21.3mirroringendpointgroupassociations.ts

Global Arguments

Argument	Type	Required	Description
accessToken?	string	no	GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
credentialsJson?	string	no	GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault.
project?	string	no	GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables.
scopes?	string	no	Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes.
labels?	record	no	Optional. Labels are key/value pairs that help to organize and filter resources.
mirroringEndpointGroup?	string	no	Immutable. The endpoint group that this association is connected to, for example: `projects/123456789/locations/global/mirroringEndpointGroups/my-eg`. See https://google.aip.dev/124.
name?	string	no	Immutable. Identifier. The resource name of this endpoint group association, for example: `projects/123456789/locations/global/mirroringEndpointGroupAssociations/my-eg-association`. See https://google.aip.dev/122 for more details.
network?	string	no	Immutable. The VPC network that is associated. for example: `projects/123456789/global/networks/my-network`. See https://google.aip.dev/124.
mirroringEndpointGroupAssociationId?	string	no	Optional. The ID to use for the new association, which will become the final component of the endpoint group's resource name. If not provided, the server will generate a unique ID.
requestId?	string	no	Optional. A unique identifier for this request. Must be a UUID4. This request is only idempotent if a `request_id` is provided. See https://google.aip.dev/155 for more details.
location?	string	no	The location for this resource (e.g., 'us', 'us-central1', 'europe-west1')

fn create(waitForReady?: boolean)

Create a mirroringEndpointGroupAssociations

Argument	Type	Required	Description
waitForReady?	boolean	no	Wait for the resource to reach a ready state after creation (default: true)

fn get(identifier: string)

Get a mirroringEndpointGroupAssociations

Argument	Type	Required	Description
identifier	string	yes	The name of the mirroringEndpointGroupAssociations

fn update(identifier?: string, waitForReady?: boolean)

Update mirroringEndpointGroupAssociations attributes

Argument	Type	Required	Description
identifier?	string	no	Target a specific mirroringEndpointGroupAssociations by name (e.g. one discovered by list)
waitForReady?	boolean	no	Wait for the resource to reach a ready state after update (default: true)

fn delete(identifier: string)

Delete the mirroringEndpointGroupAssociations

Argument	Type	Required	Description
identifier	string	yes	The name of the mirroringEndpointGroupAssociations

fn sync(identifier?: string)

Sync mirroringEndpointGroupAssociations state from GCP

Argument	Type	Required	Description
identifier?	string	no	Target a specific mirroringEndpointGroupAssociations by name (e.g. one discovered by list)

fn list(filter?: string, orderBy?: string, pageSize?: number, maxPages?: number)

List mirroringEndpointGroupAssociations resources

Argument	Type	Required	Description
filter?	string	no	Optional. Filter expression. See https://google.aip.dev/160#filtering for more details.
orderBy?	string	no	Optional. Sort expression. See https://google.aip.dev/132#ordering for more details.
pageSize?	number	no	Optional. Requested page size. Server may return fewer items than requested. If unspecified, server will pick an appropriate default. See https://google.aip.dev/158 for more details.
maxPages?	number	no	Maximum number of pages to fetch (default: 10)

Resources

state(infinite)— An endpoint group association represents a link between a network and an endp...

@swamp/gcp/networksecurity/mirroringendpointgroupsv2026.07.21.2mirroringendpointgroups.ts

Global Arguments

Argument	Type	Required	Description
accessToken?	string	no	GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
credentialsJson?	string	no	GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault.
project?	string	no	GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables.
scopes?	string	no	Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes.
description?	string	no	Optional. User-provided description of the endpoint group. Used as additional context for the endpoint group.
labels?	record	no	Optional. Labels are key/value pairs that help to organize and filter resources.
mirroringDeploymentGroup?	string	no	Immutable. The deployment group that this DIRECT endpoint group is connected to, for example: `projects/123456789/locations/global/mirroringDeploymentGroups/my-dg`. See https://google.aip.dev/124.
name?	string	no	Immutable. Identifier. The resource name of this endpoint group, for example: `projects/123456789/locations/global/mirroringEndpointGroups/my-eg`. See https://google.aip.dev/122 for more details.
type?	enum	no	Immutable. The type of the endpoint group. If left unspecified, defaults to DIRECT.
mirroringEndpointGroupId?	string	no	Required. The ID to use for the endpoint group, which will become the final component of the endpoint group's resource name.
requestId?	string	no	Optional. A unique identifier for this request. Must be a UUID4. This request is only idempotent if a `request_id` is provided. See https://google.aip.dev/155 for more details.
location?	string	no	The location for this resource (e.g., 'us', 'us-central1', 'europe-west1')

fn create(waitForReady?: boolean)

Create a mirroringEndpointGroups

Argument	Type	Required	Description
waitForReady?	boolean	no	Wait for the resource to reach a ready state after creation (default: true)

fn get(identifier: string)

Get a mirroringEndpointGroups

Argument	Type	Required	Description
identifier	string	yes	The name of the mirroringEndpointGroups

fn update(identifier?: string, waitForReady?: boolean)

Update mirroringEndpointGroups attributes

Argument	Type	Required	Description
identifier?	string	no	Target a specific mirroringEndpointGroups by name (e.g. one discovered by list)
waitForReady?	boolean	no	Wait for the resource to reach a ready state after update (default: true)

fn delete(identifier: string)

Delete the mirroringEndpointGroups

Argument	Type	Required	Description
identifier	string	yes	The name of the mirroringEndpointGroups

fn sync(identifier?: string)

Sync mirroringEndpointGroups state from GCP

Argument	Type	Required	Description
identifier?	string	no	Target a specific mirroringEndpointGroups by name (e.g. one discovered by list)

fn list(filter?: string, orderBy?: string, pageSize?: number, maxPages?: number)

List mirroringEndpointGroups resources

Argument	Type	Required	Description
filter?	string	no	Optional. Filter expression. See https://google.aip.dev/160#filtering for more details.
orderBy?	string	no	Optional. Sort expression. See https://google.aip.dev/132#ordering for more details.
pageSize?	number	no	Optional. Requested page size. Server may return fewer items than requested. If unspecified, server will pick an appropriate default. See https://google.aip.dev/158 for more details.
maxPages?	number	no	Maximum number of pages to fetch (default: 10)

Resources

state(infinite)— An endpoint group is a consumer frontend for a deployment group (backend). In...

@swamp/gcp/networksecurity/sacattachmentsv2026.07.21.1sacattachments.ts

Global Arguments

Argument	Type	Required	Description
accessToken?	string	no	GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
credentialsJson?	string	no	GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault.
project?	string	no	GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables.
scopes?	string	no	Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes.
labels?	record	no	Optional. Optional list of labels applied to the resource.
name?	string	no	Identifier. Resource name, in the form `projects/{project}/locations/{location}/sacAttachments/{sac_attachment}`.
nccGateway?	string	no	Required. NCC Gateway associated with the attachment. This can be input as an ID or a full resource name. The output always has the form `projects/{project_number}/locations/{location}/spokes/{ncc_gateway}`.
sacRealm?	string	no	Required. SAC Realm which owns the attachment. This can be input as an ID or a full resource name. The output always has the form `projects/{project_number}/locations/{location}/sacRealms/{sac_realm}`.
requestId?	string	no	Optional. An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. The server will guarantee that for at least 60 minutes since the first request. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID w
sacAttachmentId?	string	no	Required. ID of the created attachment. The ID must be 1-63 characters long, and comply with RFC1035. Specifically, it must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?` which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
location?	string	no	The location for this resource (e.g., 'us', 'us-central1', 'europe-west1')

fn create()

Create a sacAttachments

fn get(identifier: string)

Get a sacAttachments

Argument	Type	Required	Description
identifier	string	yes	The name of the sacAttachments

fn delete(identifier: string)

Delete the sacAttachments

Argument	Type	Required	Description
identifier	string	yes	The name of the sacAttachments

fn sync(identifier?: string)

Sync sacAttachments state from GCP

Argument	Type	Required	Description
identifier?	string	no	Target a specific sacAttachments by name (e.g. one discovered by list)

fn list(filter?: string, orderBy?: string, pageSize?: number, maxPages?: number)

List sacAttachments resources

Argument	Type	Required	Description
filter?	string	no	Optional. An expression that filters the list of results.
orderBy?	string	no	Optional. Sort the results by a certain order.
pageSize?	number	no	Optional. Requested page size. Server may return fewer items than requested. If unspecified, server will pick an appropriate default.
maxPages?	number	no	Maximum number of pages to fetch (default: 10)

Resources

state(infinite)— Represents a Secure Access Connect (SAC) attachment resource. A Secure Access...

@swamp/gcp/networksecurity/sacrealmsv2026.07.21.1sacrealms.ts

Global Arguments

Argument	Type	Required	Description
accessToken?	string	no	GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
credentialsJson?	string	no	GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault.
project?	string	no	GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables.
scopes?	string	no	Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes.
labels?	record	no	Optional. Optional list of labels applied to the resource.
name?	string	no	Identifier. Resource name, in the form `projects/{project}/locations/global/sacRealms/{sacRealm}`.
securityService?	enum	no	Immutable. SSE service provider associated with the realm.
requestId?	string	no	Optional. An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. The server will guarantee that for at least 60 minutes since the first request. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID w
sacRealmId?	string	no	Required. ID of the created realm. The ID must be 1-63 characters long, and comply with RFC1035. Specifically, it must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?` which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
location?	string	no	The location for this resource (e.g., 'us', 'us-central1', 'europe-west1')

fn create()

Create a sacRealms

fn get(identifier: string)

Get a sacRealms

Argument	Type	Required	Description
identifier	string	yes	The name of the sacRealms

fn delete(identifier: string)

Delete the sacRealms

Argument	Type	Required	Description
identifier	string	yes	The name of the sacRealms

fn sync(identifier?: string)

Sync sacRealms state from GCP

Argument	Type	Required	Description
identifier?	string	no	Target a specific sacRealms by name (e.g. one discovered by list)

fn list(filter?: string, orderBy?: string, pageSize?: number, maxPages?: number)

List sacRealms resources

Argument	Type	Required	Description
filter?	string	no	Optional. An expression that filters the list of results.
orderBy?	string	no	Optional. Sort the results by a certain order.
pageSize?	number	no	Optional. Requested page size. Server may return fewer items than requested. If unspecified, server will pick an appropriate default.
maxPages?	number	no	Maximum number of pages to fetch (default: 10)

Resources

state(infinite)— Represents a Secure Access Connect (SAC) realm resource. A Secure Access Conn...

@swamp/gcp/networksecurity/securityprofilegroupsv2026.07.21.2securityprofilegroups.ts

Global Arguments

Argument	Type	Required	Description
accessToken?	string	no	GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
credentialsJson?	string	no	GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault.
project?	string	no	GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables.
scopes?	string	no	Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes.
customInterceptProfile?	string	no	Optional. Reference to a SecurityProfile with the CustomIntercept configuration.
customMirroringProfile?	string	no	Optional. Reference to a SecurityProfile with the CustomMirroring configuration.
description?	string	no	Optional. An optional description of the profile group. Max length 2048 characters.
labels?	record	no	Optional. Labels as key value pairs.
name?	string	no	Immutable. Identifier. Name of the SecurityProfileGroup resource. It matches pattern `projects\|organizations/*/locations/{location}/securityProfileGroups/{security_profile_group}`.
threatPreventionProfile?	string	no	Optional. Reference to a SecurityProfile with the ThreatPrevention configuration.
urlFilteringProfile?	string	no	Optional. Reference to a SecurityProfile with the UrlFiltering configuration.
securityProfileGroupId?	string	no	Required. Short name of the SecurityProfileGroup resource to be created. This value should be 1-63 characters long, containing only letters, numbers, hyphens, and underscores, and should not start with a number. E.g. "security_profile_group1".
parent?	string	no	The parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)

fn create()

Create a securityProfileGroups

fn get(identifier: string)

Get a securityProfileGroups

Argument	Type	Required	Description
identifier	string	yes	The name of the securityProfileGroups

fn update(identifier?: string)

Update securityProfileGroups attributes

Argument	Type	Required	Description
identifier?	string	no	Target a specific securityProfileGroups by name (e.g. one discovered by list)

fn delete(identifier: string)

Delete the securityProfileGroups

Argument	Type	Required	Description
identifier	string	yes	The name of the securityProfileGroups

fn sync(identifier?: string)

Sync securityProfileGroups state from GCP

Argument	Type	Required	Description
identifier?	string	no	Target a specific securityProfileGroups by name (e.g. one discovered by list)

fn list(pageSize?: number, maxPages?: number)

List securityProfileGroups resources

Argument	Type	Required	Description
pageSize?	number	no	Optional. Maximum number of SecurityProfileGroups to return per call.
maxPages?	number	no	Maximum number of pages to fetch (default: 10)

Resources

state(infinite)— SecurityProfileGroup is a resource that defines the behavior for various Prof...

@swamp/gcp/networksecurity/securityprofilesv2026.07.21.3securityprofiles.ts

Global Arguments

Argument	Type	Required	Description
accessToken?	string	no	GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
credentialsJson?	string	no	GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault.
project?	string	no	GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables.
scopes?	string	no	Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes.
customInterceptProfile?	object	no	The custom TPPI configuration for the SecurityProfile.
customMirroringProfile?	object	no	The custom Packet Mirroring v2 configuration for the SecurityProfile.
description?	string	no	Optional. An optional description of the profile. Max length 512 characters.
labels?	record	no	Optional. Labels as key value pairs.
name?	string	no	Immutable. Identifier. Name of the SecurityProfile resource. It matches pattern `projects\|organizations/*/locations/{location}/securityProfiles/{security_profile}`.
threatPreventionProfile?	object	no	The threat prevention configuration for the SecurityProfile.
type?	enum	no	Immutable. The single ProfileType that the SecurityProfile resource configures.
urlFilteringProfile?	object	no	The URL filtering configuration for the SecurityProfile.
securityProfileId?	string	no	Required. Short name of the SecurityProfile resource to be created. This value should be 1-63 characters long, containing only letters, numbers, hyphens, and underscores, and should not start with a number. E.g. "security_profile1".
parent?	string	no	The parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)

fn create()

Create a securityProfiles

fn get(identifier: string)

Get a securityProfiles

Argument	Type	Required	Description
identifier	string	yes	The name of the securityProfiles

fn update(identifier?: string)

Update securityProfiles attributes

Argument	Type	Required	Description
identifier?	string	no	Target a specific securityProfiles by name (e.g. one discovered by list)

fn delete(identifier: string)

Delete the securityProfiles

Argument	Type	Required	Description
identifier	string	yes	The name of the securityProfiles

fn sync(identifier?: string)

Sync securityProfiles state from GCP

Argument	Type	Required	Description
identifier?	string	no	Target a specific securityProfiles by name (e.g. one discovered by list)

fn list(pageSize?: number, maxPages?: number)

List securityProfiles resources

Argument	Type	Required	Description
pageSize?	number	no	Optional. Maximum number of SecurityProfiles to return per call.
maxPages?	number	no	Maximum number of pages to fetch (default: 10)

Resources

state(infinite)— SecurityProfile is a resource that defines the behavior for one of many Profi...

@swamp/gcp/networksecurity/servertlspoliciesv2026.07.21.3servertlspolicies.ts

Global Arguments

Argument	Type	Required	Description
accessToken?	string	no	GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
credentialsJson?	string	no	GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault.
project?	string	no	GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables.
scopes?	string	no	Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes.
allowOpen?	boolean	no	This field applies only for Traffic Director policies. It is must be set to false for Application Load Balancer policies. Determines if server allows plaintext connections. If set to true, server allows plain text connections. By default, it is set to false. This setting is not exclusive of other encryption modes. For example, if `allow_open` and `mtls_policy` are set, server allows both plain text and mTLS connections. See documentation of other encryption modes to confirm compatibility. Consid
description?	string	no	Free-text description of the resource.
labels?	record	no	Set of label tags associated with the resource.
mtlsPolicy?	object	no	This field is required if the policy is used with Application Load Balancers. This field can be empty for Traffic Director. Defines a mechanism to provision peer validation certificates for peer to peer authentication (Mutual TLS - mTLS). If not specified, client certificate will not be requested. The connection is treated as TLS and not mTLS. If `allow_open` and `mtls_policy` are set, server allows both plain text and mTLS connections.
name?	string	no	Required. Name of the ServerTlsPolicy resource. It matches the pattern `projects/*/locations/{location}/serverTlsPolicies/{server_tls_policy}`
serverCertificate?	object	no	Optional if policy is to be used with Traffic Director. For Application Load Balancers must be empty. Defines a mechanism to provision server identity (public and private keys). Cannot be combined with `allow_open` as a permissive mode that allows both plain text and TLS is not supported.
serverTlsPolicyId?	string	no	Required. Short name of the ServerTlsPolicy resource to be created. This value should be 1-63 characters long, containing only letters, numbers, hyphens, and underscores, and should not start with a number. E.g. "server_mtls_policy".
location?	string	no	The location for this resource (e.g., 'us', 'us-central1', 'europe-west1')

fn create()

Create a serverTlsPolicies

fn get(identifier: string)

Get a serverTlsPolicies

Argument	Type	Required	Description
identifier	string	yes	The name of the serverTlsPolicies

fn update(identifier?: string)

Update serverTlsPolicies attributes

Argument	Type	Required	Description
identifier?	string	no	Target a specific serverTlsPolicies by name (e.g. one discovered by list)

fn delete(identifier: string)

Delete the serverTlsPolicies

Argument	Type	Required	Description
identifier	string	yes	The name of the serverTlsPolicies

fn sync(identifier?: string)

Sync serverTlsPolicies state from GCP

Argument	Type	Required	Description
identifier?	string	no	Target a specific serverTlsPolicies by name (e.g. one discovered by list)

fn list(pageSize?: number, returnPartialSuccess?: boolean, maxPages?: number)

List serverTlsPolicies resources

Argument	Type	Required	Description
pageSize?	number	no	Maximum number of ServerTlsPolicies to return per call.
returnPartialSuccess?	boolean	no	Optional. Setting this field to `true` will opt the request into returning the resources that are reachable, and into including the names of those that were unreachable in the [ListServerTlsPoliciesResponse.unreachable] field. This can only be `true` when reading across collections e.g. when `parent` is set to `"projects/example/locations/-"`.
maxPages?	number	no	Maximum number of pages to fetch (default: 10)

fn get_iam_policy()

get iam policy

fn set_iam_policy(policy?: any, updateMask?: any)

set iam policy

Argument	Type	Required	Description
policy?	any	no
updateMask?	any	no

fn test_iam_permissions(permissions?: any)

test iam permissions

Argument	Type	Required	Description
permissions?	any	no

Resources

state(infinite)— ServerTlsPolicy is a resource that specifies how a server should authenticate...

@swamp/gcp/networksecurity/tlsinspectionpoliciesv2026.07.21.2tlsinspectionpolicies.ts

Global Arguments

Argument	Type	Required	Description
accessToken?	string	no	GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
credentialsJson?	string	no	GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault.
project?	string	no	GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables.
scopes?	string	no	Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes.
caPool?	string	no	Required. A CA pool resource used to issue interception certificates. The CA pool string has a relative resource path following the form "projects/{project}/locations/{location}/caPools/{ca_pool}".
customTlsFeatures?	array	no	Optional. List of custom TLS cipher suites selected. This field is valid only if the selected tls_feature_profile is CUSTOM. The compute.SslPoliciesService.ListAvailableFeatures method returns the set of features that can be specified in this list. Note that Secure Web Proxy does not yet honor this field.
description?	string	no	Optional. Free-text description of the resource.
excludePublicCaSet?	boolean	no	Optional. If FALSE (the default), use our default set of public CAs in addition to any CAs specified in trust_config. These public CAs are currently based on the Mozilla Root Program and are subject to change over time. If TRUE, do not accept our default set of public CAs. Only CAs specified in trust_config will be accepted. This defaults to FALSE (use public CAs in addition to trust_config) for backwards compatibility, but trusting public root CAs is not recommended unless the traffic in ques
minTlsVersion?	enum	no	Optional. Minimum TLS version that the firewall should use when negotiating connections with both clients and servers. If this is not set, then the default value is to allow the broadest set of clients and servers (TLS 1.0 or higher). Setting this to more restrictive values may improve security, but may also prevent the firewall from connecting to some clients or servers. Note that Secure Web Proxy does not yet honor this field.
name?	string	no	Required. Name of the resource. Name is of the form projects/{project}/locations/{location}/tlsInspectionPolicies/{tls_inspection_policy} tls_inspection_policy should match the pattern:(^[a-z]([a-z0-9-]{0,61}[a-z0-9])?$).
tlsFeatureProfile?	enum	no	Optional. The selected Profile. If this is not set, then the default value is to allow the broadest set of clients and servers ("PROFILE_COMPATIBLE"). Setting this to more restrictive values may improve security, but may also prevent the TLS inspection proxy from connecting to some clients or servers. Note that Secure Web Proxy does not yet honor this field.
trustConfig?	string	no	Optional. A TrustConfig resource used when making a connection to the TLS server. This is a relative resource path following the form "projects/{project}/locations/{location}/trustConfigs/{trust_config}". This is necessary to intercept TLS connections to servers with certificates signed by a private CA or self-signed certificates. Note that Secure Web Proxy does not yet honor this field.
tlsInspectionPolicyId?	string	no	Required. Short name of the TlsInspectionPolicy resource to be created. This value should be 1-63 characters long, containing only letters, numbers, hyphens, and underscores, and should not start with a number. E.g. "tls_inspection_policy1".
location?	string	no	The location for this resource (e.g., 'us', 'us-central1', 'europe-west1')

fn create()

Create a tlsInspectionPolicies

fn get(identifier: string)

Get a tlsInspectionPolicies

Argument	Type	Required	Description
identifier	string	yes	The name of the tlsInspectionPolicies

fn update(identifier?: string)

Update tlsInspectionPolicies attributes

Argument	Type	Required	Description
identifier?	string	no	Target a specific tlsInspectionPolicies by name (e.g. one discovered by list)

fn delete(identifier: string)

Delete the tlsInspectionPolicies

Argument	Type	Required	Description
identifier	string	yes	The name of the tlsInspectionPolicies

fn sync(identifier?: string)

Sync tlsInspectionPolicies state from GCP

Argument	Type	Required	Description
identifier?	string	no	Target a specific tlsInspectionPolicies by name (e.g. one discovered by list)

fn list(pageSize?: number, maxPages?: number)

List tlsInspectionPolicies resources

Argument	Type	Required	Description
pageSize?	number	no	Maximum number of TlsInspectionPolicies to return per call.
maxPages?	number	no	Maximum number of pages to fetch (default: 10)

Resources

state(infinite)— The TlsInspectionPolicy resource contains references to CA pools in Certifica...

@swamp/gcp/networksecurity/urllistsv2026.07.21.2urllists.ts

Global Arguments

Argument	Type	Required	Description
accessToken?	string	no	GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
credentialsJson?	string	no	GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault.
project?	string	no	GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables.
scopes?	string	no	Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes.
description?	string	no	Optional. Free-text description of the resource.
name?	string	no	Required. Name of the resource provided by the user. Name is of the form projects/{project}/locations/{location}/urlLists/{url_list} url_list should match the pattern:(^[a-z]([a-z0-9-]{0,61}[a-z0-9])?$).
values?	array	no	Required. FQDNs and URLs.
urlListId?	string	no	Required. Short name of the UrlList resource to be created. This value should be 1-63 characters long, containing only letters, numbers, hyphens, and underscores, and should not start with a number. E.g. "url_list".
location?	string	no	The location for this resource (e.g., 'us', 'us-central1', 'europe-west1')

fn create()

Create a urlLists

fn get(identifier: string)

Get a urlLists

Argument	Type	Required	Description
identifier	string	yes	The name of the urlLists

fn update(identifier?: string)

Update urlLists attributes

Argument	Type	Required	Description
identifier?	string	no	Target a specific urlLists by name (e.g. one discovered by list)

fn delete(identifier: string)

Delete the urlLists

Argument	Type	Required	Description
identifier	string	yes	The name of the urlLists

fn sync(identifier?: string)

Sync urlLists state from GCP

Argument	Type	Required	Description
identifier?	string	no	Target a specific urlLists by name (e.g. one discovered by list)

fn list(pageSize?: number, maxPages?: number)

List urlLists resources

Argument	Type	Required	Description
pageSize?	number	no	Maximum number of UrlLists to return per call.
maxPages?	number	no	Maximum number of pages to fetch (default: 10)

Resources

state(infinite)— UrlList proto helps users to set reusable, independently manageable lists of ...

04Previous Versions19

2026.07.21.1Jul 21, 2026

Updated: firewallendpoints, securityprofiles, authorizationpolicies, authzpolicies, clienttlspolicies, interceptendpointgroups, sacrealms, servertlspolicies

2026.07.20.2Jul 20, 2026

Added: sacattachments, sacrealms
Updated: locations, addressgroups, authzpolicies, mirroringendpointgroupassociations

Added 2, modified 1 models

2026.07.20.1Jul 20, 2026

Updated: addressgroups, firewallendpoints, securityprofilegroups, securityprofiles, locations, authorizationpolicies, authzpolicies, backendauthenticationconfigs, clienttlspolicies, dnsthreatdetectors, firewallendpointassociations, gatewaysecuritypolicies, gatewaysecuritypolicies_rules, interceptdeploymentgroups, interceptdeployments, interceptendpointgroupassociations, interceptendpointgroups, mirroringdeploymentgroups, mirroringdeployments, mirroringendpointgroupassociations, mirroringendpointgroups, servertlspolicies, tlsinspectionpolicies, urllists

Removed 2, modified 1 models

2026.07.19.2Jul 19, 2026

Updated: locations

2026.07.19.1Jul 19, 2026

Updated: locations, addressgroups, firewallendpoints, securityprofilegroups, securityprofiles, authorizationpolicies, authzpolicies, backendauthenticationconfigs, clienttlspolicies, dnsthreatdetectors, firewallendpointassociations, gatewaysecuritypolicies, gatewaysecuritypolicies_rules, interceptdeploymentgroups, interceptdeployments, interceptendpointgroupassociations, interceptendpointgroups, mirroringdeploymentgroups, mirroringdeployments, mirroringendpointgroupassociations, mirroringendpointgroups, sacattachments, sacrealms, servertlspolicies, tlsinspectionpolicies, urllists

2026.07.18.2Jul 18, 2026

Updated: locations, addressgroups, firewallendpoints, securityprofilegroups, securityprofiles, authorizationpolicies, authzpolicies, backendauthenticationconfigs, clienttlspolicies, dnsthreatdetectors, firewallendpointassociations, gatewaysecuritypolicies, gatewaysecuritypolicies_rules, interceptdeploymentgroups, interceptdeployments, interceptendpointgroupassociations, interceptendpointgroups, mirroringdeploymentgroups, mirroringdeployments, mirroringendpointgroupassociations, mirroringendpointgroups, sacattachments, sacrealms, servertlspolicies, tlsinspectionpolicies, urllists

2026.07.17.2Jul 17, 2026

Updated: addressgroups, firewallendpoints, securityprofilegroups, securityprofiles, authorizationpolicies, authzpolicies, backendauthenticationconfigs, clienttlspolicies, dnsthreatdetectors, firewallendpointassociations, gatewaysecuritypolicies, gatewaysecuritypolicies_rules, interceptdeploymentgroups, interceptdeployments, interceptendpointgroupassociations, interceptendpointgroups, mirroringdeploymentgroups, mirroringdeployments, mirroringendpointgroupassociations, mirroringendpointgroups, sacattachments, sacrealms, servertlspolicies, tlsinspectionpolicies, urllists

2026.07.17.1Jul 17, 2026

Updated: addressgroups, firewallendpoints, securityprofilegroups, securityprofiles, authorizationpolicies, authzpolicies, backendauthenticationconfigs, clienttlspolicies, dnsthreatdetectors, firewallendpointassociations, gatewaysecuritypolicies, gatewaysecuritypolicies_rules, interceptdeploymentgroups, interceptdeployments, interceptendpointgroupassociations, interceptendpointgroups, mirroringdeploymentgroups, mirroringdeployments, mirroringendpointgroupassociations, mirroringendpointgroups, sacattachments, sacrealms, servertlspolicies, tlsinspectionpolicies, urllists

2026.07.14.1Jul 14, 2026

Updated: authzpolicies

2026.07.08.1Jul 8, 2026

Updated: mirroringendpointgroupassociations

2026.06.08.2Jun 8, 2026

Updated: locations, addressgroups, firewallendpoints, securityprofilegroups, securityprofiles, authorizationpolicies, authzpolicies, backendauthenticationconfigs, clienttlspolicies, dnsthreatdetectors, firewallendpointassociations, gatewaysecuritypolicies, gatewaysecuritypolicies_rules, interceptdeploymentgroups, interceptdeployments, interceptendpointgroupassociations, interceptendpointgroups, mirroringdeploymentgroups, mirroringdeployments, mirroringendpointgroupassociations, mirroringendpointgroups, sacattachments, sacrealms, servertlspolicies, tlsinspectionpolicies, urllists

2026.06.07.1Jun 7, 2026

Updated: locations, addressgroups, firewallendpoints, securityprofilegroups, securityprofiles, authorizationpolicies, authzpolicies, backendauthenticationconfigs, clienttlspolicies, dnsthreatdetectors, firewallendpointassociations, gatewaysecuritypolicies, gatewaysecuritypolicies_rules, interceptdeploymentgroups, interceptdeployments, interceptendpointgroupassociations, interceptendpointgroups, mirroringdeploymentgroups, mirroringdeployments, mirroringendpointgroupassociations, mirroringendpointgroups, sacattachments, sacrealms, servertlspolicies, tlsinspectionpolicies, urllists

2026.05.26.1May 26, 2026

Added: sacattachments, sacrealms
Updated: locations, addressgroups, authzpolicies

Added 2, modified 1 models

2026.05.25.1May 25, 2026

Updated: addressgroups, firewallendpoints, securityprofilegroups, securityprofiles, locations, authorizationpolicies, authzpolicies, backendauthenticationconfigs, clienttlspolicies, dnsthreatdetectors, firewallendpointassociations, gatewaysecuritypolicies, gatewaysecuritypolicies_rules, interceptdeploymentgroups, interceptdeployments, interceptendpointgroupassociations, interceptendpointgroups, mirroringdeploymentgroups, mirroringdeployments, mirroringendpointgroupassociations, mirroringendpointgroups, servertlspolicies, tlsinspectionpolicies, urllists

Removed 2, modified 24 models

2026.05.24.1May 24, 2026

Added: sacattachments, sacrealms
Updated: locations, addressgroups, firewallendpoints, securityprofilegroups, securityprofiles, authorizationpolicies, authzpolicies, backendauthenticationconfigs, clienttlspolicies, dnsthreatdetectors, firewallendpointassociations, gatewaysecuritypolicies, gatewaysecuritypolicies_rules, interceptdeploymentgroups, interceptdeployments, interceptendpointgroupassociations, interceptendpointgroups, mirroringdeploymentgroups, mirroringdeployments, mirroringendpointgroupassociations, mirroringendpointgroups, servertlspolicies, tlsinspectionpolicies, urllists

Added 2, modified 1 models

2026.05.21.2May 21, 2026

Updated: addressgroups, firewallendpoints, securityprofilegroups, securityprofiles, locations, authorizationpolicies, authzpolicies, backendauthenticationconfigs, clienttlspolicies, dnsthreatdetectors, firewallendpointassociations, gatewaysecuritypolicies, gatewaysecuritypolicies_rules, interceptdeploymentgroups, interceptdeployments, interceptendpointgroupassociations, interceptendpointgroups, mirroringdeploymentgroups, mirroringdeployments, mirroringendpointgroupassociations, mirroringendpointgroups, servertlspolicies, tlsinspectionpolicies, urllists

2026.05.21.1May 21, 2026

Modified 4 models

2026.05.20.1May 20, 2026

Updated: authzpolicies

2026.05.19.2May 19, 2026

05Stats

100 / 100

Downloads

Archive size

327.0 KB

Verified by Swamp

Has README or module doc2/2earned
README has a code example1/1earned
README is substantive1/1earned
Most symbols documented1/1earned
No slow types (deprecated)1/1earned
Dependencies pass trust audit2/2earned
Has description1/1earned
Platform support declared (or universal)2/2earned
License declared1/1earned
Verified public repository2/2earned

Repository

https://github.com/swamp-club/swamp-extensions

06Platforms

linux · x86_64 linux · aarch64 macOS · x86_64 macOS · aarch64

07Labels

#gcp #google-cloud #networksecurity #cloud #infrastructure