<p>I have two Cloud Armor policies.
Policy "A" is allowing our office network to connect to specific services.
Policy "B" is allowing a customer to a service to consume an API.</p>

<p>I can not add the rule of Policy "B" to Policy "A" because then the rule (the customers ip) would've access to all services where Policy "A" is applied to. Therefore I separated it off to the a standalone Policy "B".</p>

<p>So I have now two different BackendConfig resources. One referencing to Policy "A" and one to Policy "B".</p>

<p>The next step I took was to somehow apply <strong>both</strong> cloud armor backend configs to one specific service. The office network should've access to that services <strong>plus</strong> the IP of our customer.
This is how I thought it might work:</p>

<pre><code>metadata:
  annotations:
    beta.cloud.google.com/backend-config: '{"default":{"policy-a-cloud-armor-backend-config","policy-b-cloud-armor-backend-config"}}'
</code></pre>

<p>Unfortunately this does <strong>not</strong> work. In the policy panel in GCP the following warning appears:</p>

<pre><code>This policy has not been applied to any targets yet, so the policy will not affect any traffic.
</code></pre>

<p>Any idea how I can make this exclusive access possible?</p>

<p>This notification <code>This policy has not been applied to any targets yet, so the policy will not affect any traffic</code> indicates that a security policy is not bound to any of targets via backend configuration and annotations. </p>

<p>The annotation syntax does not look consistent with the documentation: the field <code>ports</code> is missing. It should be like this: </p>

<pre><code>{"ports": {"http":"config-http", "http2" :"config-http2"}, "default": "config-default"} 
</code></pre>

<p>See <a href="https://cloud.google.com/kubernetes-engine/docs/concepts/backendconfig#associating_a_service_port_with_a_backendconfig" rel="nofollow noreferrer">Associating a Service port with a BackendConfig</a>  </p>

<p>It is hardly possible to apply two different security policies to the same set like service/port.  </p>

<p>As a workaround, you can try an additional service with a special security policy that includes rules for both clients. </p>
