security_policies

Creates, updates, deletes, gets or lists a security_policies resource.

Overview

Name	security_policies
Type	Resource
Id	google.compute.security_policies

Fields

The following fields are returned by SELECT queries:

get

Successful response

Name	Datatype	Description
id	string (uint64)	[Output Only] The unique identifier for the resource. This identifier is defined by the server.
name	string	Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])? which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash. (pattern: a-z?)
adaptiveProtectionConfig	object	Configuration options for Cloud Armor Adaptive Protection (CAAP). (id: SecurityPolicyAdaptiveProtectionConfig)
advancedOptionsConfig	object	(id: SecurityPolicyAdvancedOptionsConfig)
creationTimestamp	string	[Output Only] Creation timestamp in RFC3339 text format.
ddosProtectionConfig	object	(id: SecurityPolicyDdosProtectionConfig)
description	string	An optional description of this resource. Provide this property when you create the resource.
fingerprint	string (byte)	Specifies a fingerprint for this resource, which is essentially a hash of the metadata's contents and used for optimistic locking. The fingerprint is initially generated by Compute Engine and changes after every request to modify or update metadata. You must always provide an up-to-date fingerprint hash in order to update or change metadata, otherwise the request will fail with error 412 conditionNotMet. To see the latest fingerprint, make get() request to the security policy.
kind	string	[Output only] Type of the resource. Always compute#securityPolicyfor security policies (default: compute#securityPolicy)
labelFingerprint	string (byte)	A fingerprint for the labels being applied to this security policy, which is essentially a hash of the labels set used for optimistic locking. The fingerprint is initially generated by Compute Engine and changes after every request to modify or update labels. You must always provide an up-to-date fingerprint hash in order to update or change labels. To see the latest fingerprint, make get() request to the security policy.
labels	object	Labels for this resource. These can only be added or modified by the setLabels method. Each label key/value pair must comply with RFC1035. Label values may be empty.
recaptchaOptionsConfig	object	(id: SecurityPolicyRecaptchaOptionsConfig)
region	string	[Output Only] URL of the region where the regional security policy resides. This field is not applicable to global security policies.
rules	array	A list of rules that belong to this policy. There must always be a default rule which is a rule with priority 2147483647 and match all condition (for the match condition this means match "" for srcIpRanges and for the networkMatch condition every field must be either match "" or not set). If no rules are provided when creating a security policy, a default rule with action "allow" will be added.
selfLink	string	[Output Only] Server-defined URL for the resource.
type	string	The type indicates the intended use of the security policy. - CLOUD_ARMOR: Cloud Armor backend security policies can be configured to filter incoming HTTP requests targeting backend services. They filter requests before they hit the origin servers. - CLOUD_ARMOR_EDGE: Cloud Armor edge security policies can be configured to filter incoming HTTP requests targeting backend services (including Cloud CDN-enabled) as well as backend buckets (Cloud Storage). They filter requests before the request is served from Google's cache. - CLOUD_ARMOR_INTERNAL_SERVICE (preview only): Cloud Armor internal service policies can be configured to filter HTTP requests targeting services managed by Traffic Director in a service mesh. They filter requests before the request is served from the application. - CLOUD_ARMOR_NETWORK: Cloud Armor network policies can be configured to filter packets targeting network load balancing resources such as backend services, target pools, target instances, and instances with external IPs. They filter requests before the request is served from the application. This field can be set only at resource creation time.
userDefinedFields	array	Definitions of user-defined fields for CLOUD_ARMOR_NETWORK policies. A user-defined field consists of up to 4 bytes extracted from a fixed offset in the packet, relative to the IPv4, IPv6, TCP, or UDP header, with an optional mask to select certain bits. Rules may then specify matching values for these fields. Example: userDefinedFields: - name: "ipv4_fragment_offset" base: IPV4 offset: 6 size: 2 mask: "0x1fff"

list

Successful response

Name	Datatype	Description
id	string	[Output Only] Unique identifier for the resource; defined by the server.
items	array	A list of SecurityPolicy resources.
kind	string	[Output Only] Type of resource. Always compute#securityPolicyList for listsof securityPolicies (default: compute#securityPolicyList)
nextPageToken	string	[Output Only] This token allows you to get the next page of results for list requests. If the number of results is larger than maxResults, use the nextPageToken as a value for the query parameter pageToken in the next list request. Subsequent list requests will have their own nextPageToken to continue paging through the results.
warning	object	[Output Only] Informational warning message.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	project, region, securityPolicy		List all of the ordered rules present in a single specified policy.
list	select	project, region	filter, maxResults, orderBy, pageToken, returnPartialSuccess	List all the policies that have been configured for the specified project and region.
insert	insert	project, region	requestId, validateOnly	Creates a new policy in the specified project using the data included in the request.
patch	update	project, region, securityPolicy	requestId, updateMask	Patches the specified policy with the data included in the request. To clear fields in the policy, leave the fields empty and specify them in the updateMask. This cannot be used to be update the rules in the policy. Please use the per rule methods like addRule, patchRule, and removeRule instead.
patch_rule	update	project, region, securityPolicy	priority, updateMask, validateOnly	Patches a rule at the specified priority. To clear fields in the rule, leave the fields empty and specify them in the updateMask.
delete	delete	project, region, securityPolicy	requestId	Deletes the specified policy.
set_labels	exec	project, region, resource	requestId	Sets the labels on a security policy. To learn more about labels, read the Labeling Resources documentation.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
project	string
region	string
resource	string
securityPolicy	string
filter	string
maxResults	integer (uint32)
orderBy	string
pageToken	string
priority	integer (int32)
requestId	string
returnPartialSuccess	boolean
updateMask	string (google-fieldmask)
validateOnly	boolean

SELECT examples

get

List all of the ordered rules present in a single specified policy.

SELECT
id,
name,
adaptiveProtectionConfig,
advancedOptionsConfig,
creationTimestamp,
ddosProtectionConfig,
description,
fingerprint,
kind,
labelFingerprint,
labels,
recaptchaOptionsConfig,
region,
rules,
selfLink,
type,
userDefinedFields
FROM google.compute.security_policies
WHERE project = '{{ project }}' -- required
AND region = '{{ region }}' -- required
AND securityPolicy = '{{ securityPolicy }}' -- required;

list

List all the policies that have been configured for the specified project and region.

SELECT
id,
items,
kind,
nextPageToken,
warning
FROM google.compute.security_policies
WHERE project = '{{ project }}' -- required
AND region = '{{ region }}' -- required
AND filter = '{{ filter }}'
AND maxResults = '{{ maxResults }}'
AND orderBy = '{{ orderBy }}'
AND pageToken = '{{ pageToken }}'
AND returnPartialSuccess = '{{ returnPartialSuccess }}';

INSERT examples

insert

Creates a new policy in the specified project using the data included in the request.

INSERT INTO google.compute.security_policies (
data__userDefinedFields,
data__kind,
data__id,
data__creationTimestamp,
data__name,
data__description,
data__rules,
data__adaptiveProtectionConfig,
data__ddosProtectionConfig,
data__advancedOptionsConfig,
data__recaptchaOptionsConfig,
data__fingerprint,
data__selfLink,
data__type,
data__labels,
data__labelFingerprint,
data__region,
project,
region,
requestId,
validateOnly
)
SELECT 
'{{ userDefinedFields }}',
'{{ kind }}',
'{{ id }}',
'{{ creationTimestamp }}',
'{{ name }}',
'{{ description }}',
'{{ rules }}',
'{{ adaptiveProtectionConfig }}',
'{{ ddosProtectionConfig }}',
'{{ advancedOptionsConfig }}',
'{{ recaptchaOptionsConfig }}',
'{{ fingerprint }}',
'{{ selfLink }}',
'{{ type }}',
'{{ labels }}',
'{{ labelFingerprint }}',
'{{ region }}',
'{{ project }}',
'{{ region }}',
'{{ requestId }}',
'{{ validateOnly }}'
RETURNING
id,
name,
clientOperationId,
creationTimestamp,
description,
endTime,
error,
httpErrorMessage,
httpErrorStatusCode,
insertTime,
instancesBulkInsertOperationMetadata,
kind,
operationGroupId,
operationType,
progress,
region,
selfLink,
setCommonInstanceMetadataOperationMetadata,
startTime,
status,
statusMessage,
targetId,
targetLink,
user,
warnings,
zone
;

Manifest

# Description fields are for documentation purposes
- name: security_policies
  props:
    - name: project
      value: string
      description: Required parameter for the security_policies resource.
    - name: region
      value: string
      description: Required parameter for the security_policies resource.
    - name: userDefinedFields
      value: array
      description: >
        Definitions of user-defined fields for CLOUD_ARMOR_NETWORK policies. A user-defined field consists of up to 4 bytes extracted from a fixed offset in the packet, relative to the IPv4, IPv6, TCP, or UDP header, with an optional mask to select certain bits. Rules may then specify matching values for these fields. Example: userDefinedFields: - name: "ipv4_fragment_offset" base: IPV4 offset: 6 size: 2 mask: "0x1fff"
        
    - name: kind
      value: string
      description: >
        [Output only] Type of the resource. Always compute#securityPolicyfor security policies
        
      default: compute#securityPolicy
    - name: id
      value: string
      description: >
        [Output Only] The unique identifier for the resource. This identifier is defined by the server.
        
    - name: creationTimestamp
      value: string
      description: >
        [Output Only] Creation timestamp in RFC3339 text format.
        
    - name: name
      value: string
      description: >
        Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?` which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
        
    - name: description
      value: string
      description: >
        An optional description of this resource. Provide this property when you create the resource.
        
    - name: rules
      value: array
      description: >
        A list of rules that belong to this policy. There must always be a default rule which is a rule with priority 2147483647 and match all condition (for the match condition this means match "*" for srcIpRanges and for the networkMatch condition every field must be either match "*" or not set). If no rules are provided when creating a security policy, a default rule with action "allow" will be added.
        
    - name: adaptiveProtectionConfig
      value: object
      description: >
        Configuration options for Cloud Armor Adaptive Protection (CAAP).
        
    - name: ddosProtectionConfig
      value: object
    - name: advancedOptionsConfig
      value: object
    - name: recaptchaOptionsConfig
      value: object
    - name: fingerprint
      value: string
      description: >
        Specifies a fingerprint for this resource, which is essentially a hash of the metadata's contents and used for optimistic locking. The fingerprint is initially generated by Compute Engine and changes after every request to modify or update metadata. You must always provide an up-to-date fingerprint hash in order to update or change metadata, otherwise the request will fail with error 412 conditionNotMet. To see the latest fingerprint, make get() request to the security policy.
        
    - name: selfLink
      value: string
      description: >
        [Output Only] Server-defined URL for the resource.
        
    - name: type
      value: string
      description: >
        The type indicates the intended use of the security policy. - CLOUD_ARMOR: Cloud Armor backend security policies can be configured to filter incoming HTTP requests targeting backend services. They filter requests before they hit the origin servers. - CLOUD_ARMOR_EDGE: Cloud Armor edge security policies can be configured to filter incoming HTTP requests targeting backend services (including Cloud CDN-enabled) as well as backend buckets (Cloud Storage). They filter requests before the request is served from Google's cache. - CLOUD_ARMOR_INTERNAL_SERVICE (preview only): Cloud Armor internal service policies can be configured to filter HTTP requests targeting services managed by Traffic Director in a service mesh. They filter requests before the request is served from the application. - CLOUD_ARMOR_NETWORK: Cloud Armor network policies can be configured to filter packets targeting network load balancing resources such as backend services, target pools, target instances, and instances with external IPs. They filter requests before the request is served from the application. This field can be set only at resource creation time.
        
      valid_values: ['CLOUD_ARMOR', 'CLOUD_ARMOR_EDGE', 'CLOUD_ARMOR_NETWORK']
    - name: labels
      value: object
      description: >
        Labels for this resource. These can only be added or modified by the setLabels method. Each label key/value pair must comply with RFC1035. Label values may be empty.
        
    - name: labelFingerprint
      value: string
      description: >
        A fingerprint for the labels being applied to this security policy, which is essentially a hash of the labels set used for optimistic locking. The fingerprint is initially generated by Compute Engine and changes after every request to modify or update labels. You must always provide an up-to-date fingerprint hash in order to update or change labels. To see the latest fingerprint, make get() request to the security policy.
        
    - name: region
      value: string
      description: >
        [Output Only] URL of the region where the regional security policy resides. This field is not applicable to global security policies.
        
    - name: requestId
      value: string
    - name: validateOnly
      value: boolean

UPDATE examples

patch

Patches the specified policy with the data included in the request. To clear fields in the policy, leave the fields empty and specify them in the updateMask. This cannot be used to be update the rules in the policy. Please use the per rule methods like addRule, patchRule, and removeRule instead.

UPDATE google.compute.security_policies
SET 
data__userDefinedFields = '{{ userDefinedFields }}',
data__kind = '{{ kind }}',
data__id = '{{ id }}',
data__creationTimestamp = '{{ creationTimestamp }}',
data__name = '{{ name }}',
data__description = '{{ description }}',
data__rules = '{{ rules }}',
data__adaptiveProtectionConfig = '{{ adaptiveProtectionConfig }}',
data__ddosProtectionConfig = '{{ ddosProtectionConfig }}',
data__advancedOptionsConfig = '{{ advancedOptionsConfig }}',
data__recaptchaOptionsConfig = '{{ recaptchaOptionsConfig }}',
data__fingerprint = '{{ fingerprint }}',
data__selfLink = '{{ selfLink }}',
data__type = '{{ type }}',
data__labels = '{{ labels }}',
data__labelFingerprint = '{{ labelFingerprint }}',
data__region = '{{ region }}'
WHERE 
project = '{{ project }}' --required
AND region = '{{ region }}' --required
AND securityPolicy = '{{ securityPolicy }}' --required
AND requestId = '{{ requestId}}'
AND updateMask = '{{ updateMask}}'
RETURNING
id,
name,
clientOperationId,
creationTimestamp,
description,
endTime,
error,
httpErrorMessage,
httpErrorStatusCode,
insertTime,
instancesBulkInsertOperationMetadata,
kind,
operationGroupId,
operationType,
progress,
region,
selfLink,
setCommonInstanceMetadataOperationMetadata,
startTime,
status,
statusMessage,
targetId,
targetLink,
user,
warnings,
zone;

patch_rule

Patches a rule at the specified priority. To clear fields in the rule, leave the fields empty and specify them in the updateMask.

UPDATE google.compute.security_policies
SET 
data__kind = '{{ kind }}',
data__description = '{{ description }}',
data__priority = {{ priority }},
data__match = '{{ match }}',
data__networkMatch = '{{ networkMatch }}',
data__action = '{{ action }}',
data__preview = {{ preview }},
data__rateLimitOptions = '{{ rateLimitOptions }}',
data__headerAction = '{{ headerAction }}',
data__redirectOptions = '{{ redirectOptions }}',
data__preconfiguredWafConfig = '{{ preconfiguredWafConfig }}'
WHERE 
project = '{{ project }}' --required
AND region = '{{ region }}' --required
AND securityPolicy = '{{ securityPolicy }}' --required
AND priority = '{{ priority}}'
AND updateMask = '{{ updateMask}}'
AND validateOnly = {{ validateOnly}}
RETURNING
id,
name,
clientOperationId,
creationTimestamp,
description,
endTime,
error,
httpErrorMessage,
httpErrorStatusCode,
insertTime,
instancesBulkInsertOperationMetadata,
kind,
operationGroupId,
operationType,
progress,
region,
selfLink,
setCommonInstanceMetadataOperationMetadata,
startTime,
status,
statusMessage,
targetId,
targetLink,
user,
warnings,
zone;

DELETE examples

delete

Deletes the specified policy.

DELETE FROM google.compute.security_policies
WHERE project = '{{ project }}' --required
AND region = '{{ region }}' --required
AND securityPolicy = '{{ securityPolicy }}' --required
AND requestId = '{{ requestId }}';

Lifecycle Methods

set_labels

Sets the labels on a security policy. To learn more about labels, read the Labeling Resources documentation.

EXEC google.compute.security_policies.set_labels 
@project='{{ project }}' --required, 
@region='{{ region }}' --required, 
@resource='{{ resource }}' --required, 
@requestId='{{ requestId }}' 
@@json=
'{
"labels": "{{ labels }}", 
"labelFingerprint": "{{ labelFingerprint }}"
}';