Create and manage security profile groups

This page explains how to create and manage security profile groups with a custom security profile by using the Google Cloud CLI.

Before you begin

• You must enable the Network Security API in your project.

• Install the gcloud CLI if you want to run the gcloud command-line examples in this guide.

• You must have a custom mirroring security profile.

Roles

To get the permissions that you need to create, view, update, or delete security profile groups, ask your administrator to grant you the necessary Identity and Access Management (IAM) roles on your organization. For more information about granting roles, see Manage access to projects, folders, and organizations.

To check the progress of the operations listed on this page, make sure that your user role has the following Compute Network User role (roles/compute.networkUser) permissions:

• networksecurity.operations.get
• networksecurity.operations.list

Create a security profile group with custom profile

You can only create a security profile group with a security profile of type CUSTOM_MIRRORING.

When you create a security profile group, you can specify the name of the security profile group as a string or as a unique URL identifier. The unique URL for an organization-scoped security profile group can be constructed in the following format:

  organizations/ORGANIZATION_ID/locations/LOCATION/securityProfileGroups/SECURITY_PROFILE_GROUP_NAME

Replace the following:

• ORGANIZATION_ID: ID of the organization.

• LOCATION: scope of the security profile group. Location is always set to global.

• SECURITY_PROFILE_GROUP_NAME: the name of the security profile group.

If you use a unique URL identifier for the security profile group name, the organization and location of the security profile group is already included in the URL identifier. However, if you use only the security profile group name, you must specify the organization and location separately. For more information about unique URL identifiers, see Specifications.

 gcloud beta network-security security-profile-groups \
     create SECURITY_PROFILE_GROUP_NAME \
     --custom-mirroring-profile CUSTOM_MIRROING_PROFILE_NAME \
     --description DESCRIPTION \
     --organization ORGANIZATION_ID \
     --location=global \
     --billing-project PROJECT_ID

View security profile group

You can view the details of a specific security profile group in an organization.

 gcloud beta network-security security-profile-groups \
     describe SECURITY_PROFILE_GROUP_NAME \
     --organization ORGANIZATION_ID \
     --location=global \
     --billing-project PROJECT_ID

List security profile groups

You can list all the custom mirroring security profile groups in an organization.

gcloud beta network-security security-profile-groups list \
    --organization ORGANIZATION_ID \
    --location=global \
    --filter CUSTOM_MIRRORING_PROFILE
    --billing-project PROJECT_ID

Update a security profile group

You can update the description and labels of the security profile referenced in a security profile group.

gcloud beta network-security security-profile-groups \
    update SECURITY_PROFILE_GROUP_NAME \
    --organization ORGANIZATION_ID \
    --location=global \
    --description DESCRIPTION

Delete a security profile group

You can delete a security profile group by specifying its name, location, and organization. However, if a custom security profile is referenced by a network firewall policy, that security profile group cannot be deleted.

gcloud beta network-security security-profile-groups \
    delete SECURITY_PROFILE_GROUP_NAME \
    --custom-profile CUSTOM_PROFILE_NAME \
    --organization ORGANIZATION_ID \
    --location-global \
    --billing-project PROJECT_ID

What's next

• Create and manage mirroring endpoint groups
• Security profile groups overview
• Create and manage custom mirroring security profiles