Reviewing connection requests

Reviewing connection requests in the UI

To triage incoming connection requests in the IBM Cloud console, follow these steps:

1. From your browser, open the IBM Cloud console and log in to your account.
2. Select the Navigation Menu , then click Infrastructure > Network > Private Path services.
3. In the Private Path services for VPC table, click the name of a Private Path service to show its details page.
4. Scroll to the Connections section to review connection requests. Click the Actions menu and select an option to permit, deny, or revoke the connection request. After you select an option, you are prompted to confirm your choice, and optionally create an account policy for the account ID.

The consumer associated with the account ID is notified of your action. If permitted, the consumer can now access your service.

Connection requests expire after 30 days.

Reviewing connection requests from the CLI

The following examples show how to use the CLI to permit or deny an account-specific connection request.

Before you begin, make sure to set up your CLI environment.

You must first export the feature flag to use the CLI for Private Path beta release offerings.

To export the feature flag, enter the following commands:

export IBMCLOUD_IS_FEATURE_PRIVATE_PATH_SERVICE_GATEWAY=true
export IBMCLOUD_IS_FEATURE_PP_NLB_SUPPORT=true

ibmcloud is private-path-service-gateway-endpoint-gateway-binding-permit PRIVATE_PATH_SERVICE_GATEWAY ENDPOINT_GATEWAY_BINDING
    (--set-account-policy true | false)
    [--output JSON] [-q, --quiet]

ibmcloud is private-path-service-gateway-endpoint-gateway-binding-deny PRIVATE_PATH_SERVICE_GATEWAY ENDPOINT_GATEWAY_BINDING
    (--set-account-policy true | false)
    [--output JSON] [-q, --quiet]

Reviewing connection requests with the API

To triage incoming connection requests with the API, follow these steps:

1. Set up your API environment.

2. Store the following values in variables to be used in the API command:

   • ppsgId - Get your Private Path service and then populate the variable:

     export ppsgId=<your_ppsg_id>
     

   • egwBindingId - Get your VPE gateway binding and then populate the variable:

     export egwbId=<your_endpoint_gateway_binding_id>
     

The following example shows how to use the API to permit, deny, or revoke an account-specific connection request:

1. To permit a connection request:

   curl -X POST -sH "Authorization:${iam_token}" \
   "$vpc_api_endpoint/v1/private_path_service_gateways/{ppsgId}/endpoint_gateway_bindings/{egwBindingId}/permit?version=$api_version&generation=2" \
   -d {
     "set_account_policy": true
   }'
   

If set_account_policy is set to true:

• If the account has an existing access policy, that policy is updated to permit access. Otherwise, a new permit access policy is created for the account.
• All pending VPE gateway bindings for the account are permitted.

2. To deny a connection request:

   curl -X POST -sH "Authorization:${iam_token}" \
   "$vpc_api_endpoint/v1/private_path_service_gateways/{ppsgId}/endpoint_gateway_bindings/{egwBindingId}/deny?version=$api_version&generation=2" \
   -d {
     "set_account_policy": true
   }'
   

If set_account_policy is set to true:

• If the account has an existing access policy, that policy is updated to deny the request. Otherwise, a new permit access policy is created for the account.
• All pending VPE gateway bindings for the account are denied.

3. To revoke an account:

   • accountId - Get consumer account ID and then populate the variable:

     export accountId=<consumer_account_id>
     

   • Run this command to revoke the account:

     curl -X POST -sH "Authorization:${iam_token}" \
     "$vpc_api_endpoint/v1/private_path_service_gateways/{ppsgId}?version=$api_version&generation=2" \
     -d {
       "account": {
         "id": "$accountId"
       }
     }'
     

Reviewing connection requests with Terraform

Terraform will support this feature after it reaches General Availability (GA) and is officially released.

The following example permits an endpoint gateway binding to a Private Path network by using Terraform:

resource "ibm_is_private_path_service_gateway_endpoint_gateway_binding_operations" "policy" {
  access_policy = "permit"
  endpoint_gateway_binding = data.ibm_is_private_path_service_gateway_endpoint_gateway_bindings.ppsgEGWBindings.endpoint_gateway_bindings.0.id
  private_path_service_gateway = ibm_is_private_path_service_gateway.example.id
}

The following example denies an endpoint gateway binding to a Private Path network by using Terraform:

resource "ibm_is_private_path_service_gateway_endpoint_gateway_binding_operations" "policy" {
  count = length(data.ibm_is_private_path_service_gateway_endpoint_gateway_bindings.bindings.endpoint_gateway_bindings)
  access_policy = "deny"
  endpoint_gateway_binding = data.ibm_is_private_path_service_gateway_endpoint_gateway_bindings.bindings.endpoint_gateway_bindings[count.index].id
  private_path_service_gateway = ibm_is_private_path_service_gateway.ppsg.id
}