GCP Cloud Armor Geoblocking rules

To do: There are some Cloud Armor exceptions that simply de-activate owasp-rules. We should make sure that this is intended and not just a lazy way of getting rid of false-positives.

(Originally written by Antti A.) Services are distributed to four projects running LoadBalancer & Cloud Armor. Unless other policies are used (for example explicit ip whitelists), these policies provide the same geoblocking rules with exemption of Vietnam allowed in att-nightly. Why is Vietnam allowed in att-nightly?

Use Terraform to configure these policies.

Exceptions

If Cloud Armor hits false positive, create custom rule with higher priority (higher = lower number) to allow the traffic.

For example, there's already made rule for allowing specific tms trip, that can be utilized:

  rule {
    action      = "allow"
    description = "allow-specific-trip"

    match {
      expr {
        expression = "request.query.contains('c9a7f85c-5e8a-4d9f-9562-1e3091b7dde7')  || request.headers['referer'].contains('c9a7f85c-5e8a-4d9f-9562-1e3091b7dde7')"
      }
    }

    priority = 999
  }

Other examples: In the GUI: This allow rule allows all traffic that trigger the owasp-crs-v030001-id942220-sqli and hit the path /api/v2/cordova/vehicle/location

evaluatePreconfiguredWaf('sqli-stable', {'sensitivity': 0, 'opt_in_rule_ids': ['owasp-crs-v030001-id942220-sqli']})  && request.path.matches('/api/v2/cordova/vehicle/location')

Example how to make opt out rule for cloud armor:

evaluatePreconfiguredWaf('sqli-stable', {'sensitivity': 1, 'opt_out_rule_ids': ['owasp-crs-v030001-id942190-sqli']}) && request.path.matches('/api/v1/customer/signup')