# The AccountNetworkPolicy object

## Attributes

- `network_policy_id` (string)
  The unique identifier for the network policy.
  Example: `example-policy-name`
  Constraints: `^[a-zA-Z0-9_.-]{1,32}$`
- `account_id` (string)
  The associated account ID for this Network Policy object.
  Example: `123e4567-e89b-12d3-a456-426614174000`
- `egress` (object)
  The network policies applying for egress traffic.
  - `network_access` (object)
    The access policy enforced for egress traffic to the internet.
    - `restriction_mode` (string)
      The restriction mode that controls how serverless workloads can access the internet.
      Possible values: `RESTRICTION_MODE_UNSPECIFIED`, `FULL_ACCESS`, `RESTRICTED_ACCESS`
      Example: `RESTRICTED_ACCESS`
    - `allowed_internet_destinations` (array of object)
      List of internet destinations that serverless workloads are allowed to access when in RESTRICTED_ACCESS mode.
      - `destination` (string)
        The internet destination to which access will be allowed. Format dependent on the destination type.
        Example: `example.dest.domain.com`
      - `internet_destination_type` (string)
        The type of internet destination. Currently only DNS_NAME is supported.
        Possible values: `INTERNET_DESTINATION_TYPE_UNSPECIFIED`, `DNS_NAME`
        Example: `DNS_NAME`
    - `allowed_storage_destinations` (array of object)
      List of storage destinations that serverless workloads are allowed to access when in RESTRICTED_ACCESS mode.
      - `bucket_name` (string)
        **AWS:** The name of the S3 storage bucket.
        **GCP:** The name of the GGS bucket or S3 storage bucket for cross-cloud access to AWS S3.
        Example: `my-cloud-storage`
      - `region` (string)
        **AWS:** The region in which the S3 bucket is located.
        **GCP:** The AWS region in which the cross-cloud S3 bucket is located.
        Example: `us-west-1`
      - `storage_destination_type` (string)
        The type of storage destination.
        **GCP:** In addition to GOOGLE_CLOUD_STORAGE, AWS_S3 can be used for cross-cloud access
        Possible values: `STORAGE_DESTINATION_TYPE_UNSPECIFIED`, `AWS_S3`, `AZURE_STORAGE`, `GOOGLE_CLOUD_STORAGE`
        Example: `AWS_S3`
      - `azure_storage_account` (string)
        The Azure storage account name.
        Example: `example`
      - `azure_storage_service` (string)
        The Azure storage service type (blob, dfs, etc.).
        Example: `blob`
    - `policy_enforcement` (object)
      Optional. When policy_enforcement is not provided, we default to ENFORCE_MODE_ALL_SERVICES
      - `enforcement_mode` (string)
        The mode of policy enforcement. ENFORCED blocks traffic that violates policy,
         while DRY_RUN only logs violations without blocking. When not specified,
         defaults to ENFORCED.
        Possible values: `ENFORCEMENT_MODE_UNSPECIFIED`, `ENFORCED`, `DRY_RUN`
        Example: `DRY_RUN`
      - `dry_run_mode_product_filter` (array of string)
        When empty, it means dry run for all products.
         When non-empty, it means dry run for specific products and for the other products, they will run in enforced mode.
        Possible values: `DRY_RUN_MODE_PRODUCT_FILTER_UNSPECIFIED`, `DBSQL`, `ML_SERVING`
        Example: `DBSQL`
    - `blocked_internet_destinations` (array of object, Beta)
      List of internet destinations that serverless workloads are blocked from accessing.
       These destinations are enforced when restriction mode is RESTRICTED_ACCESS or DRY_RUN.
       Currently supports DNS_NAME type only; IP_RANGE support is planned.
      - `destination` (string)
        The internet destination to which access will be allowed. Format dependent on the destination type.
        Example: `example.dest.domain.com`
      - `internet_destination_type` (string)
        The type of internet destination. Currently only DNS_NAME is supported.
        Possible values: `INTERNET_DESTINATION_TYPE_UNSPECIFIED`, `DNS_NAME`
        Example: `DNS_NAME`
- `ingress` (object)
  The network policies applying for ingress traffic.
  - `public_access` (object)
    The network policy restrictions for public access to the workspace.
     Configures how public internet traffic is allowed or denied access.
    - `restriction_mode` (string)
      Possible values: `FULL_ACCESS`, `RESTRICTED_ACCESS`
      Example: `RESTRICTED_ACCESS`
    - `deny_rules` (array of object)
      - `origin` (object)
      - `destination` (object)
      - `authentication` (object)
      - `label` (string)
        The label for this ingress rule.
        Constraints: `<= 255 characters`
    - `allow_rules` (array of object)
      - `origin` (object)
      - `destination` (object)
      - `authentication` (object)
      - `label` (string)
        The label for this ingress rule.
        Constraints: `<= 255 characters`
  - `private_access` (object, Beta)
    The network policy restrictions for private access.
     Configures how requests arriving over private connectivity are governed.
    - `restriction_mode` (string, Beta)
      The restriction mode for private access.
      Possible values: `ALLOW_ALL_REGISTERED_ENDPOINTS`, `RESTRICTED_ACCESS`
      Example: `ALLOW_ALL_REGISTERED_ENDPOINTS`
    - `deny_rules` (array of object, Beta)
      Deny rules are evaluated first. A request matching any deny rule is denied,
       regardless of allow rules. Only applies when restriction_mode is RESTRICTED_ACCESS.
      - `origin` (object, Beta)
        The origin the request must match — the private connectivity the request arrives
         through, for example a specific set of registered endpoints or any endpoint
         registered to the account. See PrivateRequestOrigin.
      - `destination` (object, Beta)
        The destination the request must match — the resource being accessed, for example
         the workspace UI, workspace APIs, or account-level APIs. See RequestDestination.
      - `authentication` (object, Beta)
        The authenticated identity the request must match. When unset, the rule matches
         all users and service principals.
         On the account-level network policy, scoping to specific identities is not
         currently supported, so this field must be unset (the rule matches all users
         and service principals).
      - `label` (string, Beta)
        The label for this ingress rule.
        Constraints: `<= 255 characters`
    - `allow_rules` (array of object, Beta)
      Allow rules are evaluated after deny rules. A request matching any allow rule is
       allowed; a request matching no rule is denied by default. Only applies when
       restriction_mode is RESTRICTED_ACCESS.
      **Azure:** Allow rules are evaluated after deny rules. A request matching any allow rule is
      allowed; a request matching no rule is denied by default. Only applies when
      restriction_mode is RESTRICTED_ACCESS.
      Requests arriving through the workspace's Azure Private Link
      (ui-api) endpoints are allowed even without a matching allow rule, unless
      explicitly denied by a deny rule whose origin is azure_workspace_private_link
      or all_private_access.
      - `origin` (object, Beta)
        The origin the request must match — the private connectivity the request arrives
         through, for example a specific set of registered endpoints or any endpoint
         registered to the account. See PrivateRequestOrigin.
      - `destination` (object, Beta)
        The destination the request must match — the resource being accessed, for example
         the workspace UI, workspace APIs, or account-level APIs. See RequestDestination.
      - `authentication` (object, Beta)
        The authenticated identity the request must match. When unset, the rule matches
         all users and service principals.
         On the account-level network policy, scoping to specific identities is not
         currently supported, so this field must be unset (the rule matches all users
         and service principals).
      - `label` (string, Beta)
        The label for this ingress rule.
        Constraints: `<= 255 characters`
- `ingress_dry_run` (object)
  The ingress policy for dry run mode. Dry run will always run even if the request
   is allowed by the ingress policy. When this field is set, the policy will be evaluated
   and emit logs only without blocking requests.
  - `public_access` (object)
    The network policy restrictions for public access to the workspace.
     Configures how public internet traffic is allowed or denied access.
    - `restriction_mode` (string)
      Possible values: `FULL_ACCESS`, `RESTRICTED_ACCESS`
      Example: `RESTRICTED_ACCESS`
    - `deny_rules` (array of object)
      - `origin` (object)
      - `destination` (object)
      - `authentication` (object)
      - `label` (string)
        The label for this ingress rule.
        Constraints: `<= 255 characters`
    - `allow_rules` (array of object)
      - `origin` (object)
      - `destination` (object)
      - `authentication` (object)
      - `label` (string)
        The label for this ingress rule.
        Constraints: `<= 255 characters`
  - `private_access` (object, Beta)
    The network policy restrictions for private access.
     Configures how requests arriving over private connectivity are governed.
    - `restriction_mode` (string, Beta)
      The restriction mode for private access.
      Possible values: `ALLOW_ALL_REGISTERED_ENDPOINTS`, `RESTRICTED_ACCESS`
      Example: `ALLOW_ALL_REGISTERED_ENDPOINTS`
    - `deny_rules` (array of object, Beta)
      Deny rules are evaluated first. A request matching any deny rule is denied,
       regardless of allow rules. Only applies when restriction_mode is RESTRICTED_ACCESS.
      - `origin` (object, Beta)
        The origin the request must match — the private connectivity the request arrives
         through, for example a specific set of registered endpoints or any endpoint
         registered to the account. See PrivateRequestOrigin.
      - `destination` (object, Beta)
        The destination the request must match — the resource being accessed, for example
         the workspace UI, workspace APIs, or account-level APIs. See RequestDestination.
      - `authentication` (object, Beta)
        The authenticated identity the request must match. When unset, the rule matches
         all users and service principals.
         On the account-level network policy, scoping to specific identities is not
         currently supported, so this field must be unset (the rule matches all users
         and service principals).
      - `label` (string, Beta)
        The label for this ingress rule.
        Constraints: `<= 255 characters`
    - `allow_rules` (array of object, Beta)
      Allow rules are evaluated after deny rules. A request matching any allow rule is
       allowed; a request matching no rule is denied by default. Only applies when
       restriction_mode is RESTRICTED_ACCESS.
      **Azure:** Allow rules are evaluated after deny rules. A request matching any allow rule is
      allowed; a request matching no rule is denied by default. Only applies when
      restriction_mode is RESTRICTED_ACCESS.
      Requests arriving through the workspace's Azure Private Link
      (ui-api) endpoints are allowed even without a matching allow rule, unless
      explicitly denied by a deny rule whose origin is azure_workspace_private_link
      or all_private_access.
      - `origin` (object, Beta)
        The origin the request must match — the private connectivity the request arrives
         through, for example a specific set of registered endpoints or any endpoint
         registered to the account. See PrivateRequestOrigin.
      - `destination` (object, Beta)
        The destination the request must match — the resource being accessed, for example
         the workspace UI, workspace APIs, or account-level APIs. See RequestDestination.
      - `authentication` (object, Beta)
        The authenticated identity the request must match. When unset, the rule matches
         all users and service principals.
         On the account-level network policy, scoping to specific identities is not
         currently supported, so this field must be unset (the rule matches all users
         and service principals).
      - `label` (string, Beta)
        The label for this ingress rule.
        Constraints: `<= 255 characters`

## Example

```json
{
  "network_policy_id": "example-policy-name",
  "account_id": "123e4567-e89b-12d3-a456-426614174000",
  "egress": {
    "network_access": {}
  },
  "ingress": {
    "public_access": {},
    "private_access": {}
  },
  "ingress_dry_run": {
    "public_access": {},
    "private_access": {}
  }
}
```