[Yandex Cloud documentation](../../index.md) > [Yandex Smart Web Security](../index.md) > [Step-by-step guides](index.md) > Security profiles > Connecting a profile to a resource

# Connecting a security profile to a resource

To protect your resource using Smart Web Security, connect a Yandex Smart Web Security profile to a virtual host, domain, or API gateway.

## Connecting to a virtual host {#host}

The connection method depends on the [Yandex Application Load Balancer management method](../../application-load-balancer/concepts/index.md).

* If the load balancer is managed by you, use the Yandex Cloud interfaces.
* If the load balancer is managed by a [controller](../../application-load-balancer/tools/index.md), use an annotation.

    {% note warning %}

    For an ingress controller, connect the security profile only via an annotation.

    If you connect the profile via the Yandex Cloud interfaces and then update the Ingress resource, the security profile will be disabled due to the lack of annotation.

    {% endnote %}

To work with a security profile that connects to a load balancer, you will need a service account with the `monitoring.editor`, `smart-web-security.admin`, `certificate-manager.admin`, and `logging.writer` roles. Learn more in [Assigning roles to a service account](../../iam/operations/sa/assign-role-for-sa.md).

To connect a security profile to a virtual host:

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) containing the [security profile](../concepts/profiles.md).
    1. Navigate to **Smart Web Security**.
    1. In the left-hand panel, select ![shield-check](../../_assets/console-icons/shield-check.svg) **Security profiles**.
    1. Select the security profile you want to connect to the [virtual host](../../application-load-balancer/concepts/http-router.md#virtual-host) [Yandex Application Load Balancer](../../application-load-balancer/index.md).
    1. Click ![plug](../../_assets/console-icons/plug-connection.svg) **Connect to host**.
    1. In the window that opens, click **Add resource** and select **Virtual host**.
    1. Set the [**Load balancer**](../../application-load-balancer/concepts/application-load-balancer.md), [**HTTP router**](../../application-load-balancer/concepts/http-router.md), and [**Virtual host**](../../application-load-balancer/concepts/http-router.md#virtual-host) values one by one. You can associate the security profile with multiple virtual hosts at once.
  
        To associate the profile with another L7 load balancer, click **Add resource** and select **Virtual host**.
      
    1. Click **Connect**. If the selected hosts are already connected to another security profile, confirm the connection.
  
        You will see the connected virtual hosts under ![cubes-3-overlap](../../_assets/console-icons/cubes-3-overlap.svg) **Connected resources**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. To view a list of current security profiles in the default folder, run this command:

     ```bash
     yc smartwebsecurity security-profile list
     ```
     
     Result:
     
     ```text
     +----------------------+-------------------+---------------------+----------------+------------+-------------+
     |          ID          |       NAME        |       CREATED       | DEFAULT ACTION | CAPTCHA ID | RULES COUNT |
     +----------------------+-------------------+---------------------+----------------+------------+-------------+
     | fev3s055oq64******** | my-new-profile    | 2024-08-05 06:57:18 | DENY           |            |           1 |
     | fevlqk8vei9p******** | my-sample-profile | 2024-08-05 06:57:28 | DENY           |            |           2 |
     +----------------------+-------------------+---------------------+----------------+------------+-------------+
     ```

  1. To view a list of [HTTP routers](../../application-load-balancer/concepts/http-router.md) in the default folder, run this command:

     ```bash
     yc application-load-balancer http-router list
     ```

     Result:

     ```text
     +----------------------+-------------------+-------------+-------------+
     |          ID          |       NAME        | VHOST COUNT | ROUTE COUNT |
     +----------------------+-------------------+-------------+-------------+
     | ds7e9te73uak******** |  my-first-router  |           1 |           1 |
     +----------------------+-------------------+-------------+-------------+
     ```

  1. To view a list of [virtual hosts](../../application-load-balancer/concepts/http-router.md#virtual-host) for the selected HTTP router, run this command:

     ```bash
     yc application-load-balancer http-router get <HTTP_router_name_or_ID>
     ```

     Result:

     ```text
     id: ds7e9te73uak********
     name: my-first-router
     folder_id: b1gt6g8ht345********
     virtual_hosts:
       - name: test-virtual-host
         routes:
           - name: test-route
             http:
               match:
                 path:
                   prefix_match: /
               route:
                 backend_group_id: ds7a4niks9qv********
                 timeout: 60s
                 auto_host_rewrite: false
         route_options: {}
     created_at: "2024-08-05T08:34:03.973000654Z"
     ```

     Names of virtual hosts are specified in the `virtual_hosts.name` parameter. The example above features only one virtual host: `test-virtual-host`.

  1. To connect a [security profile](../concepts/profiles.md) to a virtual host, run this command:

     ```bash
     yc application-load-balancer virtual-host update <virtual_host_name> \
        --http-router-name <HTTP_router_name> \
        --security-profile-id <security_profile_ID>
     ```

     Where:

     * `<virtual_host_name>`: Virtual host name from the previous step.
     * `--http-router-name`: HTTP router name. This is a required setting. Instead of the HTTP router name, you can provide its ID in the `--http-router-id` parameter.
     * `--security-profile-id`: Security profile ID. This is a required setting.

     Result:

     ```text
     done (1s)
     name: test-virtual-host
     routes:
       - name: test-route
         http:
           match:
             path:
               prefix_match: /
           route:
             backend_group_id: ds7a4niks9qv********
             timeout: 60s
             auto_host_rewrite: false
     route_options:
       security_profile_id: fev3s055oq64********
      ```

  For more information about the `yc application-load-balancer virtual-host update` command, see the [CLI reference](../../cli/cli-ref/application-load-balancer/cli-ref/virtual-host/update.md).


- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  You can connect a Yandex Smart Web Security profile to a [Yandex Application Load Balancer](../../application-load-balancer/concepts/index.md) in the virtual host settings.

  1. In the Terraform configuration file, for the `yandex_alb_virtual_host` resource, specify `security_profile_id` under `route_options`.

      ```hcl
      resource "yandex_alb_virtual_host" "my-virtual-host" {
        name                    = "<virtual_host_name>"
        ...

        route_options {
          security_profile_id   = "<security_profile_ID>"
        }
      }
      ```

  1. Apply the changes:

       1. In the terminal, navigate to the configuration file directory.
       1. Make sure the configuration is correct using this command:
       
          ```bash
          terraform validate
          ```
       
          If the configuration is valid, you will get this message:
       
          ```bash
          Success! The configuration is valid.
          ```
       
       1. Run this command:
       
          ```bash
          terraform plan
          ```
       
          You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
       1. Apply the configuration changes:
       
          ```bash
          terraform apply
          ```
       
       1. Type `yes` and press **Enter** to confirm the changes.

  You can check the update using the [management console](https://console.yandex.cloud) or this [CLI](../../cli/index.md) command:

  ```bash
  yc alb http-router get <HTTP_router_ID>
  ```

- API {#api}

  Use the [update](../../application-load-balancer/api-ref/VirtualHost/update.md) REST API method for the [VirtualHost](../../application-load-balancer/api-ref/VirtualHost/index.md) resource or the [VirtualHostService/Update](../../application-load-balancer/api-ref/grpc/VirtualHost/update.md) gRPC API call in Application Load Balancer.

- Annotation {#annotation}

  {% note tip %}
  
  We recommend using the new [Yandex Cloud Gwin](../../application-load-balancer/tools/gwin/index.md) controller instead of an ALB Ingress controller and Gateway API.
  
  {% endnote %}

  Use the following annotations:

  * For a [Gwin controller](../../application-load-balancer/tools/gwin/index.md): [HTTPRoute](../../application-load-balancer/gwin-ref/httproute.md#security-configuration) or [RoutePolicy](../../application-load-balancer/gwin-ref/routepolicy.md#cheatsheet).
  * For an [Ingress controller](../../application-load-balancer/tools/k8s-ingress-controller/index.md): [Ingress resource annotation](../../application-load-balancer/k8s-ref/ingress.md#annot-security-profile-id).

      {% note info %}
      
      To connect your security profile to an Application Load Balancer virtual host, the service account used by the Ingress controller must have the [smart-web-security.editor](../security/index.md#smart-web-security-editor) role for the folder hosting Application Load Balancer and Smart Web Security resources. For more information, see [Assigning a role to a service account](../../iam/operations/sa/assign-role-for-sa.md).
      
      {% endnote %}

{% endlist %}

{% note tip %}

To ensure availability of your service at high load, set up [autoscaling](../../application-load-balancer/concepts/application-load-balancer.md#lcu-scaling) for your L7 load balancer.

{% endnote %}

The security profile is assigned to a particular virtual host of the L7 load balancer, with all incoming host traffic analyzed. If analysis of traffic to certain host routes is not required, disable the security profile for those routes. You can do this by using the `--disable-security-profile` (`disableSecurityProfile`) parameter when [adding](../../application-load-balancer/operations/http-router-update.md#add-virtual-host) or [updating](../../application-load-balancer/operations/manage-routes.md) a route via the CLI, API, or Terraform.

When adding routes, consider their order: a request will follow the first route with a matching predicate, so place the most specific routes first. Otherwise, the shared route may intercept requests, and the specific rules will not apply.

## Connecting to a domain {#domain}

{% list tabs group=instructions %}

- Management console {#console}

   1. In the [management console](https://console.yandex.cloud), select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) containing the [security profile](../concepts/profiles.md).
     1. In the left-hand panel, select ![shield-check](../../_assets/console-icons/shield-check.svg) **Security profiles**.
     1. Select the security profile you want to connect to a domain.
     1. Click ![plug](../../_assets/console-icons/plug-connection.svg) **Connect to host**.
     1. In the window that opens, click **Add resource** and select **Domain**.
     1. Set the **Proxy server** and **Domain** values one by one. You can connect the security profile to multiple domains at once.
     1. Click **Connect**.
   
         You will see the connected domains under ![cubes-3-overlap](../../_assets/console-icons/cubes-3-overlap.svg) **Connected resources**.

{% endlist %}

## Connecting to an API gateway {#gateway}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) containing the [security profile](../concepts/profiles.md).
    1. In the left-hand panel, select ![shield-check](../../_assets/console-icons/shield-check.svg) **Security profiles**.
    1. Select the security profile you want to connect to the API gateway.
    1. Click ![plug](../../_assets/console-icons/plug-connection.svg) **Connect to host**.
    1. In the window that opens, click **Add resource** and select **API gateway**.
    1. Set a value in the **API gateway** field.
    1. Click **Connect**.
  
        You will see the connected API gateways under ![cubes-3-overlap](../../_assets/console-icons/cubes-3-overlap.svg) **Connected resources**.

{% endlist %}

## Useful links {#see-also}

* [Disconnecting a security profile from a resource](host-delete.md)