Request-level conditions
Request-level conditions let you restrict a rule based on attributes of the request itself: the IP address it comes from, its user agent, or the time it is made.
Request-level conditions are built using CEL expressions. See Understanding policy conditions for the general concepts, operators, and logical operators shared by all condition types.
Variables
| Name | Type | Description |
|---|---|---|
request.ip | String | The IP address of the request. Only public IP addresses are currently supported for request.ip conditions; private IP addresses are not supported. |
request.time | google.protobuf.Timestamp | The time of the request. Represented as a Protobuf object, allowing usage with associated functions (External link). |
request.user_agent | String | The user-agent of the request. Truncated at 255 characters max. |
Expression examples
User-agent conditions
In the example below we check if the user-agent contains the term "Terraform":
request.user_agent.contains("terraform/")Time conditions
To only allow actions within a specific time slot, use CEL expressions with the request.time variable. The following examples demonstrate common use cases.
Allow requests on weekdays during business hours
To allow requests only on weekdays (Monday to Friday) between 8 AM and 4:59 PM in the Europe/Paris timezone, use the following expression:
request.time.getDayOfWeek() != 0 && request.time.getDayOfWeek() != 6
&& request.time.getHours("Europe/Paris") < 17
&& request.time.getHours("Europe/Paris") >= 8Allow requests on weekends only
To allow requests performed over the weekend only (Saturday and Sunday), use the following expression:
request.time.getDayOfWeek() == 0 || request.time.getDayOfWeek() == 6