Connecting a security profile to a resource

If you do not have the Yandex Cloud CLI installed yet, install and initialize it.

By default, the CLI uses the folder specified when creating the profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also set a different folder for any specific command using the --folder-name or --folder-id parameter.

1. To view a list of current security profiles in the default folder, run this command:

   yc smartwebsecurity security-profile list
   

   Result:

   +----------------------+-------------------+---------------------+----------------+------------+-------------+
   |          ID          |       NAME        |       CREATED       | DEFAULT ACTION | CAPTCHA ID | RULES COUNT |
   +----------------------+-------------------+---------------------+----------------+------------+-------------+
   | fev3s055oq64******** | my-new-profile    | 2024-08-05 06:57:18 | DENY           |            |           1 |
   | fevlqk8vei9p******** | my-sample-profile | 2024-08-05 06:57:28 | DENY           |            |           2 |
   +----------------------+-------------------+---------------------+----------------+------------+-------------+
   

2. To view a list of HTTP routers in the default folder, run this command:

   yc application-load-balancer http-router list
   

   Result:

   +----------------------+-------------------+-------------+-------------+
   |          ID          |       NAME        | VHOST COUNT | ROUTE COUNT |
   +----------------------+-------------------+-------------+-------------+
   | ds7e9te73uak******** |  my-first-router  |           1 |           1 |
   +----------------------+-------------------+-------------+-------------+
   

3. To view a list of virtual hosts for the selected HTTP router, run this command:

   yc application-load-balancer http-router get <HTTP_router_name_or_ID>
   

   Result:

   id: ds7e9te73uak********
   name: my-first-router
   folder_id: b1gt6g8ht345********
   virtual_hosts:
     - name: test-virtual-host
       routes:
         - name: test-route
           http:
             match:
               path:
                 prefix_match: /
             route:
               backend_group_id: ds7a4niks9qv********
               timeout: 60s
               auto_host_rewrite: false
       route_options: {}
   created_at: "2024-08-05T08:34:03.973000654Z"
   

   Names of virtual hosts are specified in the virtual_hosts.name parameter. The example above features only one virtual host: test-virtual-host.

4. To connect a security profile to a virtual host, run this command:

   yc application-load-balancer virtual-host update <virtual_host_name> \
      --http-router-name <HTTP_router_name> \
      --security-profile-id <security_profile_ID>
   

   Where:

   • <virtual_host_name>: Virtual host name from the previous step.
   • --http-router-name: HTTP router name. This is a required parameter. Instead of the HTTP router name, you can provide its ID in the --http-router-id parameter.
   • --security-profile-id: Security profile ID. This is a required parameter.

   Result:

   done (1s)
   name: test-virtual-host
   routes:
     - name: test-route
       http:
         match:
           path:
             prefix_match: /
         route:
           backend_group_id: ds7a4niks9qv********
           timeout: 60s
           auto_host_rewrite: false
   route_options:
     security_profile_id: fev3s055oq64********
   

For more information about the yc application-load-balancer virtual-host update command, see the CLI reference.

With Terraform, you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.

Terraform is distributed under the Business Source License. The Yandex Cloud provider for Terraform is distributed under the MPL-2.0 license.

For more information about the provider resources, see the relevant documentation on the Terraform website or its mirror.

If you do not have Terraform yet, install it and configure the Yandex Cloud provider.

You can connect a Yandex Smart Web Security profile to a Yandex Application Load Balancer in the virtual host settings.

1. In the Terraform configuration file, for the yandex_alb_virtual_host resource, specify security_profile_id under route_options.

   resource "yandex_alb_virtual_host" "my-virtual-host" {
     name                    = "<virtual_host_name>"
     ...
   
     route_options {
       security_profile_id   = "<security_profile_ID>"
     }
   }
   

2. Apply the changes:

   1. In the terminal, go to the directory where you edited the configuration file.

   2. Make sure the configuration file is correct using this command:

      terraform validate
      

      If the configuration is correct, you will get this message:

      Success! The configuration is valid.
      

   3. Run this command:

      terraform plan
      

      You will see a detailed list of resources. No changes will be made at this step. If the configuration contains any errors, Terraform will show them.

   4. Apply the changes:

      terraform apply
      

   5. Type yes and press Enter to confirm the changes.

You can check the update using the management console or this CLI command:

yc alb http-router get <HTTP_router_ID>

Use the update REST API method for the VirtualHost resource or the VirtualHostService/Update gRPC API call in Application Load Balancer.