A Firewall Policy that Governs a Network and Leaves a Record
A global network firewall policy exists independently of any network; an association puts it in the path, and a policy with a hundred rules and none governs nobody while rendering as fully configured. enable_logging defaults to false on every rule, so a deny that fires leaves no evidence. Refuses a policy with no network, logs every rule unless told not to, and counts the disabled ones.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- No applicable security policies for this provider
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-14 · how we verify
Use it from the registry
terraform · opentofumodule "firewall_policy" {
source = "www.iac-bazaar.com/iac-bazaar/gcp-firewall-policy/gcp"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
gcp-firewall-policy
A global network firewall policy that governs a network, with rules that
leave a record. Works with Terraform and OpenTofu (>= 1.6), google
provider >= 6.0, < 7.0.
A policy associated with no network governs nothing. Network firewall
policies are the successor to per-network VPC firewall rules: one policy,
many networks, rules with FQDNs, geo codes, threat intelligence and secure
tags. The policy and its rules exist independently of any network; an
association puts them in the path. A policy with a hundred rules and no
association is a hundred rules nobody is subject to, rendered as fully
configured. Refused without networks unless accept_unassociated.
enable_logging defaults to false on every rule. A deny that fires with
logging off drops the packet and leaves no evidence it did. Every rule here
logs unless told not to; the exceptions need accept_unlogged_rules and are
counted in unlogged_rule_count.
A disabled rule is a rule that does not exist, in the same list as the ones
that do. Each needs accept_disabled_rules.
goto_next is not allow. It defers to the next policy and finally to the
network's own VPC rules, whose implied rule denies ingress.
decides_something is false for a policy of nothing but goto_next.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
gcp-service-perimeter
spec is the dry-run configuration and status is the enforced one - two blocks of the same shape, and a perimeter with only a spec is evaluated on every request, logs violations, and blocks nothing. Empty restricted_services is the other way to have none: the perimeter exists, covers the projects, and governs no API.
gcp-recaptcha
A key with a testing score returns that score for every assessment, bots included - right for staging and, on a production key, a filter that filters nothing; allow_all_domains lets any site consume your assessments against your quota. Testing mode refused without acceptance, domains required on web keys, invisible scoring by default; only a backend assessment call turns a token into a decision.
gcp-cloud-ids
Creating the endpoint creates no packet mirroring policy, so an endpoint with nothing mirrored is provisioned, billed by the hour, shown with a green check and has never seen a packet. The mirroring policy is created with it and refused when it mirrors nothing. Cloud IDS detects and never blocks; blocks_traffic is an output that is always false.
gcp-cloud-armor
A global Cloud Armor WAF policy with preconfigured OWASP SQLi and XSS rules enforcing by default, an optional per-client rate limit, and custom IP allow/deny rules - attachable to many backends.
gcp-security-command-center
The findings page is not a pager: a project accumulates thousands of findings with nobody having received a message, and a mute rule silences a whole category, now and in future, with no record why. Streams CRITICAL and HIGH findings to a Pub/Sub topic as a requirement, refuses a mute without a written reason, and refuses a custom detector created DISABLED, which is listed and evaluates nothing.
gcp-workload-identity-federation
attribute_condition is optional, and the issuer is not yours - so omitting it on a GitHub Actions provider trusts every workflow in every repository belonging to anyone on GitHub. It works perfectly in testing, because your workflow is one of the ones it admits. Refused here, along with a wildcard principalSet.