This page describes how to manage Google Cloud Armor security policies to filter incoming traffic to your application. Cloud Armor security policies help protect your web applications and services from distributed denial-of-service (DDoS) attacks and other threats from the internet. Enforcing a strong security posture requires managing your security policies through updating, testing, attaching to backend services, and exporting or importing.
To create or view security policies, see Create and view Cloud Armor security policies. To manage rules within a security policy, see Manage Cloud Armor security policy rules.
Manage security policies
The following sections describe how you can update, delete, or test your security policies.
Update security policies
The steps in this section describe how you can update a Cloud Armor security policy. You can modify the policy's description, modify the default rule, change the target backend service, or add rules.
Console
In the Cloud de Confiance console, go to the Cloud Armor policies page.
Find the name of the policy that you want to update in the list of policies and click Menu for that policy.
- To update the description or the default rule action, select Edit, make your changes, and then click Update.
- To add a rule, select Add rule, and then follow the steps in Add rules to a security policy.
- To replace the target backend service, select Apply policy to target, click Add Target, select a target, and then click Add.
gcloud
To update a security policy, use the following Google Cloud CLI steps:
- To update a rule, see Update a single rule in a security policy.
- To add a rule, see Add rules to a security policy.
- To delete a rule, see Delete rules from a security policy.
- To update multiple rules in a single atomic update, see Atomically update multiple rules in a security policy.
- To update non-rule fields (such as the description), see Export security policies and Import security policies.
Delete security policies
This section describes how you can delete a Cloud Armor security policy. Remove all backend services from the policy before you delete it.
Console
In the Cloud de Confiance console, go to the Cloud Armor policies page.
Select the checkbox next to the policy that you want to delete.
In the upper-right corner of the page, click Delete.
gcloud
Use gcloud compute security-policies delete NAME. Replace
NAME with the name of the security policy:
gcloud compute security-policies delete NAME
Test security policies
We recommend that you deploy all new rules in preview mode, then examine your request logs, to verify that the policies and rules are behaving as expected.
Attach and remove security policies
The following sections describe how you can attach and remove security policies.
Attach a security policy to a backend service
Follow the steps in this section to attach a Cloud Armor security policy to a backend service. You can attach a security policy to multiple backend services, but a backend service can have only one of each type of security policy attached to it.
Console
In the Cloud de Confiance console, go to the Cloud Armor policies page.
Click the name of the security policy to open the Policy details page.
In the middle of the page, click the Targets tab.
Click Apply policy to new target.
Click Add Target.
In the Target list, select a target, and then click Add.
gcloud
When you attach a backend security policy to a backend service, use the
gcloud compute backend-services command and the --security-policy flag:
gcloud compute backend-services update my-backend \
--security-policy my-policy
When you attach an edge security policy to a backend service, use the
gcloud compute backend-services command and the --edge-security-policy
flag:
gcloud compute backend-services update my-backend \
--edge-security-policy my-policy
Remove a security policy from a backend service
Follow the steps in this section to remove a Cloud Armor security policy from a backend service.
Console
In the Cloud de Confiance console, go to the Cloud Armor policies page.
Click the name of the security policy to open the Policy details page.
In the middle of the page, click the Targets tab.
Select the target backend service that you're removing the policy from.
Click Remove.
In the Remove target message, click Remove.
gcloud
When you remove a backend security policy, use the gcloud compute
backend-services command and the --security-policy flag:
gcloud compute backend-services update my-backend \
--security-policy ""
When you remove an edge security policy, use the gcloud compute
backend-services command and the --edge-security-policy flag:
gcloud compute backend-services update my-backend \
--edge-security-policy ""