Protecting DNS Services resources with context-based restrictions

Creating network zones from the CLI

1. To create network zones from the CLI, install the CBR CLI plug-in.

2. Use the cbr-zone-create command to add network locations and VPCs to network zones. For more information, see the CBR CLI reference.

   The following example command adds an individual IP, range, subnet, and a VPC to a network zone.

   ibmcloud cbr zone-create --name example-zone --description "this is an example of zone" --addresses 169.23.56.234,169.23.22.0-169.23.22.255,192.0.2.0/24 --vpc crn:v1:bluemix:public:is:us-south:a/12ab34cd56ef78ab90cd12ef34ab56cd::vpc:r134-d98a1702-b39a-449a-86d4-ef8dbacf281e
   

Creating network zones with the API

You can create network zones by using the create-zone command. For more information, see the API docs.

The addresses attribute specifies individual IP addresses, ranges, subnets, and VPCs where requests originating from are permitted.

{
    "name": "example-zone",
    "description": "this is an example of zone",
    "account_id": "12ab34cd56ef78ab90cd12ef34ab56cd",
    "addresses": [
        {
            "type": "ipAddress",
            "value": "169.23.56.234"
        },
        {
            "type": "ipRange",
            "value": "169.23.22.0-169.23.22.255"
        },
        {
            "type": "subnet",
            "value": "192.0.2.0/24"
        },
        {
            "type": "vpc",
            "value": "crn:v1:bluemix:public:is:us-south:a/12ab34cd56ef78ab90cd12ef34ab56cd::vpc:r134-d98a1702-b39a-449a-86d4-ef8dbacf281e"
        }
    ]
}

{
  "id": "65810ac762004f22ac19f8f8edf70a34",
  "crn": "crn:v1:bluemix:public:context-based-restrictions:global:a/12ab34cd56ef78ab90cd12ef34ab56cd::zone:65810ac762004f22ac19f8f8edf70a34",
  "name": "example-zone",
  "description": "this is an example of zone",
  "account_id": "12ab34cd56ef78ab90cd12ef34ab56cd",
  "addresses": [
    {
      "type": "ipAddress",
      "value": "169.23.56.234"
    },
    {
      "type": "ipRange",
      "value": "169.23.22.0-169.23.22.255"
    },
    {
      "type": "subnet",
      "value": "192.0.2.0/24"
    },
    {
      "type": "vpc",
      "value": "crn:v1:bluemix:public:is:us-south:a/12ab34cd56ef78ab90cd12ef34ab56cd::vpc:r134-d98a1702-b39a-449a-86d4-ef8dbacf281e"
    }
  ],
  "address_count": 4,
  "excluded_count": 0,
  "href": "https://cbr.cloud.ibm.com/v1/zones/65810ac762004f22ac19f8f8edf70a34",
  "created_at": "2020-11-23T02:01:59Z",
  "created_by_id": "IBMid-120000P1JM",
  "last_modified_at": "2022-09-26T02:01:59Z",
  "last_modified_by_id": "IBMid-120000P1JM"
}

Creating rules from the CLI

1. To create rules from the CLI, install the CBR CLI plug-in.
2. Use the ibmcloud cbr rule-create command to create CBR rules. For more information, see the CBR CLI reference.

The examples in this section are enforcement rules. You can make them report-only by adding --enforcement-mode report.

The following example CLI command creates a context-based restriction rule for a DNS Services instance in the current account:

ibmcloud cbr rule-create  --zone-id 65810ac762004f22ac19f8f8edf70a34 --description "example CBR rule" --service-name dns-svcs --service-instance 3bd0bc3c-232c-4886-a0c4-72aa26ec0d38

Creating rules with the API

Review the following example requests to create rules. For more information about the v1/rules API, see the API docs.

When you create a rule with context attribute to restrict requests to private endpoint, it is not possible to restrict access to an overlay IP for an individual VPC virtual server instance or bare-metal server. You must specify the VPC zone's underlay IP addresses, which are also known as Cloud Service Endpoint IPs.

The following example payload creates a rule that protects the DNS Services instance and allows access only from the specified network zone via a private endpoint.

{
  "contexts": [
    {
      "attributes": [
        {
          "name": "endpointType",
          "value": "private"
        },
        {
          "name": "networkZoneId",
          "value": "65810ac762004f22ac19f8f8edf70a34"
        }
      ]
    }
  ],
  "resources": [
    {
      "attributes": [
        {
          "name": "serviceName",
          "value": "dns-svcs"
        },
        {
          "name": "serviceInstance",
          "operator": "stringEquals",
          "value": "3bd0bc3c-232c-4886-a0c4-72aa26ec0d38"
        }
      ]
    }
  ]
}