Policy Packs

guardrails-samples

Ensure that only necessary and specific ports are open for inbound traffic, minimizing the risk of unauthorized access and potential attacks.

Enforce GCP VPC Network Firewall Rules with Port Ranges to Block Incoming Traffic

main

gcp_network_firewall_ingress_rules_approved

Configure Firewall Ingress Rule checking. This policy defines whether&#92;nto verify the firewall ingress rules are approved, as well as the&#92;nsubsequent action to take on unapproved items.&#92;n&#92;nIf set to `Enforce: Delete unapproved`, any unapproved rules will be&#92;nrevoked from the firewall.&#92;n

firewallIngressRulesApproved

GCP > Network > Firewall > Ingress Rules > Approved

gcp_network_firewall_ingress_rules_approved_rules

An [Object Control List (OCL)](https://turbot.com/guardrails/docs/reference/ocl)&#92;nwith a list of filter rules to approve or reject firewall rules.&#92;n&#92;nExamples:&#92;n  ```&#92;n  Allow HTTP and HTTPS rules for RFC1918 private space&#92;n  APPROVE $.turbot.fromPort:=80 $.turbot.toPort:=80 $.turbot.cidr:&lt;=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16&#92;n  APPROVE $.turbot.fromPort:=443 $.turbot.toPort:=443 $.turbot.cidr:&lt;=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16&#92;n&#92;n  Reject any rule from 0.0.0.0/0&#92;n  REJECT $.turbot.cidr:0.0.0.0/0&#92;n  ```&#92;n

firewallIngressRulesApprovedRules

GCP > Network > Firewall > Ingress Rules > Approved > Rules

turbot_policy_setting.gcp_network_firewall_ingress_rules_approved

turbot_policy_setting.gcp_network_firewall_ingress_rules_approved_rules

Policy	Setting	Note
GCP > Network > Firewall > Ingress Rules > Approved	Check: Approved
GCP > Network > Firewall > Ingress Rules > Approved > Rules	# Reject ports 21(FTP), 22(SSH), 25(SMTP), 80(HTTP), 443(HTTPS), 3389(RDP) REJECT $.turbot.ports.+:21,22,25,80,443,3389 $.turbot.cidr:0.0.0.0/0,::/0 # Reject if IP protocol is all REJECT $.turbot.protocol:all $.turbot.cidr:0.0.0.0/0,::/0 # Reject port range sizes greater than 1 REJECT $.turbot.portRangeSize:>1 # Approve unmatched rules APPROVE *

Policy Settings