create

{              
  "metadata": {                // [required]
    "labels": {                // [map]
                               // Labels associated with the resource.
      string: string                  
    },
    "name": string,            // Human readable name for the resource.
    "parent_id": string,       // [required]
                               // Identifier of the parent resource to which the resource belongs.
    "resource_version": int64  // Version of the resource for safe concurrent modifications and consistent reads.
                               // Positive and monotonically increases on each resource spec change (but *not* on each change of the
                               // resource's container(s) or status).
                               // Service allows zero value or current.
  },
  "spec": {            // [required]
    "access": enum(         // [required] [immutable]
                            // Access action for the rule.
                            // Required. Determines whether matching traffic is allowed or denied.
      "ACCESS_UNSPECIFIED",
      "ALLOW",             
      "DENY"               
    ),
    "egress": {                                // [immutable]
                                               // Cannot be set together with: ingress
      "destination_cidrs": [string],           // CIDR blocks as the destination.
                                               // Optional. Empty list means any address.
                                               // Must be a valid IPv4.
                                               // Maximum of 8 CIDRs can be specified.
      "destination_ports": [int32],            // List of ports to which the rule applies.
                                               // Optional. Empty list means any port.
                                               // Valid range: 1–65535.
                                               // Maximum of 8 ports can be specified.
      "destination_security_group_id": string  // ID of the referenced Security Group as the destination.
    },
    "ingress": {                          // [immutable]
                                          // Cannot be set together with: egress
      "destination_ports": [int32],       // List of destination ports to which the rule applies.
                                          // Optional. Empty list means any port.
                                          // Valid range: 1–65535.
                                          // Maximum of 8 ports can be specified.
      "source_cidrs": [string],           // CIDR blocks as the source.
                                          // Optional. Empty list means any address.
                                          // Must be a valid IPv4
                                          // Maximum of 8 CIDRs can be specified.
      "source_security_group_id": string  // ID of the referenced Security Group as the source.
    },
    "priority": int32, // [immutable] [non_empty_default]
                       // Priority of the rule. Valid range: 0-1000.
                       // Optional. If not specified or set to 0, defaults to 500.
                       // Rules are evaluated in priority order (lower numbers first) using a first-match algorithm:
                       // only the first matching rule takes effect (ALLOW or DENY), and subsequent rules are skipped.
                       // 
                       // When multiple rules share the same priority, DENY rules are evaluated before ALLOW rules.
                       // The final evaluation order is reflected in 'effective_priority' (see SecurityRuleStatus).
    "protocol": enum(         // [required] [immutable]
                              // Protocol used in the rule.
                              // Supported values: ANY, TCP, UDP, ICMP.
      "PROTOCOL_UNSPECIFIED",
      "ANY",                 
      "TCP",                 
      "UDP",                 
      "ICMP"                 
    ),
    "type": enum(              // [immutable] [non_empty_default]
                               // Type of the rule (STATEFUL or STATELESS)
                               // Default value is STATEFUL.
      "RULE_TYPE_UNSPECIFIED",
      "STATEFUL",             
      "STATELESS"             
    )
  }
}