SandboxEgressPolicy

The outbound network policy of one Pix sandbox: its egress mode and the hostnames allowed or denied, the same two things the console’s egress page sets. Egress is decided by hostname only, as the sandbox enforces it: a rule is a DNS name or a *. wildcard over one, never an address or a port. The hosts the sandbox needs for itself cannot be declared. A host decided in the console and left out of the document goes back to undecided on apply. Only an owner or admin can change it. Deleting the document resets the mode to inherit and every decision to undecided; the record of the hosts the sandbox reached stays.

apiVersion	vulnetix.com/v1
kind	SandboxEgressPolicy
Group	Pix
Status	Served. The config engine plans and applies it.
Objects per tenant	many, keyed by metadata.name
Token and role	An owner or admin session, or a vmt_ config management token with the owner or admin role that lists SandboxEgressPolicy in its kinds. See Management tokens.
Terraform resource	vulnetix_sandbox_egress_policy, imported by name (see Terraform and OpenTofu)
CLI	vulnetix config apply, CLI v3.168.0 and later.
Pinned schema	v1.15.0/SandboxEgressPolicy.schema.json
Newest schema	latest/SandboxEgressPolicy.schema.json
First released in	v1.6.0
Print the built-in copy	vulnetix config schema SandboxEgressPolicy

Minimal

Only the fields the kind requires. From examples/SandboxEgressPolicy/minimal.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/SandboxEgressPolicy.schema.json
apiVersion: vulnetix.com/v1
kind: SandboxEgressPolicy
metadata:
  name: dev-sandbox-egress
spec:
  sandbox: 3c9e1f2a-7b4d-4e6f-8a1b-2c3d4e5f6a7b

HCL (resource vulnetix_sandbox_egress_policy)

# Only the arguments the kind requires. From config-schemas examples/SandboxEgressPolicy/minimal.yaml.

resource "vulnetix_sandbox_egress_policy" "dev_sandbox_egress" {
  name    = "dev-sandbox-egress"
  sandbox = "3c9e1f2a-7b4d-4e6f-8a1b-2c3d4e5f6a7b"
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/SandboxEgressPolicy.schema.json
apiVersion: vulnetix.com/v1
kind: SandboxEgressPolicy
metadata:
  name: dev-sandbox-egress
spec:
  sandbox: 3c9e1f2a-7b4d-4e6f-8a1b-2c3d4e5f6a7b
EOF

Advanced

Every field the kind supports, with a when expression where it takes one. From examples/SandboxEgressPolicy/advanced.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/SandboxEgressPolicy.schema.json
apiVersion: vulnetix.com/v1
kind: SandboxEgressPolicy
metadata:
  name: dev-sandbox-egress
  annotations:
    ticket: https://tracker.example.com/SEC-88
spec:
  sandbox: 3c9e1f2a-7b4d-4e6f-8a1b-2c3d4e5f6a7b
  mode: deny_except_allow
  allow:
    - api.github.com
    - "*.githubusercontent.com"
    - registry.npmjs.org
  deny:
    - pastebin.com

HCL (resource vulnetix_sandbox_egress_policy)

# Every argument the kind supports. From config-schemas examples/SandboxEgressPolicy/advanced.yaml.

resource "vulnetix_sandbox_egress_policy" "dev_sandbox_egress" {
  name    = "dev-sandbox-egress"
  allow   = ["api.github.com", "*.githubusercontent.com", "registry.npmjs.org"]
  deny    = ["pastebin.com"]
  mode    = "deny_except_allow"
  sandbox = "3c9e1f2a-7b4d-4e6f-8a1b-2c3d4e5f6a7b"
  annotations = {
    ticket = "https://tracker.example.com/SEC-88"
  }
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/SandboxEgressPolicy.schema.json
apiVersion: vulnetix.com/v1
kind: SandboxEgressPolicy
metadata:
  name: dev-sandbox-egress
  annotations:
    ticket: https://tracker.example.com/SEC-88
spec:
  sandbox: 3c9e1f2a-7b4d-4e6f-8a1b-2c3d4e5f6a7b
  mode: deny_except_allow
  allow:
    - api.github.com
    - "*.githubusercontent.com"
    - registry.npmjs.org
  deny:
    - pastebin.com
EOF

Fields

Paths use dots for nesting and [] for the items of a list. Required means required whenever the parent object is present. A default is what the server uses when the field is left out.

Field	Type	Required	Default	Allowed values	Description
apiVersion	string	yes		exactly vulnetix.com/v1	The document format version. Every kind in this release is vulnetix.com/v1.
kind	string	yes		exactly SandboxEgressPolicy	Always SandboxEgressPolicy.
metadata	object	yes		no other keys
metadata.name	string	yes		pattern ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$	The object’s name, unique per kind within a tenant. It is the natural key: plan, apply, export and the Terraform provider all address an object by kind and name.
metadata.org	string	no		format uuid	The tenant (organization UUID) the document belongs to. When set, plan and apply refuse to run against any other tenant.
metadata.labels	object	no		map of string to string (length 0 to 256); keys match ^[a-z0-9]([a-z0-9._/-]{0,61}[a-z0-9])?$	Free key/value labels. Stored with the object, never interpreted by the server.
metadata.annotations	object	no		map of string to string (length 0 to 4096)	Free key/value notes for people and tools, such as a ticket link.
spec	object	yes		no other keys
spec.sandbox	string	yes		pattern ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$	The sandbox, by its id (a lower-case UUID), as the console’s sandbox page shows it.
spec.mode	string	no		allow_all_logged, deny_except_allow	allow_all_logged lets every host through and records it; deny_except_allow refuses every host not allowed. Left out, the product default.
spec.allow	array of string	no		0 to 500 items; items unique; each item: pattern ^(\*\.)?[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*\.[a-z][a-z0-9-]{0,61}$; length 0 to 253	Hosts allowed. With mode deny_except_allow, the only hosts reached.
spec.deny	array of string	no		0 to 500 items; items unique; each item: pattern ^(\*\.)?[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*\.[a-z][a-z0-9-]{0,61}$; length 0 to 253	Hosts refused whatever the mode.

Applying this kind

• Command. vulnetix config apply -f <file>; the CLI line above says from which release. Plan first with vulnetix config plan: it shows each object as create, update, delete or no change, with a planHash that apply then holds to. Apply writes in one transaction.
• Manager. Each object records the manager that applied it (terraform, console or gitops:<repo>). --prune deletes only objects its own manager owns. See The manager and the config engine.
• Status. Applied, Unchanged or Deleted, with no other status fields. The phases the engine reports are explained under status phases.

How apply treats it

• The mode plus hostname allow and deny lists. A host is a DNS name or a *. wildcard, never an address.
• A host decided in the console and left out of the document goes back to undecided. A system host cannot be declared.
• Owner or admin only. Delete resets the mode and every decision.

Terraform and OpenTofu

The resource is vulnetix_sandbox_egress_policy in the vulnetix/resolve provider. Its arguments are the spec in snake case, beside name, labels and annotations from metadata. The Minimal and Advanced HCL are above. The provider’s own reference is vulnetix_sandbox_egress_policy.

Import an object that already exists by its name:

# Import an existing SandboxEgressPolicy by its name (metadata.name).
terraform import vulnetix_sandbox_egress_policy.dev_sandbox_egress dev-sandbox-egress

Install, authentication and how state is read: Terraform and OpenTofu.

Check a file with vulnetix config validate -f <file>. See Validate documents. In an editor, start the file with the schema comment.