You configure Google Cloud Armor security policies and rules using API resources that
are part of the Compute Engine API and the Google Cloud CLI. This page lists
the API resources and Google Cloud CLI command groups that you use to configure
Cloud Armor.

- **Security policies**: Use to create security policies and rules.

  [gcloud](https://docs.cloud.google.com/sdk/gcloud/reference/compute/security-policies) \|
  [API](https://docs.cloud.google.com/compute/docs/reference/rest/v1/securityPolicies)
- **Hierarchical Security policies**: Use to create hierarchical security policies and rules.

  [gcloud](https://docs.cloud.google.com/sdk/gcloud/reference/compute/org-security-policies) \|
  [API](https://docs.cloud.google.com/compute/docs/reference/rest/v1/organizationSecurityPolicies)
- **Backend services**: Use to attach a security policy to a backend service.

  [gcloud](https://docs.cloud.google.com/sdk/gcloud/reference/compute/backend-services) \|
  [API](https://docs.cloud.google.com/compute/docs/reference/rest/v1/backendServices)

To learn how to write expressions in advanced match conditions for security
policy rules, see the
[Cloud Armor custom rules language reference](https://docs.cloud.google.com/armor/docs/create-security-policy-rules).