Cloud Armor Request Body Exclusions

[Nathan-Scott]

Is there no way to create exclusions for specific values that appear in a request's body for the preconfigured rulesets? E.g. I have a value within a JSON parameter that is triggering a great deal of false positives, but it seems there is no way to highlight this field to be skipped by the specific rule that is causing the FPs.

Image to the side shows what values exclusions can be created for, but nothing for request body/parameters.

So as I see it, this leaves turning the rules completely off as the only option, which I don't believe is a great option.

[Marvin_Lucero]

Hi @Nathan-Scott ,

There is no direct way to create exclusions for specific values that appear in a request's body for the preconfigured rulesets in Google Cloud Armor. The exclusions are primarily designed to exclude entire IP addresses, IP ranges, or ASNs.

However, there is a workaround you can consider. You can create a custom rule in Cloud Armor to specifically allow requests with the problematic value in the request body. This way, the preconfigured rule that is causing false positives will not be triggered for requests with the problematic value. You can check this documentation for more details.