{% set config = merged_configs.get('google_compute_security_policy', {}) %}
# Compliance: {{ compliance_comments.get('google_compute_security_policy', []) | join(', ') }}
resource "google_compute_security_policy" "main" {
  name    = "{{ config.get('name', '${var.project_id}-armor-policy') }}"
  project = var.project_id

  adaptive_protection_config {
    layer_7_ddos_defense_config {
      enable = {{ config.get('layer_7_ddos_defense', true) | lower }}
    }
  }

  rule {
    action   = "allow"
    priority = 2147483647
    match {
      versioned_expr = "SRC_IPS_V1"
      config {
        src_ip_ranges = ["*"]
      }
    }
    description = "Default allow rule"
  }

  rule {
    action   = "deny(403)"
    priority = 1000
    match {
      expr {
        expression = "evaluatePreconfiguredExpr('xss-v33-stable')"
      }
    }
    description = "XSS protection"
  }

  rule {
    action   = "deny(403)"
    priority = 1001
    match {
      expr {
        expression = "evaluatePreconfiguredExpr('sqli-v33-stable')"
      }
    }
    description = "SQLi protection"
  }
}
