CloudArmor Customized Rules and WAF

[oownus]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment. If the issue is assigned to the "modular-magician" user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If the issue is assigned to a user, that user is claiming responsibility for the issue. If the issue is assigned to "hashibot", a community member has claimed the issue already.

Description

CloudArmor has a new feature, custom rules, which lets you define rule expressions. Currently, the provider doesn't seem to allow defining them through terraform.

New or Affected Resource(s)

• google_compute_security_policy

Potential Terraform Configuration

resource "google_compute_security_policy" "policy" {
  name = "my-policy"

  rule {
    action   = "deny(403)"
    priority = "1000"
    match {
      expr {
        expression": "evaluatePreconfiguredExpr('xss-canary')"
      }
    },
    description = "Deny access to XSS attempts"
  }

  rule {
    action   = "allow"
    priority = "2147483647"
    match {
      versioned_expr = "SRC_IPS_V1"
      config {
        src_ip_ranges = ["*"]
      }
    }
    description = "default rule"
  }
}

References

• https://cloud.google.com/blog/products/identity-security/understanding-google-cloud-armors-new-waf-capabilities
• https://www.terraform.io/docs/providers/google/r/compute_security_policy.html

[oownus]

Hello, thanks to @megan07 and @danawillow for getting this issue closed. In which release could we expect to see this change? Thanks!

[danawillow]

You can expect it in 3.2.0, which should be coming out tomorrowish

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!