Skip to content
Get packs

Cloud Armor CRS Rule Upgrader

Upgrades Google Cloud Armor WAF policies from OWASP CRS 3.0/3.3 to CRS 4.22 with risk audits

Source Download skill
Repository
google/skills
Stars
21,782
Licence
Apache-2.0
Files
7 files

What it does

Once installed, the agent can audit a Google Cloud Armor web application firewall policy that still uses older OWASP Core Rule Set versions (3.0 or 3.3) and plan or perform an upgrade to version 4.22. It rewrites rule references and signature IDs, flags changes that could block legitimate traffic (such as stricter method enforcement for PUT, PATCH and DELETE), and offers two rollout paths: a direct in-place swap, or a safer preview mode that logs what would be blocked before enforcement. It also includes a Python helper script that parses policy JSON and produces gcloud commands or reports.

Great for

  • Cloud or network security engineers who manage Google Cloud Armor WAF policies on load balancers
  • Teams planning a migration off legacy OWASP CRS 3.x rulesets before they are retired
  • Operators who want a risk report before changing production firewall rules

Skip it if

  • Non-WAF Cloud Armor rules such as IP rate limiting, geo-blocking or reCAPTCHA, which the skill explicitly excludes
  • AWS or Azure WAF migrations, which are out of scope
  • Anyone expecting it to run safely without cloud access: applying changes can alter live traffic filtering and needs a qualified reviewer

Try asking

  • “Audit my ecommerce-waf Cloud Armor policy and tell me which rules still use CRS 3.3”
  • “Generate a preview-mode upgrade plan for my security policy at priority spacing with gcloud commands”
  • “Show me which method enforcement rules could block PUT or DELETE requests after upgrading to CRS 4.22”
Step-by-step guide: how to use Cloud Armor CRS Rule UpgraderInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 7 original files, the Apache-2.0 licence and an attribution note.

    cloud-armor-crs-rule-upgrader.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip cloud-armor-crs-rule-upgrader.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip cloud-armor-crs-rule-upgrader.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Start with a read-only audit and the report format before generating any change commands
  • Use preview mode first and review Cloud Logging telemetry before cutting over to in-place enforcement
  • Delete temporary preview rules after cutover so they do not consume policy quota or incur charges

What's inside

  • references/attribution.md
  • references/contributing.md
  • references/fine_tuning_and_cel.md
  • references/gcloud_recipes.md
  • references/ruleset_mappings.md
  • scripts/upgrade_policy.py
  • SKILL.md

Redistributed unmodified from google/skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.