Configure custom rules language attributes

Each Google Cloud Armor security policy rule has a priority, a match condition, and an action. Cloud Armor performs the action of the highest priority rule that matches a request. Rules with a lower priority than the highest priority matching rule are not evaluated, even if they have the same match conditions.

Each security policy rule supports two types of match conditions:

• A basic match condition contains lists of IP addresses or lists of IP address ranges. Basic match conditions are defined by using the --src-ip-ranges flag when creating a rule using the Google Cloud CLI.
• An advanced match condition contains an expression with up to five subexpressions that can match a variety of attributes of an incoming request. Advanced match conditions are defined using the --expression flag when creating a rule using the Google Cloud CLI.

This page discusses advanced match conditions and the Cloud Armor custom rules language that you use to write expressions in the advanced match conditions of security policy rules. The Cloud Armor custom rules language is a subset of the Common Expression Language (CEL). Expressions written in the Cloud Armor custom rules language require two components:

• The attribute: the data to inspect
• The operation: how to use the data

For example, the following expression uses the attributes origin.ip and 198.51.100.0/24 in the operation inIpRange. In this case, the expression returns true if origin.ip is within the 198.51.100.0/24 IP address range.

inIpRange(origin.ip, '198.51.100.0/24')

Even though the previous example expression only matches on client IP address, when you use the example expression in a Cloud Armor security policy rule, the rule is considered a rule with advanced match conditions from a quota perspective. For more information, see Cloud Armor quotas and limits.

Operations

The following reference describes the operators that you can use with attributes (represented by x, y, and k) to define rule expressions.