-
Notifications
You must be signed in to change notification settings - Fork 30
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: Add support for Automatically deploy Adaptive Protection sugges…
…ted rules (#61)
- Loading branch information
1 parent
d806a37
commit 1dd4e0c
Showing
18 changed files
with
560 additions
and
30 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
67 changes: 67 additions & 0 deletions
67
examples/security-policy-managed-protection-plus/README.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,67 @@ | ||
| # Cloud Armor Policy with rules supported by [Cloud Armor Managed Protection Plus (CAMP+)](https://cloud.google.com/armor/docs/managed-protection-overview) | ||
|
|
||
| This example configures a single cloud armor policy with following types of rules: | ||
| - Threat Intelligence Rules | ||
| - Rule for Automatically deploying Adaptive Protection suggested rules | ||
|
|
||
|
|
||
| ## Usage | ||
|
|
||
| To run this example you need to execute: | ||
|
|
||
| ```bash | ||
| export TF_VAR_project_id="your_project_id" | ||
| ``` | ||
|
|
||
| ```bash | ||
| terraform init | ||
| terraform plan | ||
| terraform apply | ||
| ``` | ||
|
|
||
| <!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK --> | ||
| ## Inputs | ||
|
|
||
| | Name | Description | Type | Default | Required | | ||
| |------|-------------|------|---------|:--------:| | ||
| | project\_id | The project in which the resource belongs | `string` | n/a | yes | | ||
|
|
||
| ## Outputs | ||
|
|
||
| | Name | Description | | ||
| |------|-------------| | ||
| | policy\_name | Security Policy name | | ||
| | project\_id | The project ID | | ||
| | security\_policy | Cloud Armor security policy created | | ||
|
|
||
| <!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK --> | ||
|
|
||
| ## For testing `redirect` and `throttle` policies replace `adaptive_protection_auto_deploy` with the following in `main.tf` | ||
|
|
||
| ### Example 1 (redirect): | ||
|
|
||
| ``` | ||
| adaptive_protection_auto_deploy = { | ||
| enable = true | ||
| priority = 100000 | ||
| action = "redirect" | ||
| redirect_type = "GOOGLE_RECAPTCHA" | ||
| } | ||
| ``` | ||
|
|
||
| ### Example 2 (throttle): | ||
|
|
||
| ``` | ||
| adaptive_protection_auto_deploy = { | ||
| enable = true | ||
| priority = 100000 | ||
| action = "throttle" | ||
| rate_limit_options = { | ||
| exceed_action = "deny(502)" | ||
| rate_limit_http_request_count = 500 | ||
| rate_limit_http_request_interval_sec = 120 | ||
| enforce_on_key = "IP" | ||
| } | ||
| } | ||
| ``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,59 @@ | ||
| /** | ||
| * Copyright 2023 Google LLC | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
|
|
||
| resource "random_id" "suffix" { | ||
| byte_length = 4 | ||
| } | ||
| module "cloud_armor" { | ||
| source = "../../" | ||
|
|
||
| project_id = var.project_id | ||
| name = "test-camp-policy-${random_id.suffix.hex}" | ||
| description = "Test Cloud Armor security policy with with rules supported by Cloud Armor Managed Protection Plus (CAMP+)" | ||
| default_rule_action = "allow" | ||
| type = "CLOUD_ARMOR" | ||
| layer_7_ddos_defense_enable = true | ||
| layer_7_ddos_defense_rule_visibility = "PREMIUM" | ||
|
|
||
| ## This is an example of deny policy. Examples for redirect and throttle policies are in README. | ||
| adaptive_protection_auto_deploy = { | ||
| enable = true | ||
| priority = 100000 | ||
| action = "deny(403)" | ||
| } | ||
|
|
||
| threat_intelligence_rules = { | ||
|
|
||
| deny_malicious_ips = { | ||
| action = "deny(502)" | ||
| priority = 300 | ||
| description = "Deny IP addresses known to attack web applications" | ||
| preview = false | ||
| feed = "iplist-known-malicious-ips" | ||
| exclude_ip = "['47.100.100.100', '47.189.12.139']" | ||
| } | ||
|
|
||
| deny_tor_exit_ips = { | ||
| action = "deny(502)" | ||
| priority = 400 | ||
| description = "Deny Tor exit nodes IP addresses" | ||
| preview = false | ||
| feed = "iplist-tor-exit-nodes" | ||
| } | ||
|
|
||
| } | ||
|
|
||
| } |
Oops, something went wrong.