A rule for the RegionSecurityPolicy.
To get more information about RegionSecurityPolicyRule, see:
resource "google_compute_region_security_policy" "default" {
provider = google-beta
region = "us-west2"
name = "policyruletest"
description = "basic region security policy"
type = "CLOUD_ARMOR"
}
resource "google_compute_region_security_policy_rule" "policy_rule" {
provider = google-beta
region = "us-west2"
security_policy = google_compute_region_security_policy.default.name
description = "new rule"
priority = 100
match {
versioned_expr = "SRC_IPS_V1"
config {
src_ip_ranges = ["10.10.0.0/16"]
}
}
action = "allow"
preview = true
}
resource "google_compute_region_security_policy" "default" {
provider = google-beta
region = "us-west2"
name = "policywithmultiplerules"
description = "basic region security policy"
type = "CLOUD_ARMOR"
}
resource "google_compute_region_security_policy_rule" "policy_rule_one" {
provider = google-beta
region = "us-west2"
security_policy = google_compute_region_security_policy.default.name
description = "new rule one"
priority = 100
match {
versioned_expr = "SRC_IPS_V1"
config {
src_ip_ranges = ["10.10.0.0/16"]
}
}
action = "allow"
preview = true
}
resource "google_compute_region_security_policy_rule" "policy_rule_two" {
provider = google-beta
region = "us-west2"
security_policy = google_compute_region_security_policy.default.name
description = "new rule two"
priority = 101
match {
versioned_expr = "SRC_IPS_V1"
config {
src_ip_ranges = ["192.168.0.0/16", "10.0.0.0/8"]
}
}
action = "allow"
preview = true
}
# First activate advanced network DDoS protection for the desired region
resource "google_compute_region_security_policy" "policyddosprotection" {
provider = google-beta
region = "us-west2"
name = "policyddosprotection"
description = "policy for activating network DDoS protection for the desired region"
type = "CLOUD_ARMOR_NETWORK"
ddos_protection_config {
ddos_protection = "ADVANCED_PREVIEW"
}
}
resource "google_compute_network_edge_security_service" "edge_sec_service" {
provider = google-beta
region = "us-west2"
name = "edgesecservice"
description = "linking policy to edge security service"
security_policy = google_compute_region_security_policy.policyddosprotection.self_link
}
# Add the desired policy and custom rule.
resource "google_compute_region_security_policy" "policynetworkmatch" {
provider = google-beta
region = "us-west2"
name = "policyfornetworkmatch"
description = "region security policy for network match"
type = "CLOUD_ARMOR_NETWORK"
user_defined_fields {
name = "SIG1_AT_0"
base = "TCP"
offset = 8
size = 2
mask = "0x8F00"
}
depends_on = [google_compute_network_edge_security_service.edge_sec_service]
}
resource "google_compute_region_security_policy_rule" "policy_rule_network_match" {
provider = google-beta
region = "us-west2"
security_policy = google_compute_region_security_policy.policynetworkmatch.name
description = "custom rule for network match"
priority = 100
network_match {
src_ip_ranges = ["10.10.0.0/16"]
user_defined_fields {
name = "SIG1_AT_0"
values = ["0x8F00"]
}
}
action = "allow"
preview = true
}
The following arguments are supported:
priority
-
(Required)
An integer indicating the priority of a rule in the list.
The priority must be a positive value between 0 and 2147483647.
Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest priority.
action
-
(Required)
The Action to perform when the rule is matched. The following are the valid actions:
region
-
(Required)
The Region in which the created Region Security Policy rule should reside.
security_policy
-
(Required)
The name of the security policy this rule belongs to.
description
-
(Optional)
An optional description of this resource. Provide this property when you create the resource.
match
-
(Optional)
A match condition that incoming traffic is evaluated against.
If it evaluates to true, the corresponding 'action' is enforced.
Structure is documented below.
preview
-
(Optional)
If set to true, the specified action is not enforced.
network_match
-
(Optional)
A match condition that incoming packets are evaluated against for CLOUD_ARMOR_NETWORK security policies. If it matches, the corresponding 'action' is enforced.
The match criteria for a rule consists of built-in match fields (like 'srcIpRanges') and potentially multiple user-defined match fields ('userDefinedFields').
Field values may be extracted directly from the packet or derived from it (e.g. 'srcRegionCodes'). Some fields may not be present in every packet (e.g. 'srcPorts'). A user-defined field is only present if the base header is found in the packet and the entire field is in bounds.
Each match field may specify which values can match it, listing one or more ranges, prefixes, or exact values that are considered a match for the field. A field value must be present in order to match a specified match field. If no match values are specified for a match field, then any field value is considered to match it, and it's not required to be present. For strings specifying '*' is also equivalent to match all.
For a packet to match a rule, all specified match fields must match the corresponding field values derived from the packet.
Example:
networkMatch: srcIpRanges: - "192.0.2.0/24" - "198.51.100.0/24" userDefinedFields: - name: "ipv4_fragment_offset" values: - "1-0x1fff"
The above match condition matches packets with a source IP in 192.0.2.0/24 or 198.51.100.0/24 and a user-defined field named "ipv4_fragment_offset" with a value between 1 and 0x1fff inclusive
Structure is documented below.
project
- (Optional) The ID of the project in which the resource belongs.
If it is not provided, the provider project is used.
versioned_expr
-
(Optional)
Preconfigured versioned expression. If this field is specified, config must also be specified.
Available preconfigured expressions along with their requirements are: SRC_IPS_V1 - must specify the corresponding srcIpRange field in config.
Possible values are: SRC_IPS_V1
.
config
-
(Optional)
The configuration options available when specifying versionedExpr.
This field must be specified if versionedExpr is specified and cannot be specified if versionedExpr is not specified.
Structure is documented below.
src_ip_ranges
-
(Optional)
CIDR IP address range. Maximum number of srcIpRanges allowed is 10.The network_match
block supports:
user_defined_fields
-
(Optional)
User-defined fields. Each element names a defined field and lists the matching values for that field.
Structure is documented below.
src_ip_ranges
-
(Optional)
Source IPv4/IPv6 addresses or CIDR prefixes, in standard text format.
dest_ip_ranges
-
(Optional)
Destination IPv4/IPv6 addresses or CIDR prefixes, in standard text format.
ip_protocols
-
(Optional)
IPv4 protocol / IPv6 next header (after extension headers). Each element can be an 8-bit unsigned decimal number (e.g. "6"), range (e.g. "253-254"), or one of the following protocol names: "tcp", "udp", "icmp", "esp", "ah", "ipip", or "sctp".
src_ports
-
(Optional)
Source port numbers for TCP/UDP/SCTP. Each element can be a 16-bit unsigned decimal number (e.g. "80") or range (e.g. "0-1023").
dest_ports
-
(Optional)
Destination port numbers for TCP/UDP/SCTP. Each element can be a 16-bit unsigned decimal number (e.g. "80") or range (e.g. "0-1023").
src_region_codes
-
(Optional)
Two-letter ISO 3166-1 alpha-2 country code associated with the source IP address.
src_asns
-
(Optional)
BGP Autonomous System Number associated with the source IP address.
The user_defined_fields
block supports:
name
-
(Optional)
Name of the user-defined field, as given in the definition.
values
-
(Optional)
Matching values of the field. Each element can be a 32-bit unsigned decimal or hexadecimal (starting with "0x") number (e.g. "64") or range (e.g. "0x400-0x7ff").
In addition to the arguments listed above, the following computed attributes are exported:
id
- an identifier for the resource with format projects/{{project}}/regions/{{region}}/securityPolicies/{{security_policy}}/priority/{{priority}}
This resource provides the following Timeouts configuration options:
create
- Default is 20 minutes.update
- Default is 20 minutes.delete
- Default is 20 minutes.RegionSecurityPolicyRule can be imported using any of these accepted formats:
projects/{{project}}/regions/{{region}}/securityPolicies/{{security_policy}}/priority/{{priority}}
{{project}}/{{region}}/{{security_policy}}/{{priority}}
{{region}}/{{security_policy}}/{{priority}}
{{security_policy}}/{{priority}}
In Terraform v1.5.0 and later, use an import
block to import RegionSecurityPolicyRule using one of the formats above. For example:
import {
id = "projects/{{project}}/regions/{{region}}/securityPolicies/{{security_policy}}/priority/{{priority}}"
to = google_compute_region_security_policy_rule.default
}
When using the terraform import
command, RegionSecurityPolicyRule can be imported using one of the formats above. For example:
$ terraform import google_compute_region_security_policy_rule.default projects/{{project}}/regions/{{region}}/securityPolicies/{{security_policy}}/priority/{{priority}}
$ terraform import google_compute_region_security_policy_rule.default {{project}}/{{region}}/{{security_policy}}/{{priority}}
$ terraform import google_compute_region_security_policy_rule.default {{region}}/{{security_policy}}/{{priority}}
$ terraform import google_compute_region_security_policy_rule.default {{security_policy}}/{{priority}}
This resource supports User Project Overrides.