Rule

Represents a rule that describes one or more match conditions along with the action to be taken when traffic matches this condition (allow or deny).

JSON representation 
{
  "kind": string,
  "description": string,
  "priority": integer,
  "match": {
    object (Matcher)
  },
  "networkMatch": {
    object (NetworkMatcher)
  },
  "action": string,
  "preview": boolean,
  "rateLimitOptions": {
    object (RateLimitOptions)
  },
  "headerAction": {
    object (HttpHeaderAction)
  },
  "redirectOptions": {
    object (RedirectOptions)
  },
  "preconfiguredWafConfig": {
    object (PreconfiguredWafConfig)
  }
}
Fields
kind

string

[Output only] Type of the resource. Always

compute#securityPolicyRule

for security policy rules
description

string

An optional description of this resource. Provide this property when you create the resource.
priority

integer

An integer indicating the priority of a rule in the list. The priority must be a positive value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
match

object (Matcher)

A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.
networkMatch

object (NetworkMatcher)

A match condition that incoming packets are evaluated against for CLOUD_ARMOR_NETWORK security policies. If it matches, the corresponding 'action' is enforced.

The match criteria for a rule consists of built-in match fields (like 'srcIpRanges') and potentially multiple user-defined match fields ('userDefinedFields').

Field values may be extracted directly from the packet or derived from it (e.g. 'srcRegionCodes'). Some fields may not be present in every packet (e.g. 'srcPorts'). A user-defined field is only present if the base header is found in the packet and the entire field is in bounds.

Each match field may specify which values can match it, listing one or more ranges, prefixes, or exact values that are considered a match for the field. A field value must be present in order to match a specified match field. If no match values are specified for a match field, then any field value is considered to match it, and it's not required to be present. For strings specifying '*' is also equivalent to match all.

For a packet to match a rule, all specified match fields must match the corresponding field values derived from the packet.

Example:

networkMatch: srcIpRanges: - "192.0.2.0/24" - "198.51.100.0/24" userDefinedFields: - name: "ipv4_fragment_offset" values: - "1-0x1fff"

The above match condition matches packets with a source IP in 192.0.2.0/24 or 198.51.100.0/24 and a user-defined field named "ipv4_fragment_offset" with a value between 1 and 0x1fff inclusive.
action

string

The Action to perform when the rule is matched. The following are the valid actions:

  • allow

    : allow access to target.

  • deny(STATUS)

    : deny access to target, returns the HTTP response code specified. Valid values for STATUS are 403, 404, and 502.

  • rate_based_ban

    : limit client traffic to the configured threshold and ban the client if the traffic exceeds the threshold. Configure parameters for this action in RateLimitOptions. Requires rateLimitOptions to be set.

  • redirect

    : redirect to a different target. This can either be an internal reCAPTCHA redirect, or an external URL-based redirect via a 302 response. Parameters for this action can be configured via redirectOptions. This action is only supported in Global Security Policies of type CLOUD_ARMOR.

  • throttle

    : limit client traffic to the configured threshold. Configure parameters for this action in rateLimitOptions. Requires rateLimitOptions to be set for this.
preview

boolean

If set to true, the specified action is not enforced.
rateLimitOptions

object (RateLimitOptions)

Must be specified if the action is "rate_based_ban" or "throttle". Cannot be specified for any other actions.
headerAction

object (HttpHeaderAction)

Optional, additional actions that are performed on headers. This field is only supported in Global Security Policies of type CLOUD_ARMOR.
redirectOptions

object (RedirectOptions)

Parameters defining the redirect action. Cannot be specified for any other actions. This field is only supported in Global Security Policies of type CLOUD_ARMOR.
preconfiguredWafConfig

object (PreconfiguredWafConfig)

Preconfigured WAF configuration to be applied for the rule. If the rule does not evaluate preconfigured WAF rules, i.e., if evaluatePreconfiguredWaf() is not used, this field will have no effect.

Matcher

Represents a match condition that incoming traffic is evaluated against. Exactly one field must be specified.

JSON representation 
{
  "expr": {
    object (Expr)
  },
  "exprOptions": {
    object (ExprOptions)
  },
  "versionedExpr": enum (VersionedExpr),
  "config": {
    object (Config)
  }
}
Fields
expr

object (Expr)

User defined CEVAL expression. A CEVAL expression is used to specify match criteria such as origin.ip, source.region_code and contents in the request header. Expressions containing evaluateThreatIntelligence require Cloud Armor Managed Protection Plus tier and are not supported in Edge Policies nor in Regional Policies. Expressions containing evaluatePreconfiguredExpr('sourceiplist-*') require Cloud Armor Managed Protection Plus tier and are only supported in Global Security Policies.
exprOptions

object (ExprOptions)

The configuration options available when specifying a user defined CEVAL expression (i.e., 'expr').
versionedExpr

enum (VersionedExpr)

Preconfigured versioned expression. If this field is specified, config must also be specified. Available preconfigured expressions along with their requirements are: SRC_IPS_V1 - must specify the corresponding srcIpRange field in config.
config

object (Config)

The configuration options available when specifying versionedExpr. This field must be specified if versionedExpr is specified and cannot be specified if versionedExpr is not specified.

ExprOptions

JSON representation 
{
  "recaptchaOptions": {
    object (RecaptchaOptions)
  }
}
Fields
recaptchaOptions

object (RecaptchaOptions)

reCAPTCHA configuration options to be applied for the rule. If the rule does not evaluate reCAPTCHA tokens, this field has no effect.

RecaptchaOptions

JSON representation 
{
  "actionTokenSiteKeys": [
    string
  ],
  "sessionTokenSiteKeys": [
    string
  ]
}
Fields
actionTokenSiteKeys[]

string

A list of site keys to be used during the validation of reCAPTCHA action-tokens. The provided site keys need to be created from reCAPTCHA API under the same project where the security policy is created.
sessionTokenSiteKeys[]

string

A list of site keys to be used during the validation of reCAPTCHA session-tokens. The provided site keys need to be created from reCAPTCHA API under the same project where the security policy is created.

VersionedExpr

Enums
SRC_IPS_V1 Matches the source IP address of a request to the IP ranges supplied in config.

Config

JSON representation 
{
  "srcIpRanges": [
    string
  ]
}
Fields
srcIpRanges[]

string

CIDR IP address range. Maximum number of srcIpRanges allowed is 10.

NetworkMatcher

Represents a match condition that incoming network traffic is evaluated against.

JSON representation 
{
  "userDefinedFields": [
    {
      object (UserDefinedFieldMatch)
    }
  ],
  "srcIpRanges": [
    string
  ],
  "destIpRanges": [
    string
  ],
  "ipProtocols": [
    string
  ],
  "srcPorts": [
    string
  ],
  "destPorts": [
    string
  ],
  "srcRegionCodes": [
    string
  ],
  "srcAsns": [
    integer
  ]
}
Fields
userDefinedFields[]

object (UserDefinedFieldMatch)

User-defined fields. Each element names a defined field and lists the matching values for that field.
srcIpRanges[]

string

Source IPv4/IPv6 addresses or CIDR prefixes, in standard text format.
destIpRanges[]

string

Destination IPv4/IPv6 addresses or CIDR prefixes, in standard text format.
ipProtocols[]

string

IPv4 protocol / IPv6 next header (after extension headers). Each element can be an 8-bit unsigned decimal number (e.g. "6"), range (e.g. "253-254"), or one of the following protocol names: "tcp", "udp", "icmp", "esp", "ah", "ipip", or "sctp".
srcPorts[]

string

Source port numbers for TCP/UDP/SCTP. Each element can be a 16-bit unsigned decimal number (e.g. "80") or range (e.g. "0-1023").
destPorts[]

string

Destination port numbers for TCP/UDP/SCTP. Each element can be a 16-bit unsigned decimal number (e.g. "80") or range (e.g. "0-1023").
srcRegionCodes[]

string

Two-letter ISO 3166-1 alpha-2 country code associated with the source IP address.
srcAsns[]

integer (uint32 format)

BGP Autonomous System Number associated with the source IP address.

UserDefinedFieldMatch

JSON representation 
{
  "name": string,
  "values": [
    string
  ]
}
Fields
name

string

Name of the user-defined field, as given in the definition.
values[]

string

Matching values of the field. Each element can be a 32-bit unsigned decimal or hexadecimal (starting with "0x") number (e.g. "64") or range (e.g. "0x400-0x7ff").

RateLimitOptions

JSON representation 
{
  "rateLimitThreshold": {
    object (Threshold)
  },
  "conformAction": string,
  "exceedAction": string,
  "exceedRedirectOptions": {
    object (RedirectOptions)
  },
  "enforceOnKey": enum (EnforceOnKey),
  "enforceOnKeyName": string,
  "enforceOnKeyConfigs": [
    {
      object (EnforceOnKeyConfig)
    }
  ],
  "banThreshold": {
    object (Threshold)
  },
  "banDurationSec": integer
}
Fields
rateLimitThreshold

object (Threshold)

Threshold at which to begin ratelimiting.
conformAction

string

Action to take for requests that are under the configured rate limit threshold. Valid option is "allow" only.
exceedAction

string

Action to take for requests that are above the configured rate limit threshold, to either deny with a specified HTTP response code, or redirect to a different endpoint. Valid options are deny(STATUS), where valid values for STATUS are 403, 404, 429, and 502, and redirect, where the redirect parameters come from exceedRedirectOptions below. The redirect action is only supported in Global Security Policies of type CLOUD_ARMOR.
exceedRedirectOptions

object (RedirectOptions)

Parameters defining the redirect action that is used as the exceed action. Cannot be specified if the exceed action is not redirect. This field is only supported in Global Security Policies of type CLOUD_ARMOR.
enforceOnKey

enum (EnforceOnKey)

Determines the key to enforce the rateLimitThreshold on. Possible values are:

  • ALL

    : A single rate limit threshold is applied to all the requests matching this rule. This is the default value if "enforceOnKey" is not configured.

  • IP

    : The source IP address of the request is the key. Each IP has this limit enforced separately.

  • HTTP_HEADER

    : The value of the HTTP header whose name is configured under "enforceOnKeyName". The key value is truncated to the first 128 bytes of the header value. If no such header is present in the request, the key type defaults to

    ALL

    .

  • XFF_IP

    : The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP header. If no such header is present or the value is not a valid IP, the key defaults to the source IP address of the request i.e. key type

    IP

    .

  • HTTP_COOKIE

    : The value of the HTTP cookie whose name is configured under "enforceOnKeyName". The key value is truncated to the first 128 bytes of the cookie value. If no such cookie is present in the request, the key type defaults to

    ALL

    .

  • HTTP_PATH

    : The URL path of the HTTP request. The key value is truncated to the first 128 bytes.

  • SNI

    : Server name indication in the TLS session of the HTTPS request. The key value is truncated to the first 128 bytes. The key type defaults to

    ALL

    on a HTTP session.

  • REGION_CODE

    : The country/region from which the request originates.

  • TLS_JA3_FINGERPRINT

    : JA3 TLS/SSL fingerprint if the client connects using HTTPS, HTTP/2 or HTTP/3. If not available, the key type defaults to

    ALL

    .

  • USER_IP

    : The IP address of the originating client, which is resolved based on "userIpRequestHeaders" configured with the security policy. If there is no "userIpRequestHeaders" configuration or an IP address cannot be resolved from it, the key type defaults to

    IP

    .

  • TLS_JA4_FINGERPRINT

    : JA4 TLS/SSL fingerprint if the client connects using HTTPS, HTTP/2 or HTTP/3. If not available, the key type defaults to

    ALL

    .

    • enforceOnKeyName

    string

    Rate limit key name applicable only for the following key types: HTTP_HEADER -- Name of the HTTP header whose value is taken as the key value. HTTP_COOKIE -- Name of the HTTP cookie whose value is taken as the key value.
    enforceOnKeyConfigs[]

    object (EnforceOnKeyConfig)

    If specified, any combination of values of enforceOnKeyType/enforceOnKeyName is treated as the key on which ratelimit threshold/action is enforced. You can specify up to 3 enforceOnKeyConfigs. If enforceOnKeyConfigs is specified, enforceOnKey must not be specified.
    banThreshold

    object (Threshold)

    Can only be specified if the action for the rule is "rate_based_ban". If specified, the key will be banned for the configured 'banDurationSec' when the number of requests that exceed the 'rateLimitThreshold' also exceed this 'banThreshold'.
    banDurationSec

    integer

    Can only be specified if the action for the rule is "rate_based_ban". If specified, determines the time (in seconds) the traffic will continue to be banned by the rate limit after the rate falls below the threshold.

    Threshold

    JSON representation 
    {
  "count": integer,
  "intervalSec": integer
}
    Fields
    count

    integer

    Number of HTTP(S) requests for calculating the threshold.
    intervalSec

    integer

    Interval over which the threshold is computed.

    RedirectOptions

    JSON representation 
    {
  "type": enum (RedirectType),
  "target": string
}
    Fields
    type

    enum (RedirectType)

    Type of the redirect action. Possible values are:

    • GOOGLE_RECAPTCHA

      : redirect to reCAPTCHA for manual challenge assessment.

    • EXTERNAL_302

      : redirect to a different URL via a 302 response.
    target

    string

    Target for the redirect action. This is required if the type is EXTERNAL_302 and cannot be specified for GOOGLE_RECAPTCHA.

    RedirectType

    Enums
    GOOGLE_RECAPTCHA
    EXTERNAL_302

    EnforceOnKey

    Enums
    IP
    ALL
    HTTP_HEADER
    XFF_IP
    HTTP_PATH
    SNI
    REGION_CODE
    TLS_JA3_FINGERPRINT
    USER_IP
    TLS_JA4_FINGERPRINT

    EnforceOnKeyConfig

    JSON representation 
    {
  "enforceOnKeyType": enum (EnforceOnKey),
  "enforceOnKeyName": string
}
    Fields
    enforceOnKeyType

    enum (EnforceOnKey)

    Determines the key to enforce the rateLimitThreshold on. Possible values are:

    • ALL

      : A single rate limit threshold is applied to all the requests matching this rule. This is the default value if "enforceOnKeyConfigs" is not configured.

    • IP

      : The source IP address of the request is the key. Each IP has this limit enforced separately.

    • HTTP_HEADER

      : The value of the HTTP header whose name is configured under "enforceOnKeyName". The key value is truncated to the first 128 bytes of the header value. If no such header is present in the request, the key type defaults to

      ALL

      .

    • XFF_IP

      : The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP header. If no such header is present or the value is not a valid IP, the key defaults to the source IP address of the request i.e. key type

      IP

      .

    • HTTP_COOKIE

      : The value of the HTTP cookie whose name is configured under "enforceOnKeyName". The key value is truncated to the first 128 bytes of the cookie value. If no such cookie is present in the request, the key type defaults to

      ALL

      .

    • HTTP_PATH

      : The URL path of the HTTP request. The key value is truncated to the first 128 bytes.

    • SNI

      : Server name indication in the TLS session of the HTTPS request. The key value is truncated to the first 128 bytes. The key type defaults to

      ALL

      on a HTTP session.

    • REGION_CODE

      : The country/region from which the request originates.

    • TLS_JA3_FINGERPRINT

      : JA3 TLS/SSL fingerprint if the client connects using HTTPS, HTTP/2 or HTTP/3. If not available, the key type defaults to

      ALL

      .

    • USER_IP

      : The IP address of the originating client, which is resolved based on "userIpRequestHeaders" configured with the security policy. If there is no "userIpRequestHeaders" configuration or an IP address cannot be resolved from it, the key type defaults to

      IP

      .

  • TLS_JA4_FINGERPRINT

    : JA4 TLS/SSL fingerprint if the client connects using HTTPS, HTTP/2 or HTTP/3. If not available, the key type defaults to

    ALL

    .

    • enforceOnKeyName

    string

    Rate limit key name applicable only for the following key types: HTTP_HEADER -- Name of the HTTP header whose value is taken as the key value. HTTP_COOKIE -- Name of the HTTP cookie whose value is taken as the key value.

    HttpHeaderAction

    JSON representation 
    {
  "requestHeadersToAdds": [
    {
      object (HttpHeaderOption)
    }
  ]
}
    Fields
    requestHeadersToAdds[]

    object (HttpHeaderOption)

    The list of request headers to add or overwrite if they're already present.

    HttpHeaderOption

    JSON representation 
    {
  "headerName": string,
  "headerValue": string
}
    Fields
    headerName

    string

    The name of the header to set.
    headerValue

    string

    The value to set the named header to.

    PreconfiguredWafConfig

    JSON representation 
    {
  "exclusions": [
    {
      object (Exclusion)
    }
  ]
}
    Fields
    exclusions[]

    object (Exclusion)

    A list of exclusions to apply during preconfigured WAF evaluation.

    Exclusion

    JSON representation 
    {
  "targetRuleSet": string,
  "targetRuleIds": [
    string
  ],
  "requestHeadersToExclude": [
    {
      object (FieldParams)
    }
  ],
  "requestCookiesToExclude": [
    {
      object (FieldParams)
    }
  ],
  "requestQueryParamsToExclude": [
    {
      object (FieldParams)
    }
  ],
  "requestUrisToExclude": [
    {
      object (FieldParams)
    }
  ]
}
    Fields
    targetRuleSet

    string

    Target WAF rule set to apply the preconfigured WAF exclusion.
    targetRuleIds[]

    string

    A list of target rule IDs under the WAF rule set to apply the preconfigured WAF exclusion. If omitted, it refers to all the rule IDs under the WAF rule set.
    requestHeadersToExclude[]

    object (FieldParams)

    A list of request header names whose value will be excluded from inspection during preconfigured WAF evaluation.
    requestQueryParamsToExclude[]

    object (FieldParams)

    A list of request query parameter names whose value will be excluded from inspection during preconfigured WAF evaluation. Note that the parameter can be in the query string or in the POST body.
    requestUrisToExclude[]

    object (FieldParams)

    A list of request URIs from the request line to be excluded from inspection during preconfigured WAF evaluation. When specifying this field, the query or fragment part should be excluded.

    FieldParams

    JSON representation 
    {
  "val": string,
  "op": enum (FieldOp)
}
    Fields
    val

    string

    The value of the field.
    op

    enum (FieldOp)

    The match operator for the field.

    FieldOp

    Enums
    EQUALS The operator matches if the field value equals the specified value.
    STARTS_WITH The operator matches if the field value starts with the specified value.
    ENDS_WITH The operator matches if the field value ends with the specified value.
    CONTAINS The operator matches if the field value contains the specified value.
    EQUALS_ANY The operator matches if the field value is any value.