Configure Adaptive Protection

This page explains how to configure Google Cloud Armor Adaptive Protection, which helps protect your services from layer 7 (L7) distributed denial-of-service (DDoS) attacks and other web attacks by using Google's global infrastructure and security systems. By following the instructions on this page, you can fine-tune Adaptive Protection's mitigation strategies and customize how it safeguards your applications. Before you begin, familiarize yourself with the Adaptive Protection overview and its Adaptive Protection use cases to understand its capabilities.

Before you begin

The following sections explain all of the Identity and Access Management (IAM) roles and permissions required to configure Google Cloud Armor security policies. For the use cases in this document, you only need the compute.securityPolicies.update permission.

Set up IAM permissions for Cloud Armor security policies

The following operations require the Identity and Access Management (IAM) Compute Security Admin role (roles/compute.securityAdmin):

• Configuring, modifying, updating, and deleting a Cloud Armor security policy
• Using the following API methods:
  • SecurityPolicies insert
  • SecurityPolicies delete
  • SecurityPolicies patch
  • SecurityPolicies addRule
  • SecurityPolicies patchRule
  • SecurityPolicies removeRule

A user with the Compute Network Admin role (roles/compute.networkAdmin) can perform the following operations:

• Setting a Cloud Armor security policy for a backend service
• Using the following API methods:
  • BackendServices setSecurityPolicy
  • BackendServices list (gcloud only)

Users with the Security Admin role (roles/iam.securityAdmin) and the Compute Network Admin role (roles/compute.networkAdmin) can view Cloud Armor security policies by using the SecurityPolicies API methods get, list, and getRule.

Set up IAM permissions for custom roles

The following table lists the IAM roles' base permissions, their associated API methods, and the roles that grant that permission.