<p>I am trying to add google cloud armor to my Terraform project that deploys app using Kubernetes. I follow this example. But, in my case, I want to create this rules instead:
<a href="https://github.com/hashicorp/terraform-provider-google/blob/master/examples/cloud-armor/main.tf" rel="nofollow noreferrer">https://github.com/hashicorp/terraform-provider-google/blob/master/examples/cloud-armor/main.tf</a></p>
<p><strong>Close all traffics for all IPs on all ports but open traffic for all IPs on port 80 and 443</strong></p>
<ul>
<li>Then I added a file also called <code>web_application_firewall.tf</code> under the directory <code>terraform/kubernetes</code> with the following configuration:</li>
</ul>
<pre><code># Cloud Armor Security policies
resource &quot;google_compute_security_policy&quot; &quot;web-app-firewall&quot; {
  name        = &quot;armor-security-policy&quot;
  description = &quot;Web application security policy to close all traffics for all IPs on all ports but open traffic for all IPs on port 80 and 443&quot;

  # Reject all traffics for all IPs on all ports
  rule {
    description = &quot;Default rule, higher priority overrides it&quot;

    action   = &quot;deny(403)&quot;
    priority = &quot;2147483647&quot;

    match {
      versioned_expr = &quot;SRC_IPS_V1&quot;

      config {
        src_ip_ranges = [&quot;*&quot;]
      }
    }

    
  }

  # Open traffic for all IPs on port 80 and 443
  #rule {
  #  description = &quot;allow traffic for all IPs on port 80 and 443&quot;

  #  action   = &quot;allow&quot;
  #  priority = &quot;1000&quot;

  #  match {
  #    versioned_expr = &quot;SRC_IPS_V1&quot;

  #    config {
  #      src_ip_ranges = [&quot;*&quot;]
  #    }
  #  }
  #}
}

resource &quot;google_compute_firewall&quot; &quot;firewall-allow-ports&quot; {
  name    = &quot;firewall-allow-ports&quot;
  network = google_compute_network.default.name

  allow {
    protocol = &quot;icmp&quot;
  }

  allow {
    protocol = &quot;tcp&quot;
    ports    = [&quot;80&quot;]
  }

  source_tags = [&quot;web&quot;]
}

resource &quot;google_compute_network&quot; &quot;default&quot; {
  name = &quot;test-network&quot;
}

</code></pre>
<p>Here, I deactivate port 445 but after I redeployed, I still have an access to the web app. Could you please let me know what I did wrong here? Thank you in advance.</p>

<p>First of all I would like to clarify a few things.</p>
<p><strong>Cloud Armor</strong></p>
<blockquote>
<p><a href="https://cloud.google.com/armor/docs/cloud-armor-overview" rel="nofollow noreferrer">Google Cloud Armor</a> provides protection only to applications running behind an external load balancer, and several features are only available for external HTTP(S) load balancer.</p>
</blockquote>
<p>In short, it can filter IP addresses but cannot block ports, it's firewall role.</p>
<p>In question you have <code>deny</code> rule for all IP's and <code>allow</code> rule (which is commented), however both rules have <code>src_ip_ranges = [&quot;*&quot;]</code> which applies to all IPs which is a bit pointless.</p>
<p><strong>Terraform snippet</strong>.</p>
<p>I have tried to apply <a href="https://github.com/hashicorp/terraform-provider-google/blob/master/examples/cloud-armor/main.tf" rel="nofollow noreferrer">terraform-provider-google</a> with your changes, however I am not sure if this is exactly what you have. If you could post your whole code it would be more helpful to replicate this whole scenario as you have.</p>
<p>As I mentioned previously, to block ports you need to use Firewall Rule. Firewall Rule applies to a specific VPC network, not all. When I tried to replicate your issue I found that you:</p>
<p><em><strong>Create new VPC network</strong></em></p>
<pre><code>resource &quot;google_compute_network&quot; &quot;default&quot; {
  name = &quot;test-network&quot;
}
</code></pre>
<p><em><strong>Created Firewall rule</strong></em></p>
<pre><code>resource &quot;google_compute_firewall&quot; &quot;firewall-allow-ports&quot; {
  name    = &quot;firewall-allow-ports&quot;
  network = google_compute_network.default.name

  allow {
    protocol = &quot;icmp&quot;
  }

  allow {
    protocol = &quot;tcp&quot;
    ports    = [&quot;80&quot;]
  }

  source_tags = [&quot;web&quot;]
}
</code></pre>
<p><strong>But where did you create VMs? If you followed github code, your VM has been created in <code>default</code> VPC:</strong></p>
<pre><code>  network_interface {
    network = &quot;default&quot; ### this line
    access_config {
      # Ephemeral IP
    }
</code></pre>
<p>In <a href="https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_instance#network_interface" rel="nofollow noreferrer">Terraform doc</a> you can find information that this value indicates to which network the VM will be attached.</p>
<blockquote>
<p><code>network_interface</code> - (Required) Networks to attach to the instance. This can be specified multiple times.</p>
</blockquote>
<p><strong>Issue Summary</strong></p>
<p>So in short, you have created new VPC (<code>test-network</code>), Created VPC rule (<code>&quot;firewall-allow-ports&quot;</code>) to allow only <code>ICMP</code> protocol and <code>TCP</code> protocol on port <code>80</code> with <code>source_tags = web</code> for new VPC - <code>test-network</code> but your VM has been created in <code>default</code> VPC which might have different firewall rules to allow whole traffic, allow traffic on port 445 or many more variations.</p>
<p><a href="https://i.stack.imgur.com/zPA5k.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/zPA5k.png" alt="" /></a>
<a href="https://i.stack.imgur.com/mGY1W.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/mGY1W.png" alt="" /></a></p>
<p><strong>Possible solution</strong></p>
<p>Using <code>default</code> as the name of resource in terraform might be dangerous/tricky as it can create resources in different locations than you want. I have changed this code a bit to create a VPC network - <code>test-network</code>, use it for firewall rules and in resource <code>&quot;google_compute_instance&quot;</code>.</p>
<pre><code>resource &quot;google_compute_network&quot; &quot;test-network&quot; {
  name = &quot;test-network&quot;
}

resource &quot;google_compute_firewall&quot; &quot;firewall-allow-ports&quot; {
  name    = &quot;firewall-allow-ports&quot;
  network = google_compute_network.test-network.name

  allow {
    protocol = &quot;icmp&quot;
  }

  allow {
    protocol = &quot;tcp&quot;
    ports    = [&quot;80&quot;, &quot;443&quot;] ### before was only 80
  }

  source_tags = [&quot;web&quot;]
}

resource &quot;google_compute_instance&quot; &quot;cluster1&quot; {
  name         = &quot;armor-gce-333&quot; ### previous VM name was &quot;armor-gce-222&quot;
  machine_type = &quot;f1-micro&quot;

  boot_disk {
    initialize_params {
      image = &quot;debian-cloud/debian-9&quot;
    }
  }

  network_interface {
    network = &quot;test-network&quot;
    access_config {

...
</code></pre>
<p>As you can see on the screens below, it created Firewall rule also for port 443 and in VPC <code>test-network</code> you can see VM <code>&quot;armor-gce-333&quot;</code>.</p>
<p><strong>Summary</strong>
Your main issue was related that you have configured new VPC with firewall rules, but your instance was probably created in another VPC network which allowed traffic on port 445.</p>
<p><a href="https://i.stack.imgur.com/Tfb6E.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Tfb6E.png" alt="" /></a>
<a href="https://i.stack.imgur.com/OYhHA.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/OYhHA.png" alt="" /></a></p>
