Before
Security or cloud operations staff likely had to search for open firewall findings, identify the affected Google Cloud project and rules, and decide whether to disable access or restrict its source ranges. They then had to update each rule individually and manually notify the relevant channel about the change.
How it works
- Retrieve open Google Cloud firewall findings that match the restriction policy and determine whether any affected rules exist.
- Apply the configured remediation choice to each matching rule by disabling it or restricting access to the configured source IP.
- Post a channel update with the project, selected action, and number of affected rules.
Workflow details
- Findings retrieval: The workflow obtains a Google bearer token and queries the security findings system for open Google Cloud configuration findings matching the rule that VPC firewall rules should be restricted. The query collects affected firewall resources, their projects, regions, severity, remediation guidance, and related rule information.
- Scope validation: The workflow checks whether the returned rule set is non-empty and counts the affected rules before proceeding. If no matching rules are returned, the remediation path is not used.
- Remediation decision: A configured action determines whether the workflow disables each affected firewall rule or restricts its access to the configured source IP. The flow processes the rules individually through the cloud firewall service.
- Operational notification: After the remediation branch completes, the workflow sends a channel message identifying the Google Cloud project, the action performed, and the number of impacted rules, giving the team a direct record of the change.
What changed
Firewall findings are collected and evaluated automatically, the configured remediation is applied rule by rule without a separate manual handoff, and the resulting action and impact count are delivered to a channel after processing.
Work removed
Repeatedly searching for open overly permissive firewall findings, counting affected rules, looking up the relevant project and rule details, updating each firewall rule individually, and manually composing the remediation notification.
Expected outcome
A consistent automated remediation and notification cycle for each matching firewall finding, with the manual search, per-rule update, and status-reporting steps removed.
