Delete multiple firewall rules in a network Google Cloud Platform

0
votes

For school we have to write a script to automaticaly deploy an application on gcp. This is going pretty well, but I have stumbled across a problem I can't seem to fix.

In my script, I need to be able to delete multiple firewall rules in my test environment network. The only option I see to do this, is to hardcode the list of names of the firewall rules. I do want it to be dynamic tho, so that when I add a rule with a different name, it also deletes that one. Is there any way to do this?

1
google-cloud-platform

1 Answers

1
votes

Unfortunately, there's no other way to do it. You should delete unnecessary rules and then create new ones.

Have a look at the documentation Using firewall rules there's no such flags like --replace or --delete for create command:

gcloud compute firewall-rules create NAME \
    [--network NETWORK; default="default"] \
    [--priority PRIORITY;default=1000] \
    [--direction (ingress|egress|in|out); default="ingress"] \
    [--action (deny | allow )] \
    [--target-tags TAG,TAG,...] \
    [--target-service-accounts=IAM Service Account,IAM Service Account,...] \
    [--source-ranges CIDR-RANGE,CIDR-RANGE...] \
    [--source-tags TAG,TAG,...] \
    [--source-service-accounts=IAM Service Account,IAM Service Account,...] \
    [--destination-ranges CIDR-RANGE,CIDR-RANGE...] \
    [--rules (PROTOCOL[:PORT[-PORT]],[PROTOCOL[:PORT[-PORT]],...]] | all ) \
    [--disabled | --no-disabled]
    [--enable-logging | --no-enable-logging]

You can try to update existing rules, but it has some limitations:

You can modify some components of a firewall rule, such as the specified protocols and ports for the match condition. You cannot modify a firewall rule's name, network, the action on match, and the direction of traffic.

If you need to change the name, network, or the action or direction component, you must delete the rule and create a new one instead.

As a possible workaround you can file a feature request at the Google Issue Tracker under this component and ask to introduce some --replace or --delete flags for create command.