Skip to content

Google Cloud Armor Module#

This module provides a robust and flexible solution for configuring Cloud Armor security policies in Google Cloud Platform. It simplifies the creation and management of WAF rules, IP-based access controls, and advanced threat protection, enabling you to secure your applications against DDoS attacks and common web vulnerabilities.

Compatibility#

This module is compatible with Terraform version ~> 1.0 and has been tested with the following provider versions:

  • Google Provider: >= 6.28.0, < 7.0.0
  • Google Beta Provider: >= 6.28.0, < 7.0.0

Usage#

This module enables you to create and manage multiple types of Cloud Armor security policies with advanced features including:

  • Multi-Layered Policy Management: Configure multiple types of policies, including default, custom, and predefined WAF rules, to build a layered security posture.
  • IP-Based Access Control: Easily define rules to allow or deny traffic based on source IP ranges.
  • Predefined WAF Rules: Leverage Google's curated WAF rules to protect against common attacks like XSS, SQLi, and RCE.
  • Custom Rule Expressions: Implement granular access control using custom expressions with the Common Expression Language (CEL).
  • Adaptive Protection: Enable ML-based protection against Layer 7 DDoS attacks to safeguard your applications from volumetric and sophisticated threats.
  • Rule Preview Mode: Test the impact of new rules in a non-enforcing "preview" mode before they go live, ensuring safe deployments.

Basic Example with Multiple Policy Types#

module "cloud_armor" {
  source = "github.com/myops-co/gcp-terraform-modules//modules/terraform-google-cloud-armor?ref=vX.Y.Z"

  project_id = "my-project-id"

  default_policy = {
    "default-policy" = {
      description = "Default policy with allow rule for office IPs"
      rules = [
        {
          action      = "allow"
          priority    = "10000"
          preview     = false
          description = "Allow office IPs"
          match = [{
            versioned_expr = "SRC_IPS_V1"
            config         = [{ src_ip_ranges = ["77.29.40.49/32"] }]
          }]
        }
      ]
    }
  }

  custom_policies = {
    "custom-rules" = {
      description = "Custom rules for API endpoints"
      rules = [
        {
          action      = "deny(403)"
          priority    = "100"
          preview     = true # Test this rule before enforcing
          description = "Deny POST requests in preview mode"
          match = [{
            expr = [{ expression = "request.method != 'POST'" }]
          }]
        }
      ]
    }
  }

  predefined_policies = {
    "preconfigured-rules" = {
      description = "Preconfigured WAF rules for common vulnerabilities"
      rules = [
        {
          action      = "deny(403)"
          priority    = "1000"
          description = "Prevent Cross-site scripting"
          match = [{
            expr = [{ expression = "evaluatePreconfiguredExpr('xss-stable')" }]
          }]
        }
      ]
    }
  }

  adaptive_protection_config = {
    layer_7_ddos_defense_config = {
      enable = false
    }
  }

  json_parsing = "STANDARD"
}

Software#

This module requires the following software dependencies:

Service Account#

The service account used to run this module must have the following IAM roles:

  • roles/compute.securityAdmin - To create and manage Cloud Armor security policies
  • roles/compute.networkAdmin - To manage network security configurations

APIs#

The following GCP APIs must be enabled in the target project:

  • Compute Engine API (compute.googleapis.com)

License#

This module is covered by a commercial license. Please see LICENSE for details.

Support#

This module is developed and maintained by MyOps Limited. For any support inquiries, please contact us at info@myops.co.il.

Requirements#

Name Version
terraform ~> 1
google >= 6.28.0, < 7.0.0
google-beta >= 6.28.0, < 7.0.0

Providers#

Name Version
google >= 6.28.0, < 7.0.0

Modules#

No modules.

Resources#

Name Type
google_compute_security_policy.custom resource
google_compute_security_policy.custom_versioned resource
google_compute_security_policy.default resource
google_compute_security_policy.predefined resource

Inputs#

Name Description Type Default Required
adaptive_protection_config Adaptive protection config for the security policy 
object({
 layer_7_ddos_defense_config = object({
 enable = bool
 })
 })
 null no
custom_policies Map of custom policies with rules to create 
map(object({
 description = optional(string)
 rules = list(object({
 action = string
 priority = string
 preview = optional(bool, false)
 match = list(object({
 expr = list(object({
 expression = string
 }))
 }))
 description = string
 }))
 }))
 {} no
custom_versioned_policies Map of custom versioned policies with rules to create 
map(object({
 description = optional(string)
 rules = list(object({
 action = string
 priority = string
 preview = optional(bool, false)
 match = list(object({
 versioned_expr = string
 config = list(object({
 src_ip_ranges = list(string)
 }))
 }))
 description = string
 }))
 }))
 {} no
default_policy Map of default policy with rules to create 
map(object({
 description = optional(string)
 rules = list(object({
 action = string
 priority = string
 preview = optional(bool, false)
 match = list(object({
 versioned_expr = string
 config = list(object({
 src_ip_ranges = list(string)
 }))
 }))
 description = string
 }))
 }))
 n/a yes
json_parsing Sets the JSON parsing behavior for the security policy string "STANDARD" no
predefined_policies Map of GCP policies with rules to create 
map(object({
 description = optional(string)
 rules = list(object({
 action = string
 priority = string
 preview = optional(bool, false)
 match = list(object({
 expr = list(object({
 expression = string
 }))
 }))
 description = string
 }))
 }))
 {} no
project_id Project ID where to create Cloud Armor string n/a yes

Outputs#

Name Description
custom_policies Self link of custom Cloud Armor policies
custom_versioned_policies Self link of custom versioned Cloud Armor policies
default_policy Self link of default Cloud Armor policies
predefined_policies Self link of predefined Cloud Armor policies