region_security_policies

Creates, updates, deletes, gets or lists a region_security_policies resource.

Overview

Name	region_security_policies
Type	Resource
Id	google.compute.region_security_policies

Fields

Name	Datatype	Description
id	string	[Output Only] The unique identifier for the resource. This identifier is defined by the server.
name	string	Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])? which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
description	string	An optional description of this resource. Provide this property when you create the resource.
adaptiveProtectionConfig	object	Configuration options for Cloud Armor Adaptive Protection (CAAP).
advancedOptionsConfig	object
creationTimestamp	string	[Output Only] Creation timestamp in RFC3339 text format.
ddosProtectionConfig	object
fingerprint	string	Specifies a fingerprint for this resource, which is essentially a hash of the metadata's contents and used for optimistic locking. The fingerprint is initially generated by Compute Engine and changes after every request to modify or update metadata. You must always provide an up-to-date fingerprint hash in order to update or change metadata, otherwise the request will fail with error 412 conditionNotMet. To see the latest fingerprint, make get() request to the security policy.
kind	string	[Output only] Type of the resource. Always compute#securityPolicyfor security policies
labelFingerprint	string	A fingerprint for the labels being applied to this security policy, which is essentially a hash of the labels set used for optimistic locking. The fingerprint is initially generated by Compute Engine and changes after every request to modify or update labels. You must always provide an up-to-date fingerprint hash in order to update or change labels. To see the latest fingerprint, make get() request to the security policy.
labels	object	Labels for this resource. These can only be added or modified by the setLabels method. Each label key/value pair must comply with RFC1035. Label values may be empty.
recaptchaOptionsConfig	object
region	string	[Output Only] URL of the region where the regional security policy resides. This field is not applicable to global security policies.
rules	array	A list of rules that belong to this policy. There must always be a default rule which is a rule with priority 2147483647 and match all condition (for the match condition this means match "" for srcIpRanges and for the networkMatch condition every field must be either match "" or not set). If no rules are provided when creating a security policy, a default rule with action "allow" will be added.
selfLink	string	[Output Only] Server-defined URL for the resource.
type	string	The type indicates the intended use of the security policy. - CLOUD_ARMOR: Cloud Armor backend security policies can be configured to filter incoming HTTP requests targeting backend services. They filter requests before they hit the origin servers. - CLOUD_ARMOR_EDGE: Cloud Armor edge security policies can be configured to filter incoming HTTP requests targeting backend services (including Cloud CDN-enabled) as well as backend buckets (Cloud Storage). They filter requests before the request is served from Google's cache. - CLOUD_ARMOR_INTERNAL_SERVICE: Cloud Armor internal service policies can be configured to filter HTTP requests targeting services managed by Traffic Director in a service mesh. They filter requests before the request is served from the application. - CLOUD_ARMOR_NETWORK: Cloud Armor network policies can be configured to filter packets targeting network load balancing resources such as backend services, target pools, target instances, and instances with external IPs. They filter requests before the request is served from the application. This field can be set only at resource creation time.
userDefinedFields	array	Definitions of user-defined fields for CLOUD_ARMOR_NETWORK policies. A user-defined field consists of up to 4 bytes extracted from a fixed offset in the packet, relative to the IPv4, IPv6, TCP, or UDP header, with an optional mask to select certain bits. Rules may then specify matching values for these fields. Example: userDefinedFields: - name: "ipv4_fragment_offset" base: IPV4 offset: 6 size: 2 mask: "0x1fff"

Methods

Name	Accessible by	Required Params	Description
get	SELECT	project, region, securityPolicy	List all of the ordered rules present in a single specified policy.
list	SELECT	project, region	List all the policies that have been configured for the specified project and region.
insert	INSERT	project, region	Creates a new policy in the specified project using the data included in the request.
delete	DELETE	project, region, securityPolicy	Deletes the specified policy.
patch	UPDATE	project, region, securityPolicy	Patches the specified policy with the data included in the request. To clear fields in the policy, leave the fields empty and specify them in the updateMask. This cannot be used to be update the rules in the policy. Please use the per rule methods like addRule, patchRule, and removeRule instead.
patch_rule	UPDATE	project, region, securityPolicy	Patches a rule at the specified priority. To clear fields in the rule, leave the fields empty and specify them in the updateMask.

SELECT examples

List all the policies that have been configured for the specified project and region.

SELECT
id,
name,
description,
adaptiveProtectionConfig,
advancedOptionsConfig,
creationTimestamp,
ddosProtectionConfig,
fingerprint,
kind,
labelFingerprint,
labels,
recaptchaOptionsConfig,
region,
rules,
selfLink,
type,
userDefinedFields
FROM google.compute.region_security_policies
WHERE project = '{{ project }}'
AND region = '{{ region }}';

INSERT example

Use the following StackQL query and manifest file to create a new region_security_policies resource.

All Properties

/*+ create */
INSERT INTO google.compute.region_security_policies (
project,
region,
userDefinedFields,
name,
description,
rules,
adaptiveProtectionConfig,
ddosProtectionConfig,
advancedOptionsConfig,
recaptchaOptionsConfig,
fingerprint,
type,
labels,
labelFingerprint,
region
)
SELECT 
'{{ project }}',
'{{ region }}',
'{{ userDefinedFields }}',
'{{ name }}',
'{{ description }}',
'{{ rules }}',
'{{ adaptiveProtectionConfig }}',
'{{ ddosProtectionConfig }}',
'{{ advancedOptionsConfig }}',
'{{ recaptchaOptionsConfig }}',
'{{ fingerprint }}',
'{{ type }}',
'{{ labels }}',
'{{ labelFingerprint }}',
'{{ region }}'
;

Manifest

- name: your_resource_model_name
  props:
    - name: userDefinedFields
      value:
        - - name: name
            value: string
          - name: base
            value: string
          - name: offset
            value: integer
          - name: size
            value: integer
          - name: mask
            value: string
    - name: kind
      value: string
    - name: id
      value: string
    - name: creationTimestamp
      value: string
    - name: name
      value: string
    - name: description
      value: string
    - name: rules
      value:
        - - name: kind
            value: string
          - name: description
            value: string
          - name: priority
            value: integer
          - name: match
            value:
              - name: expr
                value:
                  - name: expression
                    value: string
                  - name: title
                    value: string
                  - name: description
                    value: string
                  - name: location
                    value: string
              - name: exprOptions
                value:
                  - name: recaptchaOptions
                    value:
                      - name: actionTokenSiteKeys
                        value:
                          - string
                      - name: sessionTokenSiteKeys
                        value:
                          - string
              - name: versionedExpr
                value: string
              - name: config
                value:
                  - name: srcIpRanges
                    value:
                      - string
          - name: networkMatch
            value:
              - name: userDefinedFields
                value:
                  - - name: name
                      value: string
                    - name: values
                      value:
                        - string
              - name: srcIpRanges
                value:
                  - string
              - name: destIpRanges
                value:
                  - string
              - name: ipProtocols
                value:
                  - string
              - name: srcPorts
                value:
                  - string
              - name: destPorts
                value:
                  - string
              - name: srcRegionCodes
                value:
                  - string
              - name: srcAsns
                value:
                  - integer
          - name: action
            value: string
          - name: preview
            value: boolean
          - name: rateLimitOptions
            value:
              - name: rateLimitThreshold
                value:
                  - name: count
                    value: integer
                  - name: intervalSec
                    value: integer
              - name: conformAction
                value: string
              - name: exceedAction
                value: string
              - name: exceedRedirectOptions
                value:
                  - name: type
                    value: string
                  - name: target
                    value: string
              - name: enforceOnKey
                value: string
              - name: enforceOnKeyName
                value: string
              - name: enforceOnKeyConfigs
                value:
                  - - name: enforceOnKeyType
                      value: string
                    - name: enforceOnKeyName
                      value: string
              - name: banDurationSec
                value: integer
          - name: headerAction
            value:
              - name: requestHeadersToAdds
                value:
                  - - name: headerName
                      value: string
                    - name: headerValue
                      value: string
          - name: preconfiguredWafConfig
            value:
              - name: exclusions
                value:
                  - - name: targetRuleSet
                      value: string
                    - name: targetRuleIds
                      value:
                        - string
                    - name: requestHeadersToExclude
                      value:
                        - - name: val
                            value: string
                          - name: op
                            value: string
                    - name: requestCookiesToExclude
                      value:
                        - - name: val
                            value: string
                          - name: op
                            value: string
                    - name: requestQueryParamsToExclude
                      value:
                        - - name: val
                            value: string
                          - name: op
                            value: string
                    - name: requestUrisToExclude
                      value:
                        - - name: val
                            value: string
                          - name: op
                            value: string
    - name: adaptiveProtectionConfig
      value:
        - name: layer7DdosDefenseConfig
          value:
            - name: enable
              value: boolean
            - name: ruleVisibility
              value: string
            - name: thresholdConfigs
              value:
                - - name: name
                    value: string
                  - name: autoDeployLoadThreshold
                    value: number
                  - name: autoDeployConfidenceThreshold
                    value: number
                  - name: autoDeployImpactedBaselineThreshold
                    value: number
                  - name: autoDeployExpirationSec
                    value: integer
                  - name: detectionLoadThreshold
                    value: number
                  - name: detectionAbsoluteQps
                    value: number
                  - name: detectionRelativeToBaselineQps
                    value: number
                  - name: trafficGranularityConfigs
                    value:
                      - - name: type
                          value: string
                        - name: value
                          value: string
                        - name: enableEachUniqueValue
                          value: boolean
    - name: ddosProtectionConfig
      value:
        - name: ddosProtection
          value: string
    - name: advancedOptionsConfig
      value:
        - name: jsonParsing
          value: string
        - name: jsonCustomConfig
          value:
            - name: contentTypes
              value:
                - string
        - name: logLevel
          value: string
        - name: userIpRequestHeaders
          value:
            - string
    - name: recaptchaOptionsConfig
      value:
        - name: redirectSiteKey
          value: string
    - name: fingerprint
      value: string
    - name: selfLink
      value: string
    - name: type
      value: string
    - name: labels
      value: object
    - name: labelFingerprint
      value: string
    - name: region
      value: string

UPDATE example

Updates a region_security_policies resource.

/*+ update */
UPDATE google.compute.region_security_policies
SET 
userDefinedFields = '{{ userDefinedFields }}',
name = '{{ name }}',
description = '{{ description }}',
rules = '{{ rules }}',
adaptiveProtectionConfig = '{{ adaptiveProtectionConfig }}',
ddosProtectionConfig = '{{ ddosProtectionConfig }}',
advancedOptionsConfig = '{{ advancedOptionsConfig }}',
recaptchaOptionsConfig = '{{ recaptchaOptionsConfig }}',
fingerprint = '{{ fingerprint }}',
type = '{{ type }}',
labels = '{{ labels }}',
labelFingerprint = '{{ labelFingerprint }}',
region = '{{ region }}'
WHERE 
project = '{{ project }}'
AND region = '{{ region }}'
AND securityPolicy = '{{ securityPolicy }}';

DELETE example

Deletes the specified region_security_policies resource.

/*+ delete */
DELETE FROM google.compute.region_security_policies
WHERE project = '{{ project }}'
AND region = '{{ region }}'
AND securityPolicy = '{{ securityPolicy }}';