Control: GCP > Network > Backend Service > Security Policy

Determine the action to take when a GCP Network backend service is not protected by an allowed Cloud Armor security policy.

Cloud Armor backend security policies can be attached to backend services with load balancing scheme EXTERNAL or EXTERNAL_MANAGED (global external, classic and proxy Network Load Balancer backends). Backend services with other schemes are skipped because security policies cannot be attached to them (cross-region internal Application Load Balancer backends are not supported by Cloud Armor). A supported backend service with no security policy attached is treated as not allowed.

If a backend service is not using an allowed security policy and this policy is set to Enforce: Set to default if security policy not in allowed list, the backend service will be updated to use the security policy selected in the GCP > Network > Backend Service > Security Policy > Default policy.

If the security policy in the GCP > Network > Backend Service > Security Policy > Default policy is not allowed in the GCP > Network > Backend Service > Security Policy > Allowed policy, Guardrails will not attempt to set the security policy to prevent continuous updates.