[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-05-05。"],[[["\u003cp\u003eAddress groups contain multiple IP addresses or IP ranges, which can be used by various resources like Cloud NGFW firewall policies and Google Cloud Armor security policies.\u003c/p\u003e\n"],["\u003cp\u003eUpdates made to an address group are automatically reflected in all resources that reference it, simplifying the management of IP address lists.\u003c/p\u003e\n"],["\u003cp\u003eAddress groups are uniquely identified by a URL containing the container type, container ID, location, and address group name, and they can be either IPv4 or IPv6, but not both.\u003c/p\u003e\n"],["\u003cp\u003eAddress groups can be either project-scoped, used within a specific project, or organization-scoped, used across an entire organization, offering different levels of control.\u003c/p\u003e\n"],["\u003cp\u003eTo manage address groups, users require the Network Administrator role, and the capacity of an address group must be considered in relation to the firewall policies where it's used.\u003c/p\u003e\n"]]],[],null,["# Address groups for firewall policies\n\nAn *address group* contains multiple IP addresses, IP address ranges in CIDR\nformat, or both. Each address group can be used by multiple resources, such as\nrules in Cloud NGFW firewall policies or rules in\nCloud Armor security policies.\n\nUpdates to an address group are automatically propagated to the resources that\nreference the address group. For example, you can create an address group\ncontaining a set of trusted IP addresses. To change the set of trusted IP\naddresses, you update the address group. Your updates to the address group are\nreflected in each associated resource automatically.\n\nSpecifications\n--------------\n\nAddress group resources have the following characteristics:\n\n- Each address group is uniquely identified by a URL with the following elements:\n - **Container type:** Determines the address group type---`organization` or `project`.\n - **Container ID:** ID of the organization or the project.\n - **Location:** Specifies if the address group is a `global` or regional resource (such as `europe-west`).\n - **Name:** The address group name with the following format:\n - A string 1-63 characters long\n - Includes only alphanumeric characters\n - Must not start with a number\n- You can construct a unique URL identifier for an address group in the\n following format:\n\n \u003ccontainerType\u003e/\u003ccontainerId\u003e/locations/\u003clocation\u003e/addressGroups/\u003caddress-group-name\u003e\n\n For example, a `global` address group `example-address-group` in project\n `myproject`has the following unique 4-tuple identifier: \n\n projects/myproject/locations/global/addressGroups/example-address-group\n\n- Each address group has an associated type that can be either IPv4 or IPv6,\n but not both. The address group type cannot be changed later.\n\n- Each IP address or IP range in an address group is referred to as an *item*.\n The number of items that you can add to an address group depends on the\n address group's capacity. You can define the item capacity during address\n group creation. This capacity cannot be changed later. The maximum capacity\n that you can configure for an address group varies depending on the product\n with which you use the address group.\n\n- You must specify the capacity and type when you create an address group. In\n addition, when you use Cloud Armor, you must set the `purpose`\n field to `CLOUD_ARMOR`.\n\n- When you create an address group with a purpose that is *not*\n `CLOUD_ARMOR`, the address group has a maximum capacity of 1,000 IP\n addresses.\n\nTypes of address groups\n-----------------------\n\nAddress groups are classified based on their scope. The scope identifies the level\nat which the address group is applicable in the\n[resource hierarchy](/resource-manager/docs/cloud-platform-resource-hierarchy).\nAddress groups are categorized into the following types:\n\n- [Project-scoped address groups](#project-scoped-address-group)\n- [Organization-scoped address groups](#organization-scoped-address-group)\n\nAn address group can be either project-scoped or organization-scoped, but not\nboth.\n\n### Project-scoped address groups\n\nUse project-scoped address groups when you want to define your own list of IP\naddresses to be used within a project or a network to block or allow a list of\nchanging IP addresses. For example, if you want to define your own threat\nintelligence list and add it to a rule, create an address group with the\nrequired IP addresses.\nThe container type for project-scoped address groups is always set to `project`. For more information about how to create and modify project-scoped address groups, see [Use project-scoped address groups](/firewall/docs/use-address-groups-firewall-policies#project-scoped-address-group).\n\n### Organization-scoped address groups\n\nUse organization-scoped address groups when you want to define a central list of IP addresses that can be used in high-level rules to provide consistent control for the entire organization and reduce the overhead for individual network and project owners to maintain common lists, such as trusted services and internal IP addresses.\n\n\u003cbr /\u003e\n\nThe container type for organization-scoped address groups is always set to\n`organization`. For more information about how to create and modify\norganization-scoped address groups, see\n[Use organization-scoped address groups](/firewall/docs/use-address-groups-firewall-policies#organization-scoped-address-group).\n\n\nIAM roles\n---------\n\nTo create and manage an address group, you need the\nCompute Network Admin role (`roles/compute.networkAdmin`). You can also define\na custom role with an equivalent set of permissions.\n\nThe following table provides a list of Identity and Access Management (IAM) permissions\nrequired to perform a set of tasks on address groups.\n\nFor more information about which roles include specific IAM\npermissions, see the\n[IAM roles and permissions index](/iam/docs/permissions-reference).\n\nHow address groups work with firewall policies\n----------------------------------------------\n\nAddress groups simplify the configuration and maintenance of firewall policies.\nYou can share the IP addresses across firewall policies and define more\ncomplex, consistent, and robust firewall policies for your network with reduced\nmaintenance overhead. Consider the following additional specifications when you\nuse address groups with firewall policies:\n\n- The capacity of an address group gets added to the total attribute\n count of the firewall policy where the address group is used. Make sure that\n you set the capacity to an appropriate value based on your use case.\n\n- If an address group added to the firewall policy rule does not exist, the\n address group filter is removed from the rule. For more information about\n how to add source or destination address groups to firewall policy rules,\n see [Sources](/firewall/docs/firewall-policies-rule-details#sources)\n and [Destinations](/firewall/docs/firewall-policies-rule-details#destinations).\n\n- Organization-scoped address groups can be used in\n [hierarchical firewall policies](/firewall/docs/using-firewall-policies#create-rules),\n [global network firewall policies](/firewall/docs/use-network-firewall-policies#create-rules),\n and [regional network firewall policies](/firewall/docs/use-regional-firewall-policies#create-rules).\n Project-scoped address groups can only be used in\n [global network firewall policies](/firewall/docs/use-network-firewall-policies#create-rules)\n and [regional network firewall policies](/firewall/docs/use-regional-firewall-policies#create-rules).\n\n- For both project-scoped and organization-scoped address groups, the location\n of the address group must match with the location of the firewall policy.\n\nWhat's next\n-----------\n\n- [Use address groups](/firewall/docs/use-address-groups-firewall-policies)"]]
