Enforce security policies

Integrating Application Design Center with Security Command Center lets you establish policy requirements and verify that your application infrastructure aligns with organizational security policies before deployment. After an administrator deploys frameworks in Security Command Center, you can attach those frameworks to application templates in App Design Center.

During the design phase, application developers can run an assessment on the design canvas to review the compliance scorecard and fix misconfigurations before deployment. Deployed applications inherit the frameworks attached to their templates, and Security Command Center monitors runtime resources to detect configuration drift and trace issues to a specific template revision.

Before you begin

To attach frameworks to your application templates and perform security assessments in App Design Center, you must have Security Command Center active for your organization. The assessment features available to you depend on your service tier:

  • Standard tier: Your application templates and instances are validated against the Google Cloud Security Essentials framework.
  • Premium or Enterprise tier: In addition to the Security Essentials framework, you can create additional frameworks in Security Command Center and attach them directly to your templates to enforce custom or regulatory compliance.

After setting up your application management boundary, you can view and attach security frameworks in the App Design Center canvas. For more information, see App Hub as a detection service in Security Command Center.

Required roles

To get the permissions that you need to attach frameworks to templates and run assessments, ask your administrator to grant you the following IAM roles on the management project:

For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

Attach frameworks to your application template

To enforce consistent security policies on deployed applications, attach Security Command Center frameworks directly to your application templates. This applies a consistent set of policies to any application deployed from that template.

To attach frameworks to your application template, do the following:

gcloud CLI

  1. Find available frameworks to attach:

    gcloud alpha design-center locations fetch-frameworks LOCATION \
    --project=PROJECT

  2. Create a policy to attach the framework to your application template:

    gcloud alpha design-center spaces application-templates policies create POLICY \
    --application-template=APPLICATION_TEMPLATE \
    --project=PROJECT \
    --location=LOCATION \
    --space=SPACE \
    --policy-type=compliance-framework \
    --policy-uri=POLICY_URI

    Replace the following:

    • POLICY: A name for the policy attachment, for example, my-security-policy.
    • APPLICATION_TEMPLATE: The template ID for the application template.
    • PROJECT: Your management project ID.
    • LOCATION: The application template region.
    • SPACE: Your space ID.
    • POLICY_URI: The URI of the Security Command Center framework you want to attach, for example, organizations/12345/locations/global/frameworks/my-framework.

Run an assessment

Before you share a template with application developers, perform a template security assessment. This helps you identify and fix any security issues before application developers deploy an application based on the template:

gcloud CLI 

gcloud alpha design-center spaces application-templates generate-assessment-report APPLICATION_TEMPLATE \
--project=PROJECT \
--location=LOCATION \
--space=SPACE

Replace the following:

  • APPLICATION_TEMPLATE: The template ID for the application template that you want to assess.
  • PROJECT: Your management project ID.
  • LOCATION: The application template region.
  • SPACE: Your space ID.

The output displays an assessment report for your application template based on attached frameworks.

What's next