Control: GCP > Network > Region Backend Service > Security Policy

Determine the action to take when a GCP Network region backend service is not protected by an allowed Cloud Armor security policy.

Cloud Armor backend security policies can be attached to region backend services with load balancing scheme EXTERNAL_MANAGED or INTERNAL_MANAGED (regional external and regional internal Application Load Balancer backends). Region backend services with other schemes are skipped because security policies cannot be attached to them (external passthrough Network Load Balancer backends are protected by network edge security policies, which are configured separately). A supported region backend service with no security policy attached is treated as not allowed.

If a region backend service is not using an allowed security policy and this policy is set to Enforce: Set to default if security policy not in allowed list, the region backend service will be updated to use the security policy selected in the GCP > Network > Region Backend Service > Security Policy > Default policy.

If the security policy in the GCP > Network > Region Backend Service > Security Policy > Default policy is not allowed in the GCP > Network > Region Backend Service > Security Policy > Allowed policy, Guardrails will not attempt to set the security policy to prevent continuous updates.