Connecting a security profile to a resource

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also set a different folder for any specific command using the --folder-name or --folder-id options.

1. To view a list of current security profiles in the default folder, run this command:

   yc smartwebsecurity security-profile list
   

   Result:

   +----------------------+-------------------+---------------------+----------------+------------+-------------+
   |          ID          |       NAME        |       CREATED       | DEFAULT ACTION | CAPTCHA ID | RULES COUNT |
   +----------------------+-------------------+---------------------+----------------+------------+-------------+
   | fev3s055oq64******** | my-new-profile    | 2024-08-05 06:57:18 | DENY           |            |           1 |
   | fevlqk8vei9p******** | my-sample-profile | 2024-08-05 06:57:28 | DENY           |            |           2 |
   +----------------------+-------------------+---------------------+----------------+------------+-------------+
   

2. To view a list of HTTP routers in the default folder, run this command:

   yc application-load-balancer http-router list
   

   Result:

   +----------------------+-------------------+-------------+-------------+
   |          ID          |       NAME        | VHOST COUNT | ROUTE COUNT |
   +----------------------+-------------------+-------------+-------------+
   | ds7e9te73uak******** |  my-first-router  |           1 |           1 |
   +----------------------+-------------------+-------------+-------------+
   

3. To view a list of virtual hosts for the selected HTTP router, run this command:

   yc application-load-balancer http-router get <HTTP_router_name_or_ID>
   

   Result:

   id: ds7e9te73uak********
   name: my-first-router
   folder_id: b1gt6g8ht345********
   virtual_hosts:
     - name: test-virtual-host
       routes:
         - name: test-route
           http:
             match:
               path:
                 prefix_match: /
             route:
               backend_group_id: ds7a4niks9qv********
               timeout: 60s
               auto_host_rewrite: false
       route_options: {}
   created_at: "2024-08-05T08:34:03.973000654Z"
   

   Names of virtual hosts are specified in the virtual_hosts.name parameter. The example above features only one virtual host: test-virtual-host.

4. To connect a security profile to a virtual host, run this command:

   yc application-load-balancer virtual-host update <virtual_host_name> \
      --http-router-name <HTTP_router_name> \
      --security-profile-id <security_profile_ID>
   

   Where:

   • <virtual_host_name>: Virtual host name from the previous step.
   • --http-router-name: HTTP router name. This is a required setting. Instead of the HTTP router name, you can provide its ID in the --http-router-id parameter.
   • --security-profile-id: Security profile ID. This is a required setting.

   Result:

   done (1s)
   name: test-virtual-host
   routes:
     - name: test-route
       http:
         match:
           path:
             prefix_match: /
         route:
           backend_group_id: ds7a4niks9qv********
           timeout: 60s
           auto_host_rewrite: false
   route_options:
     security_profile_id: fev3s055oq64********
   

For more information about the yc application-load-balancer virtual-host update command, see the CLI reference.

With Terraform, you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.

Terraform is distributed under the Business Source License. The Yandex Cloud provider for Terraform is distributed under the MPL-2.0 license.

For more information about the provider resources, see the relevant documentation on the Terraform website or its mirror.

If you do not have Terraform yet, install it and configure the Yandex Cloud provider.

You can connect a Yandex Smart Web Security profile to a Yandex Application Load Balancer in the virtual host settings.

1. In the Terraform configuration file, for the yandex_alb_virtual_host resource, specify security_profile_id under route_options.

   resource "yandex_alb_virtual_host" "my-virtual-host" {
     name                    = "<virtual_host_name>"
     ...
   
     route_options {
       security_profile_id   = "<security_profile_ID>"
     }
   }
   

2. Apply the changes:

   1. In the terminal, navigate to the configuration file directory.

   2. Make sure the configuration is correct using this command:

      terraform validate
      

      If the configuration is valid, you will get this message:

      Success! The configuration is valid.
      

   3. Run this command:

      terraform plan
      

      You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.

   4. Apply the configuration changes:

      terraform apply
      

   5. Type yes and press Enter to confirm the changes.

You can check the update using the management console or this CLI command:

yc alb http-router get <HTTP_router_ID>

Use the update REST API method for the VirtualHost resource or the VirtualHostService/Update gRPC API call in Application Load Balancer.

Use the following annotations:

• For a Gwin controller: HTTPRoute or RoutePolicy.

• For an Ingress controller: Ingress resource annotation.

  Note

  To connect your security profile to an Application Load Balancer virtual host, the service account used by the Ingress controller must have the smart-web-security.editor role for the folder hosting Application Load Balancer and Smart Web Security resources. For more information, see Assigning a role to a service account.