gcp-lb-cloud-armor-disable
compute.backendServices.setSecurityPolicy removes or replaces the Cloud Armor security policy attached to a backend service, stripping L7 DDoS mitigation and WAF rule enforcement from all traffic reaching that backend. setSecurityPolicy is a distinct IAM permission (not subsumed by compute.backendServices.update).
match (effective permission)
{
"action": "compute.backendServices.setSecurityPolicy",
"resource_type": "compute.googleapis.com/BackendService"
}
where
backend service has a Cloud Armor security policy attached (securityPolicy field non-null)
emit
| source type | Identity |
|---|---|
| target type | GenericNetwork |
| source | <principal> |
| target | <Cloud Armor SecurityPolicy protecting BackendService> |
| permissions | compute.backendServices.setSecurityPolicy |
| conditions | iam_permission |
Narrative
{principal.name} can remove the Cloud Armor security policy from backend service {target.name} (compute.backendServices.setSecurityPolicy). Removing Cloud Armor strips all L7 WAF rules (SQLi, XSS, SSRF), rate limiting, and IP allowlist enforcement, allowing previously blocked attack traffic to reach the backend.
Raw rule rules/derived/gcp/loadbalancing.yaml
id: gcp-lb-cloud-armor-disable
emits: CanModifyConfiguration
description: compute.backendServices.setSecurityPolicy removes or replaces the Cloud Armor security policy
attached to a backend service, stripping L7 DDoS mitigation and WAF rule enforcement from all traffic
reaching that backend. setSecurityPolicy is a distinct IAM permission (not subsumed by compute.backendServices.update).
match_effective_permission:
action: compute.backendServices.setSecurityPolicy
resource_type: compute.googleapis.com/BackendService
where:
- backend service has a Cloud Armor security policy attached (securityPolicy field non-null)
emit:
source_type: Identity
target_type: GenericNetwork
source: <principal>
target: <Cloud Armor SecurityPolicy protecting BackendService>
permissions:
- compute.backendServices.setSecurityPolicy
conditions:
- iam_permission
escalation: Call setSecurityPolicy with an empty or permissive policy to remove Cloud Armor from the
backend service. All traffic that was previously blocked by Cloud Armor rules (SQLi, XSS, SSRF, rate
limits, geo-block, IP-allowlist enforcement) now reaches the backend unfiltered. For backends with
custom IP allowlist rules this can additionally allow access from blocked IP ranges.
false_positive_note: "Only impactful if the backend service has a non-null securityPolicy (Cloud Armor\
\ attached). A backend service without Cloud Armor is already unprotected at the WAF layer \u2014\
\ removing a null policy is a no-op. compute.backendServices.setSecurityPolicy is a distinct IAM permission\
\ from compute.backendServices.update; confirm it is present in the effective permission set (it is\
\ included in roles/compute.loadBalancerAdmin and roles/compute.securityAdmin). Cloud Armor presence\
\ does not affect the ExposedToInternet fact; it only reduces L7 exploitability. The target is a Cloud\
\ Armor SecurityPolicy (generic_type GenericNetwork), not a VPC firewall rule."
narrative: '{principal.name} can remove the Cloud Armor security policy from backend service {target.name}
(compute.backendServices.setSecurityPolicy). Removing Cloud Armor strips all L7 WAF rules (SQLi, XSS,
SSRF), rate limiting, and IP allowlist enforcement, allowing previously blocked attack traffic to
reach the backend.'