Skip to content
This repository was archived by the owner on Aug 20, 2025. It is now read-only.

Commit 20bfd1c

Browse files
yunusyunus
committed
adds firewall whitelisting feature
adds more comments and examples
1 parent c8b2999 commit 20bfd1c

File tree

9 files changed

+1346
-0
lines changed

9 files changed

+1346
-0
lines changed

‎policies/templates/gcp_network_firewall_v1.yaml‎

Lines changed: 382 additions & 0 deletions
Large diffs are not rendered by default.

‎samples/gcp_network_firewall_whitelist.yaml‎

Lines changed: 183 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,183 @@
1+
# Copyright 2019 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
#
15+
16+
17+
18+
# This template enables you to create a list of "whitelist" rules that are
19+
# compliant with your regulations.
20+
# Each firewall rule in your GCP projects is checked against these whitelist rules.
21+
# If there is a match, then no alerts are triggered. If there is no match, then
22+
# that firewall is alerted.
23+
# Match is basically defined as: whitelist rule should be a superset of the actual allowed rules.
24+
25+
# It is possible to use regex, port ranges and IP CIDR ranges to define whitelists.
26+
# For instance:
27+
# - port: "1-100" covers "80" but not "443"
28+
# - sourceRange: "10.128.0.0/16" covers "10.128.1.0/24" but not "10.0.0.0/24". 0.0.0.0/0 covers all the ranges
29+
# - sourceTags, targetTags, sourceServiceAccounts, targetServiceAccounts can be defined via regular expression statements
30+
# - IPProtocol can be a list of protocols.
31+
32+
# The overall logic is as follows:
33+
# Raise an alert if a firewall rule is not a subset by any of the whitelist rules defined in this constraint file:
34+
# 1. Does the direction (ingress/egress) match?
35+
# 2. Do both firewall rule and whitelist rule have the same fields defined? No more no less.
36+
# 3. Do the IPProtocol and its ports match? IPProtocols are checked by equality while ports are checked via ranges. See above.
37+
# 4. Check whether whitelist sourceRange/destinationRange CIDR overlap the whole firewall rule's source range if a source range/destination range exist.
38+
# 5. Check regex match for sourceServiceAccounts, sourceTags, targetTags, and targetServiceAccounts.
39+
# All the SAs,Tags in a firewall rule should be whitelisted. PARTIAL overlaps are NOT enough. For instance, if 2 out of 3 targetTags are matched, it is a NO.
40+
41+
42+
# WARNINGS:
43+
# - partial matches are NOT good enough. A firewall rule should be fully covered by the whitelist rules.
44+
# - some fields like sourceTags and sourceServiceAccounts
45+
# can NOT exist at the same time in a GCP firewall rule. Therefore, please create separate rules for each.
46+
# - As hinted above, to have a match every defined field should exist in both firewall rule and whitelist rule.
47+
# If you try to create a rule for ingress, tcp, 22, from 0.0.0.0/0,
48+
# it does NOT cover ingress, tcp, 22, from 0.0.0.0/0, targetTags = ["https"] since targetTags is not defined in
49+
# whitelisting.
50+
51+
apiVersion: constraints.gatekeeper.sh/v1alpha1
52+
kind: GCPNetworkFirewallWhitelistConstraintV1
53+
metadata:
54+
name: forbid-firewalls-that-are-not-listed
55+
spec:
56+
severity: high
57+
parameters:
58+
#### HINT: Asset inventory output, which is used by this policy library as input,
59+
# shows firewalls in JSON format.
60+
# You may refer them to see the naming and fields.
61+
# The goal is to create a whitelist rule that is superset of the actual allowed firewall rules.
62+
63+
rules:
64+
# Allow SSH (22) to the bastion VMs only
65+
# the bastion VM is defined by a service account
66+
- direction: ingress
67+
allowed:
68+
- IPProtocol: "tcp"
69+
ports:
70+
- "22"
71+
targetServiceAccounts:
72+
- "bastion-sa@PROJECT.iam.gserviceaccount.com"
73+
sourceRanges:
74+
- "0.0.0.0/0"
75+
76+
# Allow SSH (22) to the bastion VMs only
77+
# the bastion VM is defined by a target tag
78+
- direction: ingress
79+
allowed:
80+
- IPProtocol: "tcp"
81+
ports:
82+
- "22"
83+
targetTags:
84+
- "^bastion$"
85+
sourceRanges:
86+
- "0.0.0.0/0"
87+
88+
# allow SSH over IAP (35.235.240.0/20)
89+
- direction: ingress
90+
allowed:
91+
- IPProtocol: "tcp"
92+
ports:
93+
- "22"
94+
sourceRanges:
95+
- "35.235.240.0/20"
96+
97+
# allow all traffic
98+
# from public internet and private network, 0.0.0.0/0
99+
# to VMs with taged as "tags.*" or "test.*"
100+
- direction: ingress
101+
allowed:
102+
- IPProtocol: "tcp"
103+
ports:
104+
- "1-65535"
105+
- IPProtocol: "udp"
106+
ports:
107+
- "1-65535"
108+
- IPProtocol: "icmp"
109+
- IPProtocol: "esp"
110+
- IPProtocol: "ah"
111+
- IPProtocol: "sctp"
112+
targetTags:
113+
- "tags.*"
114+
- "test.*"
115+
sourceRanges:
116+
- "0.0.0.0/0"
117+
118+
# allow only 22 (SSH) and 80 (HTTP) traffic
119+
# from public internet and private network, 0.0.0.0/0
120+
# to VMs with taged as "tags.*" or "test.*"
121+
- direction: ingress
122+
allowed:
123+
- IPProtocol: "tcp"
124+
ports:
125+
- "22"
126+
- "80"
127+
targetTags:
128+
- "tags.*"
129+
- "test.*"
130+
sourceRanges:
131+
- "0.0.0.0/0"
132+
133+
# allow only source service account based ingress rules to ALL instances.
134+
- direction: ingress
135+
allowed:
136+
- IPProtocol: "tcp"
137+
ports:
138+
- "1-65535"
139+
- IPProtocol: "tcp" # we provide this line since when it is ALL port, we may not see ports
140+
- IPProtocol: "udp"
141+
ports:
142+
- "1-65535"
143+
- IPProtocol: "udp"
144+
- IPProtocol: "icmp"
145+
sourceServiceAccounts:
146+
- ".*@.*gserviceaccount.com"
147+
# As a complementary to the above rule, you may use this one, so that you allow
148+
# SA -> SA traffic firewall rules.
149+
- direction: egress
150+
allowed:
151+
- IPProtocol: "tcp"
152+
ports:
153+
- "1-65535"
154+
- IPProtocol: "tcp" # we provide this line since when it is ALL port, we may not see ports
155+
- IPProtocol: "udp"
156+
ports:
157+
- "1-65535"
158+
- IPProtocol: "udp"
159+
- IPProtocol: "icmp"
160+
sourceServiceAccounts:
161+
- ".*@.*gserviceaccount.com"
162+
targetServiceAccounts:
163+
- ".*@.*gserviceaccount.com"
164+
# allow all protocols, ports from internet
165+
# to VMs tagged with ".*public_vm" or "public_service.*"
166+
- direction: ingress
167+
allowed:
168+
- IPProtocol: "ALL"
169+
sourceRanges:
170+
- "0.0.0.0/0"
171+
targetTags:
172+
- ".*public_vm"
173+
- "public_service.*"
174+
# allow all all protocols/ports from Internet
175+
# this rule does not cover the previous rule with tag
176+
# since targetTag is not mentioned.
177+
- direction: ingress
178+
allowed:
179+
- IPProtocol: "ALL"
180+
sourceRanges:
181+
- "0.0.0.0/0"
182+
183+

0 commit comments

Comments
 (0)