Set up managed rules

This page describes how to enable, configure, and manage updates for Google Cloud Armor managed rules.

Deployment and update strategies

When configuring Cloud Armor managed rules, select one of the following version strategies depending on your organization's risk tolerance:

  • stable (production-validated, recommended): Google automatically updates the rules (or expedites updates for zero-day rules). This is a safe baseline recommended for production traffic.
  • canary (early access): Google automatically updates the rules with early-exposure signatures. We recommend running in preview mode ahead of the stable version.

Configuration use cases

This section describes common use cases for setting up managed rules.

Set up managed rules by category

To use managed rules, you create a security policy, add the managed rules category to the policy, and attach the policy to a backend service.

  1. Create a security policy:

    gcloud compute security-policies create POLICY_NAME \
    --global

  2. Add the stable SQL injection (sqli) managed rules to the policy with a deny action:

    gcloud compute security-policies rules create 100 \
    --security-policy POLICY_NAME \
    --action deny-403 \
    --expression "evaluateManagedRules('sqli:stable')"

  3. Attach the security policy to your backend service:

    gcloud compute backend-services update BACKEND_SERVICE \
    --global \
    --security-policy POLICY_NAME

    A Cloud Armor security policy doesn't take effect until you attach it to a backend service. Attaching the policy enables Cloud Armor to inspect and protect incoming traffic sent to that backend service.

    Replace the following:

    • POLICY_NAME: the name of the security policy
    • BACKEND_SERVICE: the name of the backend service that you want to protect

Evaluate new rules with canary preview mode

Deploying the canary version in preview mode alongside the stable version in enforced mode lets you evaluate new rules in logs before they start blocking live traffic.

  1. Add the canary version of managed rules in preview mode at a higher priority (priority 100):

    gcloud compute security-policies rules create 100 \
    --security-policy POLICY_NAME \
    --action deny-403 \
    --expression "evaluateManagedRules('xss:canary')" \
    --preview

  2. Add the stable version of managed rules in enforced mode at a lower priority (priority 200):

    gcloud compute security-policies rules create 200 \
    --security-policy POLICY_NAME \
    --action deny-403 \
    --expression "evaluateManagedRules('xss:stable')"

What's next