public sealed class ServicePerimeter : IMessage<ServicePerimeter>, IEquatable<ServicePerimeter>, IDeepCloneable<ServicePerimeter>, IBufferMessage, IMessage
Reference documentation and code samples for the Identity Access Context Manager v1 API class ServicePerimeter.
ServicePerimeter describes a set of Google Cloud resources which can freely
import and export data amongst themselves, but not export outside of the
ServicePerimeter. If a request with a source within this ServicePerimeter
has a target outside of the ServicePerimeter, the request will be blocked.
Otherwise the request is allowed. There are two types of Service Perimeter -
Regular and Bridge. Regular Service Perimeters cannot overlap, a single
Google Cloud project can only belong to a single regular Service Perimeter.
Service Perimeter Bridges can contain only Google Cloud projects as members,
a single Google Cloud project may belong to multiple Service Perimeter
Bridges.
Required. Resource name for the ServicePerimeter. The short_name
component must begin with a letter and only include alphanumeric and '_'.
Format:
accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}
public ServicePerimeter.Types.PerimeterType PerimeterType { get; set; }
Perimeter type indicator. A single project is
allowed to be a member of single regular perimeter, but multiple service
perimeter bridges. A project cannot be a included in a perimeter bridge
without being included in regular perimeter. For perimeter bridges,
the restricted service list as well as access level lists must be
empty.
Proposed (or dry run) ServicePerimeter configuration. This configuration
allows to specify and test ServicePerimeter configuration without enforcing
actual access restrictions. Only allowed to be set when the
"use_explicit_dry_run_spec" flag is set.
public ServicePerimeterConfig Status { get; set; }
Current ServicePerimeter configuration. Specifies sets of resources,
restricted services and access levels that determine perimeter
content and boundaries.
Use explicit dry run spec flag. Ordinarily, a dry-run spec implicitly
exists for all Service Perimeters, and that spec is identical to the
status for those Service Perimeters. When this flag is set, it inhibits the
generation of the implicit spec, thereby allowing the user to explicitly
provide a configuration ("spec") to use in a dry-run version of the Service
Perimeter. This allows the user to test changes to the enforced config
("status") without actually enforcing them. This testing is done through
analyzing the differences between currently enforced and suggested
restrictions. use_explicit_dry_run_spec must bet set to True if any of the
fields in the spec are set to non-default values.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Missing the information I need","missingTheInformationINeed","thumb-down"],["Too complicated / too many steps","tooComplicatedTooManySteps","thumb-down"],["Out of date","outOfDate","thumb-down"],["Samples / code issue","samplesCodeIssue","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-07 UTC."],[[["\u003cp\u003eThe latest version of the \u003ccode\u003eServicePerimeter\u003c/code\u003e API is 2.5.0, with older versions available for reference, ranging back to version 1.2.0.\u003c/p\u003e\n"],["\u003cp\u003e\u003ccode\u003eServicePerimeter\u003c/code\u003e describes a set of Google Cloud resources that can freely exchange data among themselves but are restricted from exporting data outside of the perimeter.\u003c/p\u003e\n"],["\u003cp\u003eThere are two types of \u003ccode\u003eServicePerimeters\u003c/code\u003e: Regular, which cannot overlap and allows only one regular perimeter per project, and Bridge, which can contain multiple projects and allow a single project to belong to multiple perimeter bridges.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003eServicePerimeter\u003c/code\u003e class includes properties such as \u003ccode\u003eCreateTime\u003c/code\u003e, \u003ccode\u003eDescription\u003c/code\u003e, \u003ccode\u003eName\u003c/code\u003e, \u003ccode\u003ePerimeterType\u003c/code\u003e, \u003ccode\u003eStatus\u003c/code\u003e, \u003ccode\u003eSpec\u003c/code\u003e, \u003ccode\u003eTitle\u003c/code\u003e, and \u003ccode\u003eUpdateTime\u003c/code\u003e to define the perimeter and its configuration, with methods and documentation available for each.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003eUseExplicitDryRunSpec\u003c/code\u003e flag enables users to define a distinct dry-run configuration, allowing them to test changes without enforcing them by analyzing the differences between the current and proposed restrictions.\u003c/p\u003e\n"]]],[],null,["# Identity Access Context Manager v1 API - Class ServicePerimeter (2.5.0)\n\nVersion latestkeyboard_arrow_down\n\n- [2.5.0 (latest)](/dotnet/docs/reference/Google.Identity.AccessContextManager.V1/latest/Google.Identity.AccessContextManager.V1.ServicePerimeter)\n- [2.4.0](/dotnet/docs/reference/Google.Identity.AccessContextManager.V1/2.4.0/Google.Identity.AccessContextManager.V1.ServicePerimeter)\n- [2.3.0](/dotnet/docs/reference/Google.Identity.AccessContextManager.V1/2.3.0/Google.Identity.AccessContextManager.V1.ServicePerimeter)\n- [2.2.0](/dotnet/docs/reference/Google.Identity.AccessContextManager.V1/2.2.0/Google.Identity.AccessContextManager.V1.ServicePerimeter)\n- [2.1.0](/dotnet/docs/reference/Google.Identity.AccessContextManager.V1/2.1.0/Google.Identity.AccessContextManager.V1.ServicePerimeter)\n- [2.0.0](/dotnet/docs/reference/Google.Identity.AccessContextManager.V1/2.0.0/Google.Identity.AccessContextManager.V1.ServicePerimeter)\n- [1.5.0](/dotnet/docs/reference/Google.Identity.AccessContextManager.V1/1.5.0/Google.Identity.AccessContextManager.V1.ServicePerimeter)\n- [1.4.0](/dotnet/docs/reference/Google.Identity.AccessContextManager.V1/1.4.0/Google.Identity.AccessContextManager.V1.ServicePerimeter)\n- [1.3.0](/dotnet/docs/reference/Google.Identity.AccessContextManager.V1/1.3.0/Google.Identity.AccessContextManager.V1.ServicePerimeter)\n- [1.2.0](/dotnet/docs/reference/Google.Identity.AccessContextManager.V1/1.2.0/Google.Identity.AccessContextManager.V1.ServicePerimeter) \n\n public sealed class ServicePerimeter : IMessage\u003cServicePerimeter\u003e, IEquatable\u003cServicePerimeter\u003e, IDeepCloneable\u003cServicePerimeter\u003e, IBufferMessage, IMessage\n\nReference documentation and code samples for the Identity Access Context Manager v1 API class ServicePerimeter.\n\n`ServicePerimeter` describes a set of Google Cloud resources which can freely\nimport and export data amongst themselves, but not export outside of the\n`ServicePerimeter`. If a request with a source within this `ServicePerimeter`\nhas a target outside of the `ServicePerimeter`, the request will be blocked.\nOtherwise the request is allowed. There are two types of Service Perimeter -\nRegular and Bridge. Regular Service Perimeters cannot overlap, a single\nGoogle Cloud project can only belong to a single regular Service Perimeter.\nService Perimeter Bridges can contain only Google Cloud projects as members,\na single Google Cloud project may belong to multiple Service Perimeter\nBridges. \n\nInheritance\n-----------\n\n[object](https://learn.microsoft.com/dotnet/api/system.object) \\\u003e ServicePerimeter \n\nImplements\n----------\n\n[IMessage](https://cloud.google.com/dotnet/docs/reference/Google.Protobuf/latest/Google.Protobuf.IMessage-1.html)[ServicePerimeter](/dotnet/docs/reference/Google.Identity.AccessContextManager.V1/latest/Google.Identity.AccessContextManager.V1.ServicePerimeter), [IEquatable](https://learn.microsoft.com/dotnet/api/system.iequatable-1)[ServicePerimeter](/dotnet/docs/reference/Google.Identity.AccessContextManager.V1/latest/Google.Identity.AccessContextManager.V1.ServicePerimeter), [IDeepCloneable](https://cloud.google.com/dotnet/docs/reference/Google.Protobuf/latest/Google.Protobuf.IDeepCloneable-1.html)[ServicePerimeter](/dotnet/docs/reference/Google.Identity.AccessContextManager.V1/latest/Google.Identity.AccessContextManager.V1.ServicePerimeter), [IBufferMessage](https://cloud.google.com/dotnet/docs/reference/Google.Protobuf/latest/Google.Protobuf.IBufferMessage.html), [IMessage](https://cloud.google.com/dotnet/docs/reference/Google.Protobuf/latest/Google.Protobuf.IMessage.html) \n\nInherited Members\n-----------------\n\n[object.GetHashCode()](https://learn.microsoft.com/dotnet/api/system.object.gethashcode) \n[object.GetType()](https://learn.microsoft.com/dotnet/api/system.object.gettype) \n[object.ToString()](https://learn.microsoft.com/dotnet/api/system.object.tostring)\n\nNamespace\n---------\n\n[Google.Identity.AccessContextManager.V1](/dotnet/docs/reference/Google.Identity.AccessContextManager.V1/latest/Google.Identity.AccessContextManager.V1)\n\nAssembly\n--------\n\nGoogle.Identity.AccessContextManager.V1.dll\n\nConstructors\n------------\n\n### ServicePerimeter()\n\n public ServicePerimeter()\n\n### ServicePerimeter(ServicePerimeter)\n\n public ServicePerimeter(ServicePerimeter other)\n\nProperties\n----------\n\n### CreateTime\n\n public Timestamp CreateTime { get; set; }\n\nOutput only. Time the `ServicePerimeter` was created in UTC.\n\n### Description\n\n public string Description { get; set; }\n\nDescription of the `ServicePerimeter` and its use. Does not affect\nbehavior.\n\n### Name\n\n public string Name { get; set; }\n\nRequired. Resource name for the ServicePerimeter. The `short_name`\ncomponent must begin with a letter and only include alphanumeric and '_'.\nFormat:\n`accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}`\n\n### PerimeterType\n\n public ServicePerimeter.Types.PerimeterType PerimeterType { get; set; }\n\nPerimeter type indicator. A single project is\nallowed to be a member of single regular perimeter, but multiple service\nperimeter bridges. A project cannot be a included in a perimeter bridge\nwithout being included in regular perimeter. For perimeter bridges,\nthe restricted service list as well as access level lists must be\nempty.\n\n### ServicePerimeterName\n\n public ServicePerimeterName ServicePerimeterName { get; set; }\n\n[ServicePerimeterName](/dotnet/docs/reference/Google.Identity.AccessContextManager.V1/latest/Google.Identity.AccessContextManager.V1.ServicePerimeterName)-typed view over the [Name](/dotnet/docs/reference/Google.Identity.AccessContextManager.V1/latest/Google.Identity.AccessContextManager.V1.ServicePerimeter#Google_Identity_AccessContextManager_V1_ServicePerimeter_Name) resource name property.\n\n### Spec\n\n public ServicePerimeterConfig Spec { get; set; }\n\nProposed (or dry run) ServicePerimeter configuration. This configuration\nallows to specify and test ServicePerimeter configuration without enforcing\nactual access restrictions. Only allowed to be set when the\n\"use_explicit_dry_run_spec\" flag is set.\n\n### Status\n\n public ServicePerimeterConfig Status { get; set; }\n\nCurrent ServicePerimeter configuration. Specifies sets of resources,\nrestricted services and access levels that determine perimeter\ncontent and boundaries.\n\n### Title\n\n public string Title { get; set; }\n\nHuman readable title. Must be unique within the Policy.\n\n### UpdateTime\n\n public Timestamp UpdateTime { get; set; }\n\nOutput only. Time the `ServicePerimeter` was updated in UTC.\n\n### UseExplicitDryRunSpec\n\n public bool UseExplicitDryRunSpec { get; set; }\n\nUse explicit dry run spec flag. Ordinarily, a dry-run spec implicitly\nexists for all Service Perimeters, and that spec is identical to the\nstatus for those Service Perimeters. When this flag is set, it inhibits the\ngeneration of the implicit spec, thereby allowing the user to explicitly\nprovide a configuration (\"spec\") to use in a dry-run version of the Service\nPerimeter. This allows the user to test changes to the enforced config\n(\"status\") without actually enforcing them. This testing is done through\nanalyzing the differences between currently enforced and suggested\nrestrictions. use_explicit_dry_run_spec must bet set to True if any of the\nfields in the spec are set to non-default values."]]
