<p>I have created a Cloud Armor security policy with Terraform, and I have a Load Balancer that has been created via Kubernetes Ingress.  I want to attach the Cloud Armor policy to the Load balancer via Terraform.</p>
<p>According to the <a href="https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_backend_service#security_policy" rel="nofollow noreferrer">Terraform documentation</a>, a Cloud Armor policy must be attached via <code>google_compute_backend_service</code>.</p>
<p>My load balancer is created using <code>kubernetes_ingress</code>, which doesn't allow for a cloud armor policy to be added.</p>
<p>Within the GCP console, I can manually add the Load Balancer target to the Cloud Armor policy.  Does anyone know of a workaround to achieve this behavior in Terraform?</p>
<p>For reference, the resources I have created are:
google_compute_security_policy &amp;
kubernetes_ingress</p>

fuzzi
<p>The issue you will have if you try to attach a Cloud Armor policy created via Terraform to a Backend Generate via Ingress is that the backend it self is managed by the Ingress controller, and it's name is somehow unpredictable(you cannot know what the backend name is going to look like until you deploy the Ingress). So doing this via Terraform will be an issue and i would not recommend that.</p>
<p>Instead you can use a <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-features#cloud_armor" rel="nofollow noreferrer">BackendConfig</a> object to  attach the policy to the backend.</p>
<p>The recommanded way is to do things in this order</p>
<ul>
<li>Create the Cloud Armor Policy using Terraform</li>
<li>Create a backendConfig object that points to the policy</li>
<li>Annotate your Ingress with the <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-features#associating_backendconfig_with_your_ingress" rel="nofollow noreferrer">backendconfig</a> object</li>
<li>Deploy the Ingress</li>
</ul>
<p>After this you can keep changing and adapting your Cloud Armor Policies using Terraform without having to touch the Ingress again. We have a fully documented tutorial <a href="https://github.com/GoogleCloudPlatform/gke-networking-recipes/tree/master/ingress/single-cluster/ingress-cloudarmor" rel="nofollow noreferrer">here</a></p>
