虽然您可以在 members 属性中添加身份，但 Google 建议您不要这样做。如需了解如何允许边界相互通信，请参阅入站规则和出站规则中的 identities。
# Attributes can be included in any order in the condition-devicePolicy:# Must include at least one of the following:allowedEncryptionStatuses:# Must include at least one of the following:-ENCRYPTION_UNSUPPORTED-ENCRYPTED-UNENCRYPTEDosConstraints:# Must include at least one of the following:-osType:DESKTOP_CHROME_OSminimumVersion:11316.165.0# minimumVersion must be formatted as x.x.xrequireVerifiedChromeOs:true-osType:DESKTOP_MAC-osType:DESKTOP_WINDOWS# minimumVersion is not requiredrequireScreenlock:true# requireScreenlock defaults to false if not includedrequireAdminApproval:true# requireAdminApproval defaults to false if not includedrequireCorpOwned:true# requireCorpOwned defaults to false if not includedipSubnetworks:# Must include one or more IPv4 and IPv6 CIDRs-252.0.2.0/24-2001:db8::/32regions:# Must include one or more regions as ISO 3166-1 alpha-2 codes-US-CH-SGrequiredAccessLevels:# Must include one or more existing access levels# Must be formatted as accessPolicies/policy-name/accessLevels/level-name-accessPolicies/247332951433/accessLevels/Device_Trustmembers:# Must include one or more valid IAM users or service accounts-user:exampleuser@example.com-serviceAccount:exampleaccount@example.iam.gserviceaccount.com
negate:true# negate is not required and can only be included with other attributes# If negate is included, none of the attributes included in the condition# can be true for the condition to be met.# You can include more than one condition in the .yaml file-ipSubnetworks:-176.0.2.0/24
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[[["\u003cp\u003eA \u003ccode\u003e.yaml\u003c/code\u003e file is required when creating or modifying access levels using the \u003ccode\u003egcloud\u003c/code\u003e command-line tool.\u003c/p\u003e\n"],["\u003cp\u003eConditions within the \u003ccode\u003e.yaml\u003c/code\u003e file must include at least one attribute, which can be combined with others using AND or NAND operations.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003edevicePolicy\u003c/code\u003e attribute requires at least one allowed encryption status and one os constraint, and can optionally include requirements such as screen lock, admin approval, and corporate ownership.\u003c/p\u003e\n"],["\u003cp\u003eOther attributes that can be specified include \u003ccode\u003eipSubnetworks\u003c/code\u003e, \u003ccode\u003eregions\u003c/code\u003e, and \u003ccode\u003erequiredAccessLevels\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eWhile \u003ccode\u003emembers\u003c/code\u003e can include identities, it is recommended to refer to ingress and egress rules for perimeter communication; you can use the \u003ccode\u003enegate\u003c/code\u003e attribute to invert the condition's requirement.\u003c/p\u003e\n"]]],[],null,["# Example YAML for an access level\n\nThe following example includes all attributes that can be specified when\nyou create a .yaml file for an access level. A .yaml file is only necessary\nif you are creating or modifying an access level using the `gcloud` command-line tool.\n| **Note:** Conditions must include at least one attribute. If they contain more than one attribute, the attributes can be combined as an **AND** operation (all must be true) or as a **NAND** operation (none can be true) to determine whether the condition is met. You can use any combination of attributes required for your use case. The comments provided for these attributes apply only if you include the attribute in your .yaml file.\n\nAlthough you can include identities in the `members` attribute, Google\nrecommends against doing so. See `identities` in [Ingress and egress\nrules](/vpc-service-controls/docs/ingress-egress-rules) for how to allow\nperimeters to communicate with each other. \n\n # Attributes can be included in any order in the condition\n - devicePolicy:\n # Must include at least one of the following:\n allowedEncryptionStatuses:\n # Must include at least one of the following:\n - ENCRYPTION_UNSUPPORTED\n - ENCRYPTED\n - UNENCRYPTED\n osConstraints:\n # Must include at least one of the following:\n - osType: DESKTOP_CHROME_OS\n minimumVersion: 11316.165.0\n # minimumVersion must be formatted as x.x.x\n requireVerifiedChromeOs: true\n - osType: DESKTOP_MAC\n - osType: DESKTOP_WINDOWS\n # minimumVersion is not required\n requireScreenlock: true\n # requireScreenlock defaults to false if not included\n requireAdminApproval: true\n # requireAdminApproval defaults to false if not included\n requireCorpOwned: true\n # requireCorpOwned defaults to false if not included\n ipSubnetworks:\n # Must include one or more IPv4 and IPv6 CIDRs\n - 252.0.2.0/24\n - 2001:db8::/32\n regions:\n # Must include one or more regions as ISO 3166-1 alpha-2 codes\n - US\n - CH\n - SG\n requiredAccessLevels:\n # Must include one or more existing access levels\n # Must be formatted as accessPolicies/policy-name/accessLevels/level-name\n - accessPolicies/247332951433/accessLevels/Device_Trust\n members:\n # Must include one or more valid IAM users or service accounts\n - user:exampleuser@example.com\n - serviceAccount:exampleaccount@example.iam.gserviceaccount.com\n negate: true\n # negate is not required and can only be included with other attributes\n # If negate is included, none of the attributes included in the condition\n # can be true for the condition to be met.\n\n # You can include more than one condition in the .yaml file\n - ipSubnetworks:\n - 176.0.2.0/24"]]
