Skip to content
Get packs

Guide · Agent skill

How to use the Cloud Armor CRS Rule Upgrader agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

The Cloud Armor CRS Rule Upgrader is an agent skill, a folder of instructions and scripts that an AI agent such as Claude loads when it needs them. It helps network security engineers audit a Google Cloud Armor web application firewall policy that still uses OWASP Core Rule Set 3.0 or 3.3 and plan or perform an upgrade to 4.22. After this guide you will know how to install the skill, ask for the right kind of help, and review the risks before any production rule changes.

Cloud Armor CRS Rule Upgradergoogle/skills · Apache-2.0

Quick start

  1. 1Install the skill. Download the ZIP from the skill page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder, or upload it under Settings → Capabilities → Skills in the Claude apps.
  2. 2Set up Google Cloud access. Select your project, confirm billing is enabled, enable the Compute Engine and Cloud Logging APIs, and authenticate with gcloud.
  3. 3Grant the required IAM roles. Use roles/compute.securityAdmin for changes, roles/compute.securityViewer for read-only audits, and roles/logging.viewer for preview telemetry.
  4. 4Ask for an audit. Name the policy and ask the agent to audit it for legacy CRS 3.0 or 3.3 rulesets and operational risk.
  5. 5Get the policy JSON. Run gcloud compute security-policies describe POLICY_NAME --format=json and share the output with the agent, or pipe it into the helper script.
  6. 6Choose an upgrade mode. Decide between In-Place Upgrade and Preview Mode, and review the risk report and method enforcement warnings before applying anything.
  7. 7Verify and clean up. Check telemetry in Cloud Logging after a preview, then delete temporary preview rules once cutover is complete.

What the skill makes the agent do

Once installed, the agent can audit a Cloud Armor security policy for legacy OWASP CRS rulesets such as sqli-stable, xss-stable, rce-stable and methodenforcement-stable, or evaluatePreconfiguredExpr calls. It rewrites rule references and signature IDs for CRS 4.22, drops retired signature IDs, and updates structured preconfiguredWafConfig fine-tuning exclusions.

The skill also rates operational risk as High Breaking Change, Medium Attention Required or Low Clean Upgrade. It flags changes that could block legitimate traffic, such as stricter method enforcement for PUT, PATCH and DELETE, and it reports sensitivity coverage expansions.

  • In-Place Upgrade: direct replacement of rules with immediate enforcement and zero extra quota.
  • Preview Mode: preview rules deployed at lower numeric priority numbers with preview = true, so you can inspect telemetry in Cloud Logging before cutover.
  • A bundled Python helper, scripts/upgrade_policy.py, parses policy JSON and produces a report or gcloud commands.

Install the skill (ZIP download or Claude apps)

Download the ZIP from the skill page and unzip it. For a personal install, place the folder in ~/.claude/skills/. For a single project, place it in the project's .claude/skills/ folder.

In the Claude apps, you can instead upload the skill under Settings → Capabilities → Skills.

  • Personal install: ~/.claude/skills/cloud-armor-crs-rule-upgrader/
  • Project install: .claude/skills/cloud-armor-crs-rule-upgrader/ inside your repository

Prepare Google Cloud access and permissions

The skill runs gcloud commands against your projects, so set up access before you ask for an audit. You need the Google Cloud CLI, Python 3, a project with billing enabled, and the Compute Engine and Cloud Logging APIs enabled.

Authenticate with gcloud auth login for interactive use, gcloud auth application-default login for application default credentials, or set GOOGLE_APPLICATION_CREDENTIALS to a service account key file. Use roles/compute.securityAdmin to change policies, roles/compute.securityViewer for read-only audits, and roles/logging.viewer to read preview telemetry.

  • gcloud config set project PROJECT_ID
  • gcloud services enable compute.googleapis.com logging.googleapis.com
  • Policies can be Global (default for global external Application Load Balancers) or Regional (set a default region with gcloud config set compute/region).
gcloud config set project PROJECT_ID gcloud billing projects describe PROJECT_ID --format="value(billingEnabled)" gcloud services enable compute.googleapis.com logging.googleapis.com

Trigger the skill with natural requests

You do not need special syntax. Describe the policy and the outcome you want, and name the policy if you have it. The skill is meant for requests to audit, upgrade or transition Cloud Armor WAF rules to CRS 4.22.

If you do not paste policy JSON, the agent will give you the describe command to run and the audit checks to perform. Paste the JSON output back when you have it.

  • Audit my ecommerce-waf policy for legacy OWASP 3.3 rulesets and tell me the risks.
  • Plan a preview-mode upgrade of the checkout security policy to CRS 4.22.
  • Which of my rules would block PUT or DELETE requests after moving to CRS 4.22?
  • Generate gcloud commands for an in-place upgrade from this policy JSON.

Run the helper script

The bundled script gives deterministic parsing, signature remapping and preview priority allocation. Preview mode generates preview rules at priority minus 5. You can also pipe policy JSON straight from gcloud.

python3 scripts/upgrade_policy.py /path/to/policy.json --mode=in-place --format=report python3 scripts/upgrade_policy.py /path/to/policy.json --mode=preview --format=gcloud gcloud compute security-policies describe POLICY_NAME --format=json | python3 scripts/upgrade_policy.py - --mode=preview --format=json

Safety notes: scripts and network access

This skill runs scripts and uses the network. It executes gcloud and can call Google Cloud APIs. Applying changes can alter live traffic filtering, so have a qualified reviewer check every plan before it touches production. Each gcloud command is tagged with a metrics environment variable that identifies only the skill and its version; it contains no user data.

The skill does not cover non-WAF Cloud Armor rules such as IP rate limiting, geo-blocking or reCAPTCHA, or AWS and Azure WAF migrations.

  • Read the risk report before running any apply command.
  • Use preview mode first when you want telemetry before enforcement.
  • Delete temporary preview rules after cutover so they do not consume quota or incur rule charges.

Tips for a safer upgrade

Start with a read-only audit using securityViewer. Keep opt-out lists as opt-out lists: the skill is designed never to convert them into opt-in lists. Check the method enforcement section for PUT, PATCH and DELETE traffic your application actually uses.

The skill also watches a 200-rule quota guardrail and priority spacing, so review the generated priorities before applying them.

  • Export the current policy to a file as a backup before changing it.
  • Review sensitivity coverage expansions with your application team.
  • Check pricing on the Google Cloud Armor pricing page, since charges depend on policies, rules and requests.

What people use it for

  • Auditing a load balancer's WAF policy for legacy sqli-stable, xss-stable and rce-stable rules before a CRS retirement deadline.
  • Planning a preview-mode rollout so blocked requests appear in Cloud Logging before enforcement begins.
  • Checking whether stricter method enforcement will block PUT, PATCH or DELETE traffic in a production API.
  • Generating a gcloud command set from policy JSON for review by a security team.

Frequently asked questions

How do I install the Cloud Armor CRS Rule Upgrader skill?

Download the ZIP from the skill page and unzip it into ~/.claude/skills/ for a personal install, or into a project's .claude/skills/ folder. In the Claude apps, you can upload it under Settings → Capabilities → Skills instead.

What do I need to use this skill?

You need the Google Cloud CLI (gcloud), Python 3, and a Google Cloud project with billing enabled and the Compute Engine and Cloud Logging APIs enabled. You also need credentials and the IAM roles roles/compute.securityAdmin or roles/compute.securityViewer, plus roles/logging.viewer for preview telemetry.

Is the Cloud Armor CRS Rule Upgrader free?

The skill is licensed under Apache-2.0. Google Cloud Armor itself is billed per security policy, per rule and per million requests depending on tier, so check the Google Cloud Armor pricing page for current rates.

What is the difference between In-Place Upgrade and Preview Mode?

In-Place Upgrade replaces rules directly and enforces them immediately with zero extra quota. Preview Mode deploys preview rules at lower numeric priority numbers, which log what would be blocked so you can check Cloud Logging before cutover.

Does the skill work with AWS or Azure WAF?

No. The skill is for Google Cloud Armor WAF policies only. It also excludes non-WAF Cloud Armor rules such as IP rate limiting, geo-blocking and reCAPTCHA, and AWS or Azure WAF migrations.

Why does my upgrade audit fail or return no policy data?

If the agent cannot reach your resources, first confirm that you are authenticated with gcloud auth login or application default credentials, that the project is set, and that the Compute Engine API is enabled. Then run the gcloud compute security-policies describe command yourself and paste the JSON into the chat.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This skill suits cloud and network security engineers who manage Cloud Armor WAF policies on load balancers and need a risk report before changing production rules. It is not a fit for non-WAF Cloud Armor rules, AWS or Azure WAFs, or anyone who wants changes applied without cloud access and a qualified reviewer.

Download the skill