To secure your resources with certificate-based access, create an access level that requires certificates when
determining access to resources. To create access levels, see
[Creating a custom access level](https://docs.cloud.google.com/access-context-manager/docs/create-custom-access-level.md.txt).

The values you use when creating a custom access level can be whatever makes
sense for you, but the expression for the custom access level must be:

```bash
certificateBindingState(origin, device) == CertificateBindingState.CERT_MATCHES_EXISTING_DEVICE
```

For example, you can use the gcloud CLI to create your custom
access level by running the following command:

```bash
gcloud access-context-manager levels create LEVEL_NAME \
  --title=TITLE \
  --custom-level-spec=FILE \
  --description=DESCRIPTION \
  --policy=POLICY_NAME
```

The content of the .yaml file referenced by `FILE` is the
following custom expression:

    expression: "certificateBindingState(origin, device) == CertificateBindingState.CERT_MATCHES_EXISTING_DEVICE"

## What's next

- [Enable CBA with VPC Service Controls](https://docs.cloud.google.com/access-context-manager/docs/enable-cba-vpcsc.md.txt)
- [Enable CBA with user groups](https://docs.cloud.google.com/access-context-manager/docs/enable-cba-user-groups.md.txt)