Block addresses in Google Cloud Armor

A response can add the address from an incoming alert to a Cloud Armor security policy you own, as a deny rule, and remove that rule again when the time is up. The policy stays yours: we only add and remove our own single-address rules, in a range of priority numbers you reserve for us.

Set up Google Cloud

1. Create (or choose) a global Cloud Armor security policy and attach it to your backend service. Your own rules keep working.
2. Decide on a range of rule priorities for us. We use 1000 to 1999 unless you change it. Keep your own rules out of that range: we add one rule per blocked address there, and we never change a rule we did not add.
3. Create a custom role with only these permissions: compute.securityPolicies.get, compute.securityPolicies.update and compute.globalOperations.get. To let us find your policies for you, also allow compute.securityPolicies.list. Do not use Owner or Editor.
4. Create a service account, give it that role on the project, and create a key of type JSON for it. Download the file.

Set up UptimeWave

1. Open Connections, add Google Cloud Armor, and paste the whole key file. It is stored encrypted and never shown again. We show only the service account email.
2. Add the policy as a target (choose it from the list, or type the project ID and policy name). Change the reserved priority range here if you need to.
3. Press Test connection. It reads the policy and tells you how much of the reserved range is free. It cannot check that we may change the policy without changing it.
4. Create a response with the action Block the address on Google Cloud Armor, choose the policy, and choose how long to block: 15 minutes, 1 hour, 6 hours, 24 hours, 7 days, or until a person removes it.

Good to know

• Each blocked address becomes one deny rule (HTTP 403) for that single address, marked with a note that starts with uptime-block: so we only ever remove our own.
• If every priority in your reserved range is taken, or Google's rule quota is reached, we stop and tell you in plain words. Nothing is blocked in that case.
• If you already have a rule for the same address, we leave it alone and never remove it.