Google Cloud Armor: Cannot get the match expression to work for "in" operator and list ".exists"

Question

'in' operation

I have a list of origin asns that I would like to block access using CloudArmor. I am using the match expression and trying something very simple like this:

origin.asn in [12, 13]

I just cannot understand what the syntax is for in. I have reread this cel-spec language definition countless times and I can't figure out. https://github.com/google/cel-spec/blob/master/doc/langdef.md#list-of-standard-definitions

The doc claims:

Set membership test of a json number in a list of integers:

json.number in [1, 2, 3]

int(json.number) in [1, 2, 3]

So I wrote the following and it still gives me the syntax error. See screenshot:

I have pretty much gone through all the examples from google docs too, and they are very basic for me, and do not help. https://cloud.google.com/armor/docs/rules-language-reference#expression-examples

list ".exists" macro

The lang spec claims:

e.all(x, p): tests whether a predicate holds for all elements of a list e or keys of a map e. Here x is a simple identifier to be used in p which binds to the element or key. The all() macro combines per-element predicate results with the "and" (&&) operator, so if any predicate evaluates to false, the macro evaluates to false, ignoring any errors from other predicates.

e.exists(x, p): like the all() macro, but combines the predicate results with the "or" (||) operator.

Again, just doing a simple test with the .exists macro, I get the error. See screenshot:

I can only assume that I am missing something really basic or the lang spec isn't really supported at this current time by CA. I would be grateful if someone can point me in the right direction.

Answer 1

I believe this paragraph might mislead the readers. Docs.

The custom rules language is used to write the expressions in advanced match conditions for security policy rules. The Google Cloud Armor custom rules language is an extension of the Common Expression Language (CEL).

Cloud Armor match expression probably does not implement all the lang definitions from the CEL-spec, hence the error. Best to rewrite these expression in to smaller and multiple rules.