Manage Cloud Armor security policies

This page describes how to manage Google Cloud Armor security policies to filter incoming traffic to your application. Cloud Armor security policies help protect your web applications and services from distributed denial-of-service (DDoS) attacks and other threats from the internet. Enforcing a strong security posture requires managing your security policies through updating, testing, attaching to backend services, and exporting or importing.

To create or view security policies, see Create and view Cloud Armor security policies. To manage rules within a security policy, see Manage Cloud Armor security policy rules.

Manage security policies

The following sections describe how you can update, delete, or test your security policies.

Update security policies

The steps in this section describe how you can update a Cloud Armor security policy. You can modify the policy's description, modify the default rule, change the target backend service, or add rules.

Console

  1. In the Google Cloud console, go to the Cloud Armor policies page.

    Go to Cloud Armor policies

  2. Find the name of the policy that you want to update in the list of policies and click Menu for that policy.

    • To update the description or the default rule action, select Edit, make your changes, and then click Update.
    • To add a rule, select Add rule, and then follow the steps in Add rules to a security policy.
    • To replace the target backend service, select Apply policy to target, click Add Target, select a target, and then click Add.

gcloud

To update a security policy, use the following Google Cloud CLI steps:

Delete security policies

This section describes how you can delete a Cloud Armor security policy. Remove all backend services from the policy before you delete it.

Console

  1. In the Google Cloud console, go to the Cloud Armor policies page.

    Go to Cloud Armor policies

  2. Select the checkbox next to the policy that you want to delete.

  3. In the upper-right corner of the page, click Delete.

gcloud

Use gcloud compute security-policies delete NAME. Replace NAME with the name of the security policy:

gcloud compute security-policies delete NAME

Test security policies

We recommend that you deploy all new rules in preview mode, then examine your request logs, to verify that the policies and rules are behaving as expected.

Attach and remove security policies

The following sections describe how you can attach and remove security policies.

Attach a security policy to a backend service

Follow the steps in this section to attach a Cloud Armor security policy to a backend service. You can attach a security policy to multiple backend services, but a backend service can have only one of each type of security policy attached to it.

Console

  1. In the Google Cloud console, go to the Cloud Armor policies page.

    Go to Cloud Armor policies

  2. Click the name of the security policy to open the Policy details page.

  3. In the middle of the page, click the Targets tab.

  4. Click Apply policy to new target.

  5. Click Add Target.

  6. In the Target list, select a target, and then click Add.

gcloud

When you attach a backend security policy to a backend service, use the gcloud compute backend-services command and the --security-policy flag:

gcloud compute backend-services update my-backend \
    --security-policy my-policy

When you attach an edge security policy to a backend service, use the gcloud compute backend-services command and the --edge-security-policy flag:

gcloud compute backend-services update my-backend \
    --edge-security-policy my-policy

Remove a security policy from a backend service

Follow the steps in this section to remove a Cloud Armor security policy from a backend service.

Console

  1. In the Google Cloud console, go to the Cloud Armor policies page.

    Go to Cloud Armor policies

  2. Click the name of the security policy to open the Policy details page.

  3. In the middle of the page, click the Targets tab.

  4. Select the target backend service that you're removing the policy from.

  5. Click Remove.

  6. In the Remove target message, click Remove.

gcloud

When you remove a backend security policy, use the gcloud compute backend-services command and the --security-policy flag:

gcloud compute backend-services update my-backend \
    --security-policy ""

When you remove an edge security policy, use the gcloud compute backend-services command and the --edge-security-policy flag:

gcloud compute backend-services update my-backend \
    --edge-security-policy ""

Attach a security policy to a backend bucket

Follow the steps in this section to attach a Cloud Armor edge security policy to a backend bucket. You can attach an edge security policy to multiple backend buckets.

Console

  1. In the Google Cloud console, go to the Cloud Armor policies page.

    Go to Cloud Armor policies

  2. Click the name of the security policy to open the Policy details page.

  3. In the middle of the page, click the Targets tab.

  4. Click Apply policy to new target.

  5. Click Add Target.

  6. In the Target list, select a target, and then click Add.

gcloud

When you attach an edge security policy to a backend bucket, use the cloud compute backend-buckets command and the --edge-security-policy flag:

gcloud compute backend-services update my-bucket \
    --edge-security-policy my-edge-policy

Remove a security policy from a backend bucket

Follow the steps in this section to remove a Cloud Armor edge security policy from a backend bucket.

Console

  1. In the Google Cloud console, go to the Cloud Armor policies page.

    Go to Cloud Armor policies

  2. Click the name of the security policy to open the Policy details page.

  3. In the middle of the page, click the Targets tab.

  4. Select the target backend service that you're removing the policy from.

  5. Click Remove.

  6. In the Remove target message, click Remove.

gcloud

When you remove an edge security policy from a backend bucket, use the cloud compute backend-buckets command and the --edge-security-policy flag:

gcloud compute backend-services update my-bucket \
    --edge-security-policy ""

Import and export security policies

The following sections describe how you can import and export security policies.

Export security policies

You can export a Cloud Armor security policy as a YAML or JSON file by using the Google Cloud CLI. This feature provides the following benefits:

  • Save a copy for version control or backup: exporting provides a local copy of your policy. Save this copy in source control systems as a backup or to track changes. You can re-import it later to restore a prior version.

  • Modify and update policies locally: modify exported policies offline using a text editor. After making changes, re-import the updated policy to apply your modifications to Cloud Armor.

gcloud

  1. In the following command, NAME is the name of the security policy. Valid file formats are YAML and JSON. If you don't specify the file format, Cloud Armor uses YAML.

    gcloud compute security-policies export NAME \
    --file-name FILE_NAME  \
    --file-format FILE_FORMAT

    The following example shows the command to export the my-policy security policy to the my-file file in the YAML format:

    gcloud compute security-policies export my-policy \
    --file-name my-file \
    --file-format yaml

    The following example shows an exported security policy:

    description: my description
fingerprint: PWfLGDWQDLY=
id: '123'
name: my-policy
rules:
- action: allow
  description: default rule
  match:
      config:
        srcIpRanges:
        - '*'
      versionedExpr: SRC_IPS_V1
    preview: false
    priority: 2147483647
  selfLink: https://www.googleapis.com/compute/v1/projects/my-project/global/securityPolicies/my-policy

  2. Modify the exported file with a text editor, and then import it back to Google Cloud by using the import command.

Import security policies

You import Cloud Armor security policies from a YAML or JSON file by using the Google Cloud CLI. You can't use the import command to update an existing policy's rules. Instead, update rules individually by using the Update a single rule in a security policy procedure, or all at once by using the Atomically update multiple rules in a security policy procedure.

gcloud

To import security policies, use the following gcloud compute security-policies import NAME command.

gcloud compute security-policies import NAME \
    --file-name FILE_NAME  \
   [--file-format FILE_FORMAT]

For example, the following command updates the policy my-policy by importing the file my-file.

gcloud compute security-policies import my-policy \
    --file-name my-file \
    --file-format json

Replace NAME with the name of the security policy. If you don't provide the file format, the correct format is assumed based on the file structure. If the structure is invalid, the gcloud CLI returns an error message.

If the policy's fingerprint is out of date when you import it, Cloud Armor returns an error. This means the policy was modified since you last exported it. To fix this, use the describe command on the policy to get the latest fingerprint. You can use --format=yaml or --format=json with the describe command to make comparison easier. Compare the rules section of the describe output with the rules section in your policy file, merge any differences, and then replace the outdated fingerprint in your file with the latest one from the describe output.

What's next