Security policy¶

Security Policy¶

Rule Sets¶

class illumio.rules.RuleSet[source]¶

Represents a rule set object in the PCE.

Rule sets provide scope boundaries for security policy rules. Scopes are defined using application, environment, and location labels. Rules within the set will default to applying to workloads with these labels.

Rule sets can contain:

rules: Standard allow rules (sec_rules)
deny_rules: Block rules; each carries an override flag. Rules are evaluated in the order override-deny (override=True) > allow > deny (override=False). A ruleset exposes a single deny_rules array holding both kinds — there is no separate override-deny array.
ip_tables_rules: Custom IP tables rules

Deny rules are created against a ruleset by passing it as the parent argument, e.g. pce.deny_rules.create(rule, parent=ruleset).

See https://docs.illumio.com/core/21.5/Content/Guides/security-policy/create-security-policy/rulesets.htm

Usage:

>>> import illumio
>>> pce = illumio.PolicyComputeEngine('pce.company.com', port=443, org_id=1)
>>> pce.set_credentials('api_key', 'api_secret')
>>> app_label = pce.labels.create({'key': 'app', 'value': 'A-App'})
>>> env_label = pce.labels.create({'key': 'env', 'value': 'E-Prod'})
>>> loc_label = pce.labels.create({'key': 'loc', 'value': 'L-AWS'})
>>> ruleset = illumio.RuleSet(
...     name='RS-RINGFENCE',
...     scopes=[
...         illumio.LabelSet(
...             labels=[app_label, env_label, loc_label]
...         )
...     ]
... )
>>> ruleset = pce.rule_sets.create(ruleset)
>>> ruleset
Ruleset(
    href='/orgs/1/sec_policy/draft/rule_sets/19',
    name='RS-RINGFENCE'
)
>>> # Create a deny rule within the ruleset
>>> deny_rule = illumio.DenyRule.build(
...     providers=[external_ip_list],
...     consumers=[internal_label],
...     ingress_services=[{'port': 22, 'proto': 'tcp'}],
...     name='DR-Block-SSH'
... )
>>> deny_rule = pce.deny_rules.create(deny_rule, parent=ruleset)

Rules¶

class illumio.rules.Rule[source]¶

Represents a security rule in the PCE.

Each security rule defines one or more services on which the defined consumers are allowed to reach the defined providers. In Illumio, providers provide a service (the destination) and consumers consume it (the source that initiates the connection).

Providers and consumers can be defined using static (workload HREF) or dynamic (label, IP list) references. By default, providers and consumers are resolved as workloads.

Rule represents an allow rule. Deny and override-deny rules are distinct rule types with their own nested endpoints; see DenyRule and OverrideDenyRule.

See https://docs.illumio.com/core/21.5/Content/Guides/security-policy/create-security-policy/rules.htm

Usage:

>>> import illumio
>>> pce = illumio.PolicyComputeEngine('pce.company.com', port=443, org_id=1)
>>> pce.set_credentials('api_key', 'api_secret')
>>> any_ip_list = pce.get_default_ip_list()
>>> role_label = pce.labels.create({'key': 'role', 'value': 'R-Web'})
>>> app_label = pce.labels.create({'key': 'app', 'value': 'A-App'})
>>> env_label = pce.labels.create({'key': 'env', 'value': 'E-Prod'})
>>> loc_label = pce.labels.create({'key': 'loc', 'value': 'L-AWS'})
>>> ruleset = illumio.RuleSet(
...     name='RS-LAB-ALLOWLIST',
...     scopes=[
...         illumio.LabelSet(
...             labels=[app_label, env_label, loc_label]
...         )
...     ]
... )
>>> ruleset = pce.rule_sets.create(ruleset)
>>> rule = illumio.Rule.build(
...     providers=[role_label],
...     consumers=[any_ip_list],
...     ingress_services=[
...         {'port': 80, 'proto': 'tcp'},
...         {'port': 443, 'proto': 'tcp'}
...     ],
...     unscoped_consumers=True,  # creates an extra-scope rule
... )
>>> rule = pce.rules.create(rule, parent=ruleset)
>>> rule
Rule(
    href='/orgs/1/sec_policy/rule_sets/19/rules/sec_rules/34',
    enabled=True,
    providers=[
        Actor(
            label=Reference(
                href='/orgs/1/labels/21'
            ),
            ...
        )
    ],
    consumers=[
        Actor(
            ip_list=Reference(
                href='/orgs/1/sec_policy/draft/ip_lists/1'
            ),
            ...
        )
    ],
    ingress_services=[
        ServicePort(port=80, proto=6, ...),
        ServicePort(port=443, proto=6, ...)
    ],
    resolve_labels_as=LabelResolutionBlock(
        providers=['workloads'],
        consumers=['workloads']
    ),
    unscoped_consumers=True,
    ...
)

Deny Rules¶

class illumio.rules.DenyRule[source]¶

Represents a deny rule in the PCE.

Deny rules explicitly block the defined consumers (sources) from reaching the defined providers (destinations) on the specified services. In the policy evaluation order (override-deny > allow > deny), an ordinary deny rule is applied last and can be overridden by an allow or override-deny rule. Set override=True (or use OverrideDenyRule) for an override-deny rule that takes precedence over allow rules.

Deny rules live nested under a ruleset and are created, fetched, updated, and deleted with the ruleset passed as parent.

Usage:

>>> import illumio
>>> pce = illumio.PolicyComputeEngine('pce.company.com', port=443, org_id=1)
>>> pce.set_credentials('api_key', 'api_secret')
>>> ruleset = pce.rule_sets.get_by_name('RS-APP')
>>> external_ip_list = pce.ip_lists.get(name='External-IPs')[0]
>>> internal_label = pce.labels.get(key='role', value='internal')[0]
>>> # block external sources from reaching internal workloads over SSH/RDP
>>> deny_rule = illumio.DenyRule.build(
...     providers=[internal_label],
...     consumers=[external_ip_list],
...     ingress_services=[
...         {'port': 22, 'proto': 'tcp'},
...         {'port': 3389, 'proto': 'tcp'}
...     ]
... )
>>> deny_rule = pce.deny_rules.create(deny_rule, parent=ruleset)

Override Deny Rules¶

class illumio.rules.OverrideDenyRule[source]¶

Convenience builder for an override-deny rule (a deny rule with override=True).

Override-deny rules block traffic and have the highest precedence in the policy evaluation order (override-deny > allow > deny): they cannot be overridden by allow rules. They are the same object as a DenyRule distinguished only by the override flag, and live at the same /deny_rules nested endpoint — so they are created, fetched, updated, and deleted through pce.deny_rules (there is no separate override_deny_rules collection). This class simply defaults override=True in build().

Usage:

>>> import illumio
>>> pce = illumio.PolicyComputeEngine('pce.company.com', port=443, org_id=1)
>>> pce.set_credentials('api_key', 'api_secret')
>>> ruleset = pce.rule_sets.get_by_name('RS-APP')
>>> contractor_label = pce.labels.get(key='role', value='contractor')[0]
>>> internal_label = pce.labels.get(key='role', value='internal')[0]
>>> # unconditionally block contractors from reaching internal workloads
>>> override_rule = illumio.OverrideDenyRule.build(
...     providers=[internal_label],
...     consumers=[contractor_label],
...     ingress_services=[
...         {'port': 22, 'proto': 'tcp'}
...     ]
... )
>>> override_rule = pce.deny_rules.create(override_rule, parent=ruleset)

Enforcement Boundaries¶

class illumio.rules.EnforcementBoundary[source]¶

Represents an enforcement boundary in the PCE.

Enforcement boundaries establish deny rules for workloads within their scope communicating on its defined services.

Workloads in selective enforcement mode that fall within an enforcement boundary will have policy rules apply to them as if they were in full enforcement.

Rules allowing traffic that would otherwise be denied by an enforcement boundary will override the boundary’s deny rule.

Note: For more granular deny rule control, consider using the dedicated DenyRule and OverrideDenyRule classes instead of enforcement boundaries.

See https://docs.illumio.com/core/21.5/Content/Guides/security-policy/policy-enforcement/enforcement-boundaries.htm

Usage:

>>> import illumio
>>> pce = illumio.PolicyComputeEngine('pce.company.com', port=443, org_id=1)
>>> pce.set_credentials('api_key', 'api_secret')
>>> any_ip_list = pce.get_default_ip_list()
>>> enforcement_boundary = illumio.EnforcementBoundary.build(
...     name='EB-BLOCK-RDP',
...     providers=[AMS],  # the special 'ams' literal denotes all workloads
...     consumers=[any_ip_list.href],
...     ingress_services=[
...         {'port': 3389, 'proto': 'tcp'},
...         {'port': 3389, 'proto': 'udp'},
...     ]
... )
>>> enforcement_boundary = pce.enforcement_boundaries.create(enforcement_boundary)
>>> enforcement_boundary
EnforcementBoundary(
    href='/orgs/1/sec_policy/draft/enforcement_boundary/8',
    name='EB-BLOCK-RDP',
    providers=[
        Actor(
            actors='ams',
            ...
        )
    ],
    consumers=[
        Actor(
            ip_list=Reference(
                href='/orgs/1/sec_policy/active/ip_lists/1'
            ),
            ...
        )
    ],
    ingress_services=[
        ServicePort(port=3389, proto=6),
        ServicePort(port=3389, proto=17)
    ],
    ...
)

Firewall Settings¶

class illumio.secpolicy.FirewallSetting[source]¶

Represents firewall settings in the PCE.

Firewall settings are singleton objects under security policy. They support GET and PUT only (no create/delete).

Policy Dependencies¶

class illumio.secpolicy.PolicyDependency[source]¶: Represents a dependency between security policy objects.

Policy Checks¶

class illumio.secpolicy.PolicyCheck[source]¶: Represents the result of a policy check.

Modified Objects¶

class illumio.secpolicy.ModifiedObject[source]¶: Represents a modified policy object pending provisioning.