gcloud: Wed Mar 15 11:22:01 UTC 2023

gcloud/compute/security-policies/rules/add-preconfig-waf-exclusion

@@ -0,0 +1,146 @@
+NAME
+    gcloud compute security-policies rules add-preconfig-waf-exclusion - add an
+        exclusion configuration for preconfigured WAF evaluation into a
+        security policy rule
+
+SYNOPSIS
+    gcloud compute security-policies rules add-preconfig-waf-exclusion PRIORITY
+        --target-rule-set=TARGET_RULE_SET
+        [--request-cookie-to-exclude=[op=OP],[val=VAL]]
+        [--request-header-to-exclude=[op=OP],[val=VAL]]
+        [--request-query-param-to-exclude=[op=OP],[val=VAL]]
+        [--request-uri-to-exclude=[op=OP],[val=VAL]]
+        [--security-policy=SECURITY_POLICY] [--target-rule-ids=[RULE_ID,...]]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    gcloud compute security-policies rules add-preconfig-waf-exclusion is used
+    to add an exclusion configuration for preconfigured WAF evaluation into a
+    security policy rule.
+
+    Note that request field exclusions are associated with a target, which can
+    be a single rule set, or a rule set plus a list of rule IDs under the rule
+    set.
+
+EXAMPLES
+    To add specific request field exclusions that are associated with the
+    target of 'sqli-stable': ['owasp-crs-v030001-id942110-sqli',
+    'owasp-crs-v030001-id942120-sqli'], run:
+
+        $ gcloud compute security-policies rules \
+            add-preconfig-waf-exclusion 1000 --security-policy=my-policy \
+            --target-rule-set=sqli-stable \
+            --target-rule-ids=owasp-crs-v030001-id942110-sqli,\
+        owasp-crs-v030001-id942120-sqli \
+            --request-header-to-exclude=op=EQUALS,val=abc \
+            --request-header-to-exclude=op=STARTS_WITH,val=xyz \
+            --request-uri-to-exclude=op=EQUALS_ANY
+
+    To add specific request field exclusions that are associated with the
+    target of 'sqli-stable': [], run:
+
+        $ gcloud compute security-policies rules \
+            add-preconfig-waf-exclusion 1000 --security-policy=my-policy \
+            --target-rule-set=sqli-stable \
+            --request-cookie-to-exclude=op=EQUALS_ANY
+
+POSITIONAL ARGUMENTS
+     PRIORITY
+        The priority of the rule to add the exclusion configuration for
+        preconfigured WAF evaluation. Rules are evaluated in order from highest
+        priority to lowest priority where 0 is the highest priority and
+        2147483647 is the lowest priority.
+
+REQUIRED FLAGS
+     --target-rule-set=TARGET_RULE_SET
+        Target WAF rule set where the request field exclusions being added
+        would apply.
+
+        This, together with the target rule IDs (if given), determines the
+        target for associating request field exclusions. See --target-rule-ids.
+
+OPTIONAL FLAGS
+     --request-cookie-to-exclude=[op=OP],[val=VAL]
+        Adds a request cookie to the request field exclusions associated with
+        the rule set and rule IDs (if given). This specifies a request cookie
+        whose value will be excluded from inspection during preconfigured WAF
+        evaluation.
+
+        You can specify an exact match or a partial match by using a field
+        operator and a field value. Available field operators are:
+        ◆ EQUALS: the operator matches if the field value equals the
+          specified value.
+        ◆ STARTS_WITH: the operator matches if the field value starts with
+          the specified value.
+        ◆ ENDS_WITH: the operator matches if the field value ends with the
+          specified value.
+        ◆ CONTAINS: the operator matches if the field value contains the
+          specified value.
+        ◆ EQUALS_ANY: the operator matches if the field value is any value.
+
+        A field value must be given if the field operator is not EQUALS_ANY,
+        and cannot be given if the field operator is EQUALS_ANY. For example,
+        --request-header-to-exclude op=EQUALS,val=abc or
+        --request-header-to-exclude op=EQUALS_ANY.
+
+        This flag can be repeated to specify multiple request headers to
+        exclude. For example, --request-header-to-exclude op=EQUALS,val=abc
+        --request-header-to-exclude op=STARTS_WITH,val=xyz.
+
+     --request-header-to-exclude=[op=OP],[val=VAL]
+        Adds a request header to the request field exclusions associated with
+        the rule set and rule IDs (if given). This specifies a request header
+        whose value will be excluded from inspection during preconfigured WAF
+        evaluation.
+
+        Refer to the syntax under --request-cookie-to-exclude.
+
+        This flag can be repeated to specify multiple request headers.
+
+     --request-query-param-to-exclude=[op=OP],[val=VAL]
+        Adds a request query parameter to the request field exclusions
+        associated with the rule set and rule IDs (if given). This specifies a
+        request query parameter in the query string or in the POST body whose
+        value will be excluded from inspection during preconfigured WAF
+        evaluation.
+
+        Refer to the syntax under --request-cookie-to-exclude.
+
+        This flag can be repeated to specify multiple request query parameters.
+
+     --request-uri-to-exclude=[op=OP],[val=VAL]
+        Adds a request URI to the request field exclusions associated with the
+        rule set and rule IDs (if given). This specifies a request URI from the
+        request line to be excluded from inspection during preconfigured WAF
+        evaluation.
+
+        Refer to the syntax under --request-cookie-to-exclude.
+
+        This flag can be repeated to specify multiple request URIs.
+
+     --security-policy=SECURITY_POLICY
+        The security policy that this rule belongs to.
+
+     --target-rule-ids=[RULE_ID,...]
+        A comma-separated list of target rule IDs under the WAF rule set where
+        the request field exclusions being added would apply. If omitted, the
+        added request field exclusions will be associated with the rule set
+        only, which would apply to all the rule IDs under the rule set.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha compute security-policies rules \
+            add-preconfig-waf-exclusion
+
+        $ gcloud beta compute security-policies rules \
+            add-preconfig-waf-exclusion
+

gcloud/compute/security-policies/rules/create

@@ -102,8 +102,8 @@ OPTIONAL FLAGS
      --conform-action=CONFORM_ACTION
         Action to take when requests are under the given threshold. When
         requests are throttled, this is also the action for all requests which
-        are not dropped. CONFORM_ACTION must be (currently only one value is
-        supported): allow.
+        are not dropped. CONFORM_ACTION must be (only one value is supported):
+        allow.
 
      --description=DESCRIPTION
         An optional, textual description for the rule.

gcloud/compute/security-policies/rules/help

@@ -16,6 +16,10 @@ GCLOUD WIDE FLAGS
 COMMANDS
     COMMAND is one of the following:
 
+     add-preconfig-waf-exclusion
+        Add an exclusion configuration for preconfigured WAF evaluation into a
+        security policy rule.
+
      create
         Create a Compute Engine security policy rule.
 
@@ -25,6 +29,10 @@ COMMANDS
      describe
         Describe a Compute Engine security policy rule.
 
+     remove-preconfig-waf-exclusion
+        Remove an exclusion configuration for preconfigured WAF evaluation from
+        a security policy rule.
+
      update
         Update a Compute Engine security policy rule.
 

gcloud/compute/security-policies/rules/remove-preconfig-waf-exclusion

@@ -0,0 +1,164 @@
+NAME
+    gcloud compute security-policies rules remove-preconfig-waf-exclusion -
+        remove an exclusion configuration for preconfigured WAF evaluation from
+        a security policy rule
+
+SYNOPSIS
+    gcloud compute security-policies rules remove-preconfig-waf-exclusion
+        PRIORITY --target-rule-set=TARGET_RULE_SET
+        [--request-cookie-to-exclude=[op=OP],[val=VAL]]
+        [--request-header-to-exclude=[op=OP],[val=VAL]]
+        [--request-query-param-to-exclude=[op=OP],[val=VAL]]
+        [--request-uri-to-exclude=[op=OP],[val=VAL]]
+        [--security-policy=SECURITY_POLICY] [--target-rule-ids=[RULE_ID,...]]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    gcloud compute security-policies rules remove-preconfig-waf-exclusion is
+    used to remove an exclusion configuration for preconfigured WAF evaluation
+    from a security policy rule.
+
+    Note that request field exclusions are associated with a target, which can
+    be a single rule set, or a rule set plus a list of rule IDs under the rule
+    set.
+
+    It is possible to remove request field exclusions at 3 levels:
+      ▪ Remove specific request field exclusions that are associated with a
+        matching target.
+      ▪ Remove all the request field exclusions that are associated with a
+        matching target.
+      ▪ Remove all the request field exclusions that are configured under the
+        security policy rule, regardless of the target.
+
+EXAMPLES
+    To remove specific request field exclusions that are associated with the
+    target of 'sqli-stable': ['owasp-crs-v030001-id942110-sqli',
+    'owasp-crs-v030001-id942120-sqli'], run:
+
+        $ gcloud compute security-policies rules \
+            remove-preconfig-waf-exclusion 1000 \
+            --security-policy=my-policy --target-rule-set=sqli-stable \
+            --target-rule-ids=owasp-crs-v030001-id942110-sqli,\
+        owasp-crs-v030001-id942120-sqli \
+            --request-header-to-exclude=op=EQUALS,val=abc \
+            --request-header-to-exclude=op=STARTS_WITH,val=xyz \
+            --request-uri-to-exclude=op=EQUALS_ANY
+
+    To remove all the request field exclusions that are associated with the
+    target of 'sqli-stable': ['owasp-crs-v030001-id942110-sqli',
+    'owasp-crs-v030001-id942120-sqli'], run:
+
+        $ gcloud compute security-policies rules \
+            remove-preconfig-waf-exclusion 1000 \
+            --security-policy=my-policy --target-rule-set=sqli-stable \
+            --target-rule-ids=owasp-crs-v030001-id942110-sqli,\
+        owasp-crs-v030001-id942120-sqli
+
+    To remove all the request field exclusions that are associated with the
+    target of 'sqli-stable': [], run:
+
+        $ gcloud compute security-policies rules \
+            remove-preconfig-waf-exclusion 1000 \
+            --security-policy=my-policy --target-rule-set=sqli-stable
+
+    To remove all the request field exclusions that are configured under the
+    security policy rule, regardless of the target, run:
+
+        $ gcloud compute security-policies rules \
+            remove-preconfig-waf-exclusion 1000 \
+            --security-policy=my-policy --target-rule-set=*
+
+POSITIONAL ARGUMENTS
+     PRIORITY
+        The priority of the rule to remove the exclusion configuration for
+        preconfigured WAF evaluation. Rules are evaluated in order from highest
+        priority to lowest priority where 0 is the highest priority and
+        2147483647 is the lowest priority.
+
+REQUIRED FLAGS
+     --target-rule-set=TARGET_RULE_SET
+        Target WAF rule set from where to remove the request field exclusions.
+
+        This, together with the target rule IDs (if given), determines the
+        target for associating request field exclusions. See --target-rule-ids.
+
+        Note that the removal of request field exclusions is restricted to
+        those associated with a matching target. Set this flag to * if you want
+        to remove request field exclusions regardless of the target.
+
+OPTIONAL FLAGS
+     --request-cookie-to-exclude=[op=OP],[val=VAL]
+        Removes a request cookie from the existing request field exclusions
+        associated with the rule set and rule IDs (if given).
+
+        You can specify an exact match or a partial match by using a field
+        operator and a field value. Available field operators are:
+        ◆ EQUALS: the operator matches if the field value equals the
+          specified value.
+        ◆ STARTS_WITH: the operator matches if the field value starts with
+          the specified value.
+        ◆ ENDS_WITH: the operator matches if the field value ends with the
+          specified value.
+        ◆ CONTAINS: the operator matches if the field value contains the
+          specified value.
+        ◆ EQUALS_ANY: the operator matches if the field value is any value.
+
+        A field value must be given if the field operator is not EQUALS_ANY,
+        and cannot be given if the field operator is EQUALS_ANY. For example,
+        --request-header-to-exclude op=EQUALS,val=abc or
+        --request-header-to-exclude op=EQUALS_ANY.
+
+        This flag can be repeated to specify multiple request headers to
+        exclude. For example, --request-header-to-exclude op=EQUALS,val=abc
+        --request-header-to-exclude op=STARTS_WITH,val=xyz.
+
+     --request-header-to-exclude=[op=OP],[val=VAL]
+        Removes a request header from the existing request field exclusions
+        associated with the rule set and rule IDs (if given).
+
+        Refer to the syntax under --request-cookie-to-exclude.
+
+        This flag can be repeated to specify multiple request headers.
+
+     --request-query-param-to-exclude=[op=OP],[val=VAL]
+        Removes a request query parameter from the existing request field
+        exclusions associated with the rule set and rule IDs (if given).
+
+        Refer to the syntax under --request-cookie-to-exclude.
+
+        This flag can be repeated to specify multiple request query parameters.
+
+     --request-uri-to-exclude=[op=OP],[val=VAL]
+        Removes a request URI from the existing request field exclusions
+        associated with the rule set and rule IDs (if given).
+
+        Refer to the syntax under --request-cookie-to-exclude.
+
+        This flag can be repeated to specify multiple request URIs.
+
+     --security-policy=SECURITY_POLICY
+        The security policy that this rule belongs to.
+
+     --target-rule-ids=[RULE_ID,...]
+        A comma-separated list of target rule IDs under the WAF rule set from
+        where to remove the request field exclusions. If omitted, the removal
+        of request field exclusions is restricted to those associated with the
+        rule set only, without specific rule IDs.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha compute security-policies rules \
+            remove-preconfig-waf-exclusion
+
+        $ gcloud beta compute security-policies rules \
+            remove-preconfig-waf-exclusion
+

gcloud/compute/security-policies/rules/update

@@ -91,8 +91,8 @@ FLAGS
      --conform-action=CONFORM_ACTION
         Action to take when requests are under the given threshold. When
         requests are throttled, this is also the action for all requests which
-        are not dropped. CONFORM_ACTION must be (currently only one value is
-        supported): allow.
+        are not dropped. CONFORM_ACTION must be (only one value is supported):
+        allow.
 
      --description=DESCRIPTION
         An optional, textual description for the rule.