Protecting Virtual Private Cloud (VPC) Infrastructure Services with context-based restrictions

Creating network zones by using the API

You can create network zones by using the create-zone command. For more information, see the API docs.

The serviceRef attribute for VPC Infrastructure Services is is and Cloud Block Storage is server-protect.

{
  "name": "Example zone 1",
  "description": "",
  "addresses": [
    {
      "type": "serviceRef",
      "ref": {
        "service_name": "is"
      }
    }
  ]
}

{
  "name": "Example zone 1",
  "description": "",
  "addresses": [
    {
      "type": "serviceRef",
      "ref": {
        "service_name": "server-protect"
      }
    }
  ]
}

Creating network zones by using the CLI

1. To create network zones from the CLI, install the CBR CLI plug-in.

2. Use the cbr-zone-create command to add network locations, VPCs, and service references to network zones. For more information, see the CBR CLI reference.

   To find a list of available service reference targets, run the ibmcloud cbr service-ref-targets command. The service_name for VPC Infrastructure Services is is and Cloud Block Storage is server-protect.

   The following example command adds the is service, referred to as VPC Infrastructure Services in IBM Cloud® console, to a network zone.

   ibmcloud cbr zone-create --name example-zone-1 --description "Example zone 1" --service-ref service_name=is
   

   The following example command adds the server-protect service, referred to as Cloud Block Storage in IBM Cloud® console, to a network zone.

   ibmcloud cbr zone-create --name example-zone-1 --description "Example zone 1" --service-ref service_name=server-protect
   

Creating network zones from the console

1. Determine which resources you want to add to your allowlist.
2. Check the service references section to see if you need to add any service reference to your network zone.
3. Follow these steps to create context-based restrictions in the console.

Creating rules by using the API

Review the following example requests to create rules. For more information about the v1/rules API, see the API docs.

After you create a rule, it might take up to 10 minutes before you can update that rule.

The following example payload creates a rule that protects the Virtual Server Instances and allows access only from the specified network zone via a private endpoint.

{
  "contexts": [
    {
      "attributes": [
        {
          "name": "endpointType",
          "value": "private"
        },
        {
          "name": "networkZoneId",
          "value": "45ec64065b7c2bf84b3edec803335111"
        }
      ]
    }
  ],
  "resources": [
    {
      "attributes": [
        {
          "name": "resourceGroupId",
          "value": "1171749e3a8545069d04e6fca1ded18f"
        },
        {
          "name": "serviceName",
          "value": "is"
        },
        {
          "name": "instanceId",
          "value": "*"
        }
      ]
    }
  ]
}

Creating rules by using the CLI

1. To create rules from the CLI, install the CBR CLI plug-in.
2. Use the ibmcloud cbr rule-create command to create CBR rules. For more information, see the CBR CLI reference.

The examples in this section are enforcement rules. You can make them report-only by adding --enforcement-mode report.

The following example CLI command creates a context-based restriction rule for all of the virtual server instances in the current account:

ibmcloud cbr rule-create  --zone-id a7eeb5dd8e6bdce670eba1afce18e37f --description "Test CBR for VSIs" --service-name is --resource-attributes "instanceId=*"

The following example CLI command creates a context-based restriction rule for a specific block storage volume in the current account:

ibmcloud cbr rule-create --zone-id a7eeb5dd8e6bdce670eba1afce18e37f --description "Test CBR for volume" --service-name is --resource-attributes "volumeId=UUID_OF_THE_VOLUME"

The following example CLI command creates a context-based restriction rule for all of the virtual server instances in the current account and restricts access to private endpoints:

ibmcloud cbr rule-create --context-attributes 'endpointType=private' --zone-id a7eeb5dd8e6bdce670eba1afce18e37f --description "Test CBR for VSIs" --service-name is --resource-attributes "instanceId=*"

The following example CLI command creates a context-based restriction rule for all the virtual server instances in the resource group and restricts access to private endpoints:

ibmcloud cbr rule-create --context-attributes 'endpointType=private' --zone-id a7eeb5dd8e6bdce670eba1afce18e37f --description "Test CBR for VSIs" --service-name is --resource-attributes "instanceId=*" --resource-group-id 1171749e3a8545069d04e6fca1ded18f

Creating rules in the UI

1. Go to Manage > Context-based restrictions in the IBM Cloud® console.

2. Select Rules and click Create.

3. Select VPC Infrastructure Services and click Next.

4. Scope the rule to All resources or Specific resources. For more information, see Protecting VPC Infrasturcture Services resources. Click Continue.

5. Define the allowed endpoint types.

   • Keep the toggle set to No to allow all endpoint types.
   • Set the toggle to Yes to allow only specific endpoint types, then choose from the list.

6. Select a network zone or zones that you have already created, or create a new network zone by clicking Create.

   Contexts define the location from which your resources can be accessed, effectively linking your network zone to your rule.

7. Click Add to add your configuration to the summary. Click Next.

8. Name your rule and select how you want to enforce it. Then click Create.