Create and view Cloud Armor security policies

This page describes how you can create Google Cloud Armor security policies to filter incoming traffic to your application. For information about security policy concepts, see the Cloud Armor security policy overview.

Before you begin

Before you configure security policies, do the following:

  • Make sure that you're familiar with external Application Load Balancer concepts.

  • Examine your existing backend services to determine which ones don't have a security policy attached. These backend services and their associated backends are not protected. To add Cloud Armor protection, attach a new or existing security policy to the backend service.

Set up IAM permissions for Cloud Armor security policies

The following operations require the Identity and Access Management (IAM) Compute Security Admin role (roles/compute.securityAdmin):

  • Configuring, modifying, updating, and deleting a Cloud Armor security policy
  • Using the following API methods:
    • SecurityPolicies insert
    • SecurityPolicies delete
    • SecurityPolicies patch
    • SecurityPolicies addRule
    • SecurityPolicies patchRule
    • SecurityPolicies removeRule

A user with the Compute Network Admin role (roles/compute.networkAdmin) can perform the following operations:

  • Setting a Cloud Armor security policy for a backend service
  • Using the following API methods:
    • BackendServices setSecurityPolicy
    • BackendServices list (gcloud only)

Users with the Security Admin role (roles/iam.securityAdmin) and the Compute Network Admin role (roles/compute.networkAdmin) can view Cloud Armor security policies by using the SecurityPolicies API methods get, list, and getRule.

Set up IAM permissions for custom roles

The following table lists the IAM roles' base permissions, their associated API methods, and the roles that grant that permission.

IAM permission API methods Roles
compute.securityPolicies.create SecurityPolicies insert Compute Security Admin (roles/compute.securityAdmin)
compute.securityPolicies.delete SecurityPolicies delete Compute Security Admin (roles/compute.securityAdmin)
compute.securityPolicies.get SecurityPolicies get
SecurityPolicies getRule		 Security Admin (roles/iam.securityAdmin)
compute.securityPolicies.list SecurityPolicies list Security Admin (roles/iam.securityAdmin)
Both of the following:
  • compute.securityPolicies.use
  • compute.backendServices.
    setSecurityPolicy
 BackendServices
setSecurityPolicy		 Compute Network Admin (roles/compute.networkAdmin)
compute.securityPolicies.update SecurityPolicies patch
SecurityPolicies addRule
SecurityPolicies patchRule
SecurityPolicies removeRule		 Compute Security Admin (roles/compute.securityAdmin)

Create security policies

Use the Google Cloud console, the Google Cloud CLI, or the REST API to configure Cloud Armor security policies, rules, and expressions. When you use the gcloud CLI, use the --type flag to specify whether the security policy is a backend security policy or an edge security policy.

If you're unfamiliar with security policy configuration, review the example security policies. To add rules to a security policy or view rule expressions, see Create and view security policy rules.

List security policies

Follow the steps in this section to list Cloud Armor security policies in your project.

Console

  1. In the Google Cloud console, go to the Cloud Armor policies page.

    Go to Cloud Armor policies

  2. To view a policy, in the list of policies, click the name of that specific policy.

gcloud 

gcloud compute security-policies list

For example:

gcloud compute security-policies list

Output: 

NAME: my-policy
REGION: us-central1

For more information, see gcloud compute security-policies list.

What's next