Enforce security policies

To help you both establish authoritative policy requirements and verify that your application infrastructure aligns with organizational security policies before deployment, App Design Center integrates with Security Command Center. An administrator can deploy frameworks in Security Command Center, which you then attach to application templates in App Design Center.

During the application design phase, application developers can run an assessment to analyze the application infrastructure and view compliance findings for each framework directly on the design canvas:

  • Review the assessment scorecard to adjust the design and fix misconfigurations before proceeding with the deployment.
  • Applications inherit the frameworks that are attached to associated application templates. Validation continues post-deployment, where Security Command Center monitors runtime resources to detect configuration drift.
  • Because App Design Center manages the application lifecycle, you can trace any runtime issues detected by Security Command Center to the specific template revision that introduced them.

This document describes how to attach Security Command Center frameworks to application templates to run assessments and enforce security policies.

Before you begin

To attach frameworks to your application templates and perform security assessments in App Design Center, you must have Security Command Center active for your organization. The assessment features available to you depend on your service tier:

  • Standard tier: Your application templates and instances are validated against the Google Cloud Security Essentials framework.
  • Premium or Enterprise tier: In addition to the Security Essentials framework, you can create additional frameworks in Security Command Center and attach them directly to your templates to enforce custom or regulatory compliance.

After setting up your application management boundary, you can view and attach security frameworks in the App Design Center canvas. For more information, see App Hub as a detection service in Security Command Center.

Required roles

To get the permissions that you need to attach frameworks to templates and run assessments, ask your administrator to grant you the following IAM roles on the management project:

For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

Attach frameworks to your application template

To enforce consistent security policies on deployed applications, attach Security Command Center frameworks directly to your application templates. This applies a consistent set of policies to any application deployed from that template.

To attach frameworks to your application template, do the following:

gcloud CLI

  1. Find available frameworks to attach:

    gcloud alpha design-center locations fetch-frameworks LOCATION \
    --project=PROJECT

  2. Create a policy to attach the framework to your application template:

    gcloud alpha design-center spaces application-templates policies create POLICY \
    --application-template=APPLICATION_TEMPLATE \
    --project=PROJECT \
    --location=LOCATION \
    --space=SPACE \
    --policy-type=compliance-framework \
    --policy-uri=POLICY_URI

    Replace the following:

    • POLICY: A name for the policy attachment, for example, my-security-policy.
    • APPLICATION_TEMPLATE: The template ID for the application template.
    • PROJECT: Your management project ID.
    • LOCATION: The application template region.
    • SPACE: Your space ID.
    • POLICY_URI: The URI of the Security Command Center framework you want to attach, for example, organizations/12345/locations/global/frameworks/my-framework.

Run an assessment

Before you share a template with application developers, perform a template security assessment. This helps you identify and fix any security issues before application developers deploy an application based on the template:

gcloud CLI 

gcloud alpha design-center spaces application-templates generate-assessment-report APPLICATION_TEMPLATE \
--project=PROJECT \
--location=LOCATION \
--space=SPACE

Replace the following:

  • APPLICATION_TEMPLATE: The template ID for the application template that you want to assess.
  • PROJECT: Your management project ID.
  • LOCATION: The application template region.
  • SPACE: Your space ID.

The output displays an assessment report for your application template based on attached frameworks.

What's next