A security profile group is a container for security profiles. A firewall policy rule references a security profile group to enable layer 7 inspection, such as intrusion prevention, on your network.
This document provides a detailed overview of security profile groups and their capabilities.
A security profile group is an organizational level resource.
You can add only one security profile of type
threat-preventionto a security profile group.
Each security profile group is uniquely identified by a URL with the following elements:
- Organization ID: ID of the organization.
- Location: scope of the security profile group. Location is always
- Name: security profile group name in the following format:
- A string 1-63 characters long
- Includes only alphanumeric characters or hyphens (-)
- Must not start with a number
To construct a unique URL identifier for a security profile group, use the following format:
For example, a
2345678432has the following unique identifier:
To perform layer 7 inspection of the network traffic, a firewall policy rule must contain the name of the security profile group to be used by the firewall endpoint.
Security profile groups apply to firewall policies only when you add a firewall policy rule with action
apply_security_profile_group. You can configure security profile groups in hierarchical firewall policy rules and global network firewall policy rules.
The firewall policy rule applies to incoming and outgoing traffic of the Virtual Private Cloud (VPC) network. The matched traffic is redirected to the firewall endpoint along with the configured security profile group name. The firewall endpoint uses the security profile specified in the security profile group to scan the packets for threats and apply configured actions.
To learn more about how to configure threat prevention, see Configure intrusion prevention service.
Each security profile group must have an associated project ID. The associated project is used for quotas and access restrictions on security profile group resources. If you authenticate your service account by using the
gcloud auth activate-service-accountcommand, you can associate your service account with the security profile group. To learn more about how to create a profile group, see Create and manage security profile groups.
Identity and Access Management roles
Identity and Access Management (IAM) roles govern the following security profile group actions:
- Creating a security profile group in an organization
- Modifying or deleting a security profile group
- Viewing details of a security profile group
- Viewing a list of security profile groups in an organization
- Using a security profile group in a firewall policy rule
The following table describes the roles that are necessary for each step.
|Create a security profile group||compute.networkAdmin role on the organization where the security profile group is created.|
|Modify a security profile group||compute.networkAdmin role on the organization where the security profile group is created.|
|View details about the security profile group in an organization||Any of the following roles for the organization:
|View all of the security profile groups in an organization||Any of the following roles for the organization:
|Use a security profile group in a firewall policy rule||Any of the following roles for the organization: