Create security profile groups

Security profile groups are containers for security profiles. They let you bundle security profile types together for easier management and application to firewall rules. You can create these groups at either the organization or project level.

Each security profile group can contain up to one security profile of each of the following types:

• THREAT_PREVENTION
• URL_FILTERING

To apply consistent network security policies across your Google Cloud environment, you can use security profile groups to combine and apply threat prevention and URL filtering profiles. By grouping these profiles, you can enforce multiple security checks such as threat prevention and URL filtering on network traffic through a single firewall policy rule, ensuring consistent policy enforcement and simplified management. This document describes how to create and configure organization-level and project-level security profile groups by using the Google Cloud console or the Google Cloud CLI.

This document is intended for network administrators and security engineers who configure network security and firewall policies.

Before you begin, review the concepts in the Security profile groups overview.

Note: To check the progress of the operations listed on this page, make sure that your user role has the following Compute Network User role (roles/compute.networkUser) permissions:

• networksecurity.operations.get
• networksecurity.operations.list

Before you begin

• You must enable the Network Security API in your project.
• Install the gcloud CLI if you want to run the gcloud command-line examples in this guide.
• Create the security profiles that you need to add to the security profile group.

Roles

To get the permissions that you need to create security profile groups, ask your administrator to grant you the necessary Identity and Access Management (IAM) roles on your organization or project. For more information about granting roles, see Manage access.

Create a security profile group

Create a security profile group to bundle one or more security profiles into one resource for easier management and application to firewall rules.

Each security profile group can contain up to one security profile of each of the following types:

• URL_FILTERING
• THREAT_PREVENTION

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles on your organization or project.

Permissions

• networksecurity.securityProfileGroups.create

Roles

• Compute Network Admin (roles/compute.networkAdmin)
• Security Profile Admin (roles/networksecurity.securityProfileAdmin) granted at the organization level for organization-level security profile groups, and at either the project level or the organization level for project-level security profile groups

Console

Note: If your Google Cloud project is in a data residency zone (DRZ) in the Kingdom of Saudi Arabia (KSA) or India, you can't view, list, create, update, or delete project-level security profiles or security profile groups by using the Google Cloud console. To manage project-level security profiles and security profile groups in KSA and India, use the gcloud CLI or the API.

1. In the Google Cloud console, go to the Security profiles page.

   Go to Security profiles

2. In the project selector menu, select your organization or the project.

3. Select the Security profile groups tab.

4. Click Create profile group.

5. Enter a name in the Name field.

   Don't include sensitive information such as personally identifiable information or security data in the security profile group name.

6. Optional: Enter a description in the Description field.

7. To create a security profile group for Cloud Next Generation Firewall Enterprise, in the Purpose section, select Cloud NGFW Enterprise.

8. Add one or more security profiles to the group:

   • To add a threat prevention profile, select Threat prevention profile.
   • To add a URL filtering profile, select the URL filtering profile

9. Click Create.

gcloud

To create a security profile group, use the gcloud network-security security-profile-groups create command:

gcloud network-security security-profile-groups create NAME \
    --organization ORGANIZATION_ID | --project PROJECT_ID \
    [--billing-project QUOTA_PROJECT_ID] \
    --threat-prevention-profile THREAT_SECURITY_PROFILE_URL \
    --url-filtering-profile URL_SECURITY_PROFILE_URL \
    --location global

Replace the following:

• NAME: the name of the security profile group.

  If you don't specify the name in the unique URL identifier format, you must specify the organization or the project name, and the location.

  Don't include sensitive information such as personally identifiable information or security data in the security profile group name.

• ORGANIZATION_ID: the organization ID. Use this flag for an organization-level security profile group.

• PROJECT_ID: the project ID. Use this flag for a project-level security profile group.

• QUOTA_PROJECT_ID: the quota project ID. Use this flag only for organization-level security profile groups.

• THREAT_SECURITY_PROFILE_URL: a unique URL identifier for a security profile of THREAT_PREVENTION type.

• URL_SECURITY_PROFILE_URL: a unique URL identifier for a security profile of URL_FILTERING type.

What's next

• Manage security profile groups
• Create and manage firewall endpoints