What's new?

• Guardrails now discovers and manages Google Cloud Armor security policies through two new resource types, GCP > Network > Security Policy (global) and GCP > Network > Region Security Policy (regional). Each comes with the standard Discovery, CMDB, Active, Allowed and Labels (global only) controls, and global security policies stay current in real time as they change in Google Cloud.
• Added Backend Service > Security Policy and Region Backend Service > Security Policy controls that check whether your load balancer backends are protected by a Cloud Armor security policy from your approved list, and can enforce that protection by automatically remediating any unprotected backend — keeping your load balancers secure without disrupting live traffic.
• Added Security Policy > Rules > Approved and Region Security Policy > Rules > Approved controls to keep Cloud Armor rules within policy — for example, flagging any rule that allows traffic from the entire internet. When enforcing, only the unapproved rules are removed and the default rule is set to deny, so the security policy itself stays in place.
• Added a Firewall > Target Tags > Approved control to govern the target tags that decide which instances a firewall rule applies to. It checks each rule's tags against your wildcard-enabled approved list and, when enforcing, removes only the unapproved tags in place — leaving the rule and its other settings untouched, and never stripping a rule's last tag (which would silently widen it to every instance in the network).
• GCP > Network > Region Backend Service now updates in real time: creation, updates, deletion, and security policy attachment changes refresh the CMDB as they happen instead of waiting for the next scheduled discovery.

Resource Types

Added

• GCP > Network > Region Security Policy
• GCP > Network > Security Policy

Control Types

Added

• GCP > Network > Backend Service > Security Policy
• GCP > Network > Firewall > Target Tags
• GCP > Network > Firewall > Target Tags > Approved
• GCP > Network > Region Backend Service > Security Policy
• GCP > Network > Region Security Policy > Active
• GCP > Network > Region Security Policy > Allowed
• GCP > Network > Region Security Policy > Allowed > Custom
• GCP > Network > Region Security Policy > Allowed > Region
• GCP > Network > Region Security Policy > CMDB
• GCP > Network > Region Security Policy > Discovery
• GCP > Network > Region Security Policy > Rules
• GCP > Network > Region Security Policy > Rules > Approved
• GCP > Network > Security Policy > Active
• GCP > Network > Security Policy > Allowed
• GCP > Network > Security Policy > Allowed > Custom
• GCP > Network > Security Policy > CMDB
• GCP > Network > Security Policy > Discovery
• GCP > Network > Security Policy > Labels
• GCP > Network > Security Policy > Rules
• GCP > Network > Security Policy > Rules > Approved

Policy Types

Added

• GCP > Network > Backend Service > Security Policy
• GCP > Network > Backend Service > Security Policy > Allowed
• GCP > Network > Backend Service > Security Policy > Default
• GCP > Network > Firewall > Target Tags
• GCP > Network > Firewall > Target Tags > Approved
• GCP > Network > Firewall > Target Tags > Approved > Tags
• GCP > Network > Region Backend Service > Security Policy
• GCP > Network > Region Backend Service > Security Policy > Allowed
• GCP > Network > Region Backend Service > Security Policy > Default
• GCP > Network > Region Security Policy > Active
• GCP > Network > Region Security Policy > Active > Age
• GCP > Network > Region Security Policy > Active > Last Modified
• GCP > Network > Region Security Policy > Allowed
• GCP > Network > Region Security Policy > Allowed > Custom
• GCP > Network > Region Security Policy > Allowed > Custom > Rules
• GCP > Network > Region Security Policy > Allowed > Region
• GCP > Network > Region Security Policy > Allowed > Region > Regions
• GCP > Network > Region Security Policy > CMDB
• GCP > Network > Region Security Policy > Regions
• GCP > Network > Region Security Policy > Rules
• GCP > Network > Region Security Policy > Rules > Approved
• GCP > Network > Region Security Policy > Rules > Approved > Rules
• GCP > Network > Security Policy > Active
• GCP > Network > Security Policy > Active > Age
• GCP > Network > Security Policy > Active > Last Modified
• GCP > Network > Security Policy > Allowed
• GCP > Network > Security Policy > Allowed > Custom
• GCP > Network > Security Policy > Allowed > Custom > Rules
• GCP > Network > Security Policy > CMDB
• GCP > Network > Security Policy > Labels
• GCP > Network > Security Policy > Labels > Template
• GCP > Network > Security Policy > Rules
• GCP > Network > Security Policy > Rules > Approved
• GCP > Network > Security Policy > Rules > Approved > Rules

Action Types

Added

• GCP > Network > Backend Service > Set Security Policy
• GCP > Network > Firewall > Set Target Tags
• GCP > Network > Region Backend Service > Router
• GCP > Network > Region Backend Service > Set Security Policy
• GCP > Network > Region Security Policy > Delete
• GCP > Network > Region Security Policy > Router
• GCP > Network > Region Security Policy > Update Or Delete Rules
• GCP > Network > Security Policy > Delete
• GCP > Network > Security Policy > Router
• GCP > Network > Security Policy > Set Labels
• GCP > Network > Security Policy > Update Or Delete Rules