ComputeSecurityPolicy

Property	Value
Google Cloud Service Name	Compute Engine
Google Cloud Service Documentation	/compute/docs/
Google Cloud REST Resource Name	v1.securityPolicies
Google Cloud REST Resource Documentation	/compute/docs/reference/rest/v1/securityPolicies
Config Connector Resource Short Names	gcpcomputesecuritypolicy gcpcomputesecuritypolicies computesecuritypolicy
Config Connector Service Name	compute.googleapis.com
Config Connector Resource Fully Qualified Name	computesecuritypolicies.compute.cnrm.cloud.google.com
Can Be Referenced by IAMPolicy/IAMPolicyMember	No
Config Connector Default Average Reconcile Interval In Seconds	600

Custom Resource Definition Properties

Annotations

Fields
cnrm.cloud.google.com/project-id

Spec

Schema

adaptiveProtectionConfig:
  autoDeployConfig:
    confidenceThreshold: float
    expirationSec: integer
    impactedBaselineThreshold: float
    loadThreshold: float
  layer7DdosDefenseConfig:
    enable: boolean
    ruleVisibility: string
advancedOptionsConfig:
  jsonCustomConfig:
    contentTypes:
    - string
  jsonParsing: string
  logLevel: string
  userIpRequestHeaders:
  - string
description: string
recaptchaOptionsConfig:
  redirectSiteKeyRef:
    external: string
    name: string
    namespace: string
resourceID: string
rule:
- action: string
  description: string
  headerAction:
    requestHeadersToAdds:
    - headerName: string
      headerValue: string
  match:
    config:
      srcIpRanges:
      - string
    expr:
      expression: string
    versionedExpr: string
  preconfiguredWafConfig:
    exclusion:
    - requestCookie:
      - operator: string
        value: string
      requestHeader:
      - operator: string
        value: string
      requestQueryParam:
      - operator: string
        value: string
      requestUri:
      - operator: string
        value: string
      targetRuleIds:
      - string
      targetRuleSet: string
  preview: boolean
  priority: integer
  rateLimitOptions:
    banDurationSec: integer
    banThreshold:
      count: integer
      intervalSec: integer
    conformAction: string
    enforceOnKey: string
    enforceOnKeyConfigs:
    - enforceOnKeyName: string
      enforceOnKeyType: string
    enforceOnKeyName: string
    exceedAction: string
    exceedRedirectOptions:
      target: string
      type: string
    rateLimitThreshold:
      count: integer
      intervalSec: integer
  redirectOptions:
    target: string
    type: string
type: string

Fields
adaptiveProtectionConfig Optional	object Adaptive Protection Config of this security policy.
adaptiveProtectionConfig.autoDeployConfig Optional	object Auto Deploy Config of this security policy
adaptiveProtectionConfig.autoDeployConfig.confidenceThreshold Optional	float Rules are only automatically deployed for alerts on potential attacks with confidence scores greater than this threshold.
adaptiveProtectionConfig.autoDeployConfig.expirationSec Optional	integer Google Cloud Armor stops applying the action in the automatically deployed rule to an identified attacker after this duration. The rule continues to operate against new requests.
adaptiveProtectionConfig.autoDeployConfig.impactedBaselineThreshold Optional	float Rules are only automatically deployed when the estimated impact to baseline traffic from the suggested mitigation is below this threshold.
adaptiveProtectionConfig.autoDeployConfig.loadThreshold Optional	float Identifies new attackers only when the load to the backend service that is under attack exceeds this threshold.
adaptiveProtectionConfig.layer7DdosDefenseConfig Optional	object Layer 7 DDoS Defense Config of this security policy
adaptiveProtectionConfig.layer7DdosDefenseConfig.enable Optional	boolean If set to true, enables CAAP for L7 DDoS detection.
adaptiveProtectionConfig.layer7DdosDefenseConfig.ruleVisibility Optional	string Rule visibility. Supported values include: "STANDARD", "PREMIUM".
advancedOptionsConfig Optional	object
advancedOptionsConfig.jsonCustomConfig Optional	object Custom configuration to apply the JSON parsing. Only applicable when json_parsing is set to STANDARD.
advancedOptionsConfig.jsonCustomConfig.contentTypes Required*	list (string) A list of custom Content-Type header values to apply the JSON parsing. As per RFC 1341, a Content-Type header value has the following format: Content-Type := type "/" subtype *[";" parameter] When configuring a custom Content-Type header value, only the type/subtype needs to be specified, and the parameters should be excluded.
advancedOptionsConfig.jsonCustomConfig.contentTypes[] Required*	string
advancedOptionsConfig.jsonParsing Optional	string Check the JsonParsing enum for the list of possible values.
advancedOptionsConfig.logLevel Optional	string Check the LogLevel enum for the list of possible values.
advancedOptionsConfig.userIpRequestHeaders Optional	list (string) An optional list of case-insensitive request header names to use for resolving the callers client IP address.
advancedOptionsConfig.userIpRequestHeaders[] Optional	string
description Optional	string
recaptchaOptionsConfig Optional	object
recaptchaOptionsConfig.redirectSiteKeyRef Required*	object
recaptchaOptionsConfig.redirectSiteKeyRef.external Optional	string The value of an externally managed RecaptchaEnterpriseKey resource.
recaptchaOptionsConfig.redirectSiteKeyRef.name Optional	string The name of a RecaptchaEnterpriseKey resource.
recaptchaOptionsConfig.redirectSiteKeyRef.namespace Optional	string The namespace of a RecaptchaEnterpriseKey resource.
resourceID Optional	string The ComputeSecurityPolicy name. If not given, the metadata.name will be used.
rule Optional	list (object)
rule[] Optional	object
rule[].action Required*	string The Action to perform when the rule is matched. The following are the valid actions: - allow: allow access to target. - deny(STATUS): deny access to target, returns the HTTP response code specified. Valid values for `STATUS` are 403, 404, and 502. - rate_based_ban: limit client traffic to the configured threshold and ban the client if the traffic exceeds the threshold. Configure parameters for this action in RateLimitOptions. Requires rate_limit_options to be set. - redirect: redirect to a different target. This can either be an internal reCAPTCHA redirect, or an external URL-based redirect via a 302 response. Parameters for this action can be configured via redirectOptions. This action is only supported in Global Security Policies of type CLOUD_ARMOR. - throttle: limit client traffic to the configured threshold. Configure parameters for this action in rateLimitOptions. Requires rate_limit_options to be set for this.
rule[].description Optional	string An optional description of this resource. Provide this property when you create the resource.
rule[].headerAction Optional	object Optional, additional actions that are performed on headers. This field is only supported in Global Security Policies of type CLOUD_ARMOR.
rule[].headerAction.requestHeadersToAdds Optional	list (object) The list of request headers to add or overwrite if they're already present.
rule[].headerAction.requestHeadersToAdds[] Optional	object
rule[].headerAction.requestHeadersToAdds[].headerName Optional	string The name of the header to set.
rule[].headerAction.requestHeadersToAdds[].headerValue Optional	string The value to set the named header to.
rule[].match Required*	object A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
rule[].match.config Optional	object The configuration options available when specifying versioned_expr. This field must be specified if versioned_expr is specified and cannot be specified if versioned_expr is not specified.
rule[].match.config.srcIpRanges Required*	list (string) CIDR IP address range. Maximum number of src_ip_ranges allowed is 10.
rule[].match.config.srcIpRanges[] Required*	string
rule[].match.expr Optional	object User defined CEVAL expression. A CEVAL expression is used to specify match criteria such as origin.ip, source.region_code and contents in the request header. Expressions containing `evaluateThreatIntelligence` require Cloud Armor Managed Protection Plus tier and are not supported in Edge Policies nor in Regional Policies. Expressions containing `evaluatePreconfiguredExpr('sourceiplist-*')` require Cloud Armor Managed Protection Plus tier and are only supported in Global Security Policies.
rule[].match.expr.expression Optional	string Textual representation of an expression in Common Expression Language syntax.
rule[].match.versionedExpr Optional	string Preconfigured versioned expression. If this field is specified, config must also be specified. Available preconfigured expressions along with their requirements are: SRC_IPS_V1 - must specify the corresponding src_ip_range field in config. Check the VersionedExpr enum for the list of possible values.
rule[].preconfiguredWafConfig Optional	object Preconfigured WAF configuration to be applied for the rule. If the rule does not evaluate preconfigured WAF rules, i.e., if evaluatePreconfiguredWaf() is not used, this field will have no effect.
rule[].preconfiguredWafConfig.exclusion Optional	list (object) A list of exclusions to apply during preconfigured WAF evaluation.
rule[].preconfiguredWafConfig.exclusion[] Optional	object
rule[].preconfiguredWafConfig.exclusion[].requestCookie Optional	list (object) A list of request cookie names whose value will be excluded from inspection during preconfigured WAF evaluation.
rule[].preconfiguredWafConfig.exclusion[].requestCookie[] Optional	object
rule[].preconfiguredWafConfig.exclusion[].requestCookie[].operator Optional	string The match operator for the field. Check the Op enum for the list of possible values.
rule[].preconfiguredWafConfig.exclusion[].requestCookie[].value Optional	string The value of the field.
rule[].preconfiguredWafConfig.exclusion[].requestHeader Optional	list (object) A list of request header names whose value will be excluded from inspection during preconfigured WAF evaluation.
rule[].preconfiguredWafConfig.exclusion[].requestHeader[] Optional	object
rule[].preconfiguredWafConfig.exclusion[].requestHeader[].operator Optional	string The match operator for the field. Check the Op enum for the list of possible values.
rule[].preconfiguredWafConfig.exclusion[].requestHeader[].value Optional	string The value of the field.
rule[].preconfiguredWafConfig.exclusion[].requestQueryParam Optional	list (object) A list of request query parameter names whose value will be excluded from inspection during preconfigured WAF evaluation. Note that the parameter can be in the query string or in the POST body.
rule[].preconfiguredWafConfig.exclusion[].requestQueryParam[] Optional	object
rule[].preconfiguredWafConfig.exclusion[].requestQueryParam[].operator Optional	string The match operator for the field. Check the Op enum for the list of possible values.
rule[].preconfiguredWafConfig.exclusion[].requestQueryParam[].value Optional	string The value of the field.
rule[].preconfiguredWafConfig.exclusion[].requestUri Optional	list (object) A list of request URIs from the request line to be excluded from inspection during preconfigured WAF evaluation. When specifying this field, the query or fragment part should be excluded.
rule[].preconfiguredWafConfig.exclusion[].requestUri[] Optional	object
rule[].preconfiguredWafConfig.exclusion[].requestUri[].operator Optional	string The match operator for the field. Check the Op enum for the list of possible values.
rule[].preconfiguredWafConfig.exclusion[].requestUri[].value Optional	string The value of the field.
rule[].preconfiguredWafConfig.exclusion[].targetRuleIds Optional	list (string) A list of target rule IDs under the WAF rule set to apply the preconfigured WAF exclusion. If omitted, it refers to all the rule IDs under the WAF rule set.
rule[].preconfiguredWafConfig.exclusion[].targetRuleIds[] Optional	string
rule[].preconfiguredWafConfig.exclusion[].targetRuleSet Optional	string Target WAF rule set to apply the preconfigured WAF exclusion.
rule[].preview Optional	boolean If set to true, the specified action is not enforced.
rule[].priority Required*	integer An integer indicating the priority of a rule in the list. The priority must be a positive value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
rule[].rateLimitOptions Optional	object Must be specified if the action is "rate_based_ban" or "throttle". Cannot be specified for any other actions.
rule[].rateLimitOptions.banDurationSec Optional	integer Can only be specified if the action for the rule is "rate_based_ban". If specified, determines the time (in seconds) the traffic will continue to be banned by the rate limit after the rate falls below the threshold.
rule[].rateLimitOptions.banThreshold Optional	object Can only be specified if the action for the rule is "rate_based_ban". If specified, the key will be banned for the configured 'ban_duration_sec' when the number of requests that exceed the 'rate_limit_threshold' also exceed this 'ban_threshold'.
rule[].rateLimitOptions.banThreshold.count Required*	integer Number of HTTP(S) requests for calculating the threshold.
rule[].rateLimitOptions.banThreshold.intervalSec Required*	integer Interval over which the threshold is computed.
rule[].rateLimitOptions.conformAction Required*	string Action to take for requests that are under the configured rate limit threshold. Valid option is "allow" only.
rule[].rateLimitOptions.enforceOnKey Optional	string Determines the key to enforce the rate_limit_threshold on. Possible values are: - ALL: A single rate limit threshold is applied to all the requests matching this rule. This is the default value if "enforceOnKey" is not configured. - IP: The source IP address of the request is the key. Each IP has this limit enforced separately. - HTTP_HEADER: The value of the HTTP header whose name is configured under "enforceOnKeyName". The key value is truncated to the first 128 bytes of the header value. If no such header is present in the request, the key type defaults to ALL. - XFF_IP: The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP header. If no such header is present or the value is not a valid IP, the key defaults to the source IP address of the request i.e. key type IP. - HTTP_COOKIE: The value of the HTTP cookie whose name is configured under "enforceOnKeyName". The key value is truncated to the first 128 bytes of the cookie value. If no such cookie is present in the request, the key type defaults to ALL. - HTTP_PATH: The URL path of the HTTP request. The key value is truncated to the first 128 bytes. - SNI: Server name indication in the TLS session of the HTTPS request. The key value is truncated to the first 128 bytes. The key type defaults to ALL on a HTTP session. - REGION_CODE: The country/region from which the request originates. - TLS_JA3_FINGERPRINT: JA3 TLS/SSL fingerprint if the client connects using HTTPS, HTTP/2 or HTTP/3. If not available, the key type defaults to ALL. - USER_IP: The IP address of the originating client, which is resolved based on "userIpRequestHeaders" configured with the security policy. If there is no "userIpRequestHeaders" configuration or an IP address cannot be resolved from it, the key type defaults to IP. - TLS_JA4_FINGERPRINT: JA4 TLS/SSL fingerprint if the client connects using HTTPS, HTTP/2 or HTTP/3. If not available, the key type defaults to ALL. Check the EnforceOnKey enum for the list of possible values.
rule[].rateLimitOptions.enforceOnKeyConfigs Optional	list (object) If specified, any combination of values of enforce_on_key_type/enforce_on_key_name is treated as the key on which ratelimit threshold/action is enforced. You can specify up to 3 enforce_on_key_configs. If enforce_on_key_configs is specified, enforce_on_key must not be specified.
rule[].rateLimitOptions.enforceOnKeyConfigs[] Optional	object
rule[].rateLimitOptions.enforceOnKeyConfigs[].enforceOnKeyName Optional	string Rate limit key name applicable only for the following key types: HTTP_HEADER -- Name of the HTTP header whose value is taken as the key value. HTTP_COOKIE -- Name of the HTTP cookie whose value is taken as the key value.
rule[].rateLimitOptions.enforceOnKeyConfigs[].enforceOnKeyType Optional	string Determines the key to enforce the rate_limit_threshold on. Possible values are: - ALL: A single rate limit threshold is applied to all the requests matching this rule. This is the default value if "enforceOnKeyConfigs" is not configured. - IP: The source IP address of the request is the key. Each IP has this limit enforced separately. - HTTP_HEADER: The value of the HTTP header whose name is configured under "enforceOnKeyName". The key value is truncated to the first 128 bytes of the header value. If no such header is present in the request, the key type defaults to ALL. - XFF_IP: The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP header. If no such header is present or the value is not a valid IP, the key defaults to the source IP address of the request i.e. key type IP. - HTTP_COOKIE: The value of the HTTP cookie whose name is configured under "enforceOnKeyName". The key value is truncated to the first 128 bytes of the cookie value. If no such cookie is present in the request, the key type defaults to ALL. - HTTP_PATH: The URL path of the HTTP request. The key value is truncated to the first 128 bytes. - SNI: Server name indication in the TLS session of the HTTPS request. The key value is truncated to the first 128 bytes. The key type defaults to ALL on a HTTP session. - REGION_CODE: The country/region from which the request originates. - TLS_JA3_FINGERPRINT: JA3 TLS/SSL fingerprint if the client connects using HTTPS, HTTP/2 or HTTP/3. If not available, the key type defaults to ALL. - USER_IP: The IP address of the originating client, which is resolved based on "userIpRequestHeaders" configured with the security policy. If there is no "userIpRequestHeaders" configuration or an IP address cannot be resolved from it, the key type defaults to IP. - TLS_JA4_FINGERPRINT: JA4 TLS/SSL fingerprint if the client connects using HTTPS, HTTP/2 or HTTP/3. If not available, the key type defaults to ALL. Check the EnforceOnKeyType enum for the list of possible values.
rule[].rateLimitOptions.enforceOnKeyName Optional	string Rate limit key name applicable only for the following key types: HTTP_HEADER -- Name of the HTTP header whose value is taken as the key value. HTTP_COOKIE -- Name of the HTTP cookie whose value is taken as the key value.
rule[].rateLimitOptions.exceedAction Required*	string Action to take for requests that are above the configured rate limit threshold, to either deny with a specified HTTP response code, or redirect to a different endpoint. Valid options are `deny(STATUS)`, where valid values for `STATUS` are 403, 404, 429, and 502, and `redirect`, where the redirect parameters come from `exceedRedirectOptions` below. The `redirect` action is only supported in Global Security Policies of type CLOUD_ARMOR.
rule[].rateLimitOptions.exceedRedirectOptions Optional	object Parameters defining the redirect action that is used as the exceed action. Cannot be specified if the exceed action is not redirect. This field is only supported in Global Security Policies of type CLOUD_ARMOR.
rule[].rateLimitOptions.exceedRedirectOptions.target Optional	string Target for the redirect action. This is required if the type is EXTERNAL_302 and cannot be specified for GOOGLE_RECAPTCHA.
rule[].rateLimitOptions.exceedRedirectOptions.type Required*	string Type of the redirect action. Possible values are: - GOOGLE_RECAPTCHA: redirect to reCAPTCHA for manual challenge assessment. - EXTERNAL_302: redirect to a different URL via a 302 response. Check the Type enum for the list of possible values.
rule[].rateLimitOptions.rateLimitThreshold Required*	object Threshold at which to begin ratelimiting.
rule[].rateLimitOptions.rateLimitThreshold.count Required*	integer Number of HTTP(S) requests for calculating the threshold.
rule[].rateLimitOptions.rateLimitThreshold.intervalSec Required*	integer Interval over which the threshold is computed.
rule[].redirectOptions Optional	object Parameters defining the redirect action. Cannot be specified for any other actions. This field is only supported in Global Security Policies of type CLOUD_ARMOR.
rule[].redirectOptions.target Optional	string Target for the redirect action. This is required if the type is EXTERNAL_302 and cannot be specified for GOOGLE_RECAPTCHA.
rule[].redirectOptions.type Required*	string Type of the redirect action. Possible values are: - GOOGLE_RECAPTCHA: redirect to reCAPTCHA for manual challenge assessment. - EXTERNAL_302: redirect to a different URL via a 302 response. Check the Type enum for the list of possible values.
type Optional	string

* Field is required when parent field is specified

Status

Schema

conditions:
- lastTransitionTime: string
  message: string
  reason: string
  status: string
  type: string
fingerprint: string
observedGeneration: integer
selfLink: string

Fields
conditions	list (object) Conditions represent the latest available observations of the object's current state.
conditions[]	object
conditions[].lastTransitionTime	string Last time the condition transitioned from one status to another.
conditions[].message	string Human-readable message indicating details about last transition.
conditions[].reason	string Unique, one-word, CamelCase reason for the condition's last transition.
conditions[].status	string Status is the status of the condition. Can be True, False, Unknown.
conditions[].type	string Type is the type of the condition.
fingerprint	string
observedGeneration	integer ObservedGeneration is the generation of the resource that was most recently observed by the Config Connector controller. If this is equal to metadata.generation, then that means that the current reported status reflects the most recent desired state of the resource.
selfLink	string

Sample YAML(s)

Lockdown Security Policy With Test

# Copyright 2020 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: compute.cnrm.cloud.google.com/v1beta1
kind: ComputeSecurityPolicy
metadata:
  name: computesecuritypolicy-sample-lockdownwithtest
spec:
  description: A policy designed to completely lock down network access while testing the effect of opening ports over a few select ranges.
  rule:
  - action: deny(403)
    priority: 2147483647
    match:
      versionedExpr: SRC_IPS_V1
      config:
        srcIpRanges:
        - "*"
    description: Rule matching all IPs with priority 2147483647, set to deny.
  - action: allow
    preview: true
    priority: 1000000000
    match:
      versionedExpr: SRC_IPS_V1
      config:
        srcIpRanges:
        - 16.0.0.0/4
        - 115.128.0.0/9
        - 62.48.212.0/24
    description: Tests opening listed IP ranges. Logs sent to Stackdriver.

Multirule Security Policy

# Copyright 2020 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: compute.cnrm.cloud.google.com/v1beta1
kind: ComputeSecurityPolicy
metadata:
  name: computesecuritypolicy-sample-multirule
spec:
  description: A generally permissive policy that locks out a large block of untrusted IPs, except for some allowed trusted IP ranges within them, and never allows IPs from a denylist.
  rule:
  - action: allow
    priority: 2147483647
    match:
      versionedExpr: SRC_IPS_V1
      config:
        srcIpRanges:
        - "*"
    description: This rule must be included in any rule array. Action can change.
  - action: deny(502)
    priority: 111111111
    match:
      versionedExpr: SRC_IPS_V1
      config:
        srcIpRanges:
        - 60.0.0.0/6
    description: Untrusted range. Block IPs and return 502.
  - action: allow
    priority: 555
    match:
      versionedExpr: SRC_IPS_V1
      config:
        srcIpRanges:
        - 63.0.0.0/8
        - 61.128.0.0/10
    description: Even though they're in an untrusted block, these ranges are OK.
  - action: deny(403)
    priority: 0
    match:
      versionedExpr: SRC_IPS_V1
      config:
        srcIpRanges:
        - 145.4.56.4/30
        - 63.63.63.63/32
        - 4.5.4.0/24
    description: Never allow these denylisted IP ranges.

Note: If you have any trouble with instantiating the resource, refer to Troubleshoot Config Connector.