# Disconnecting a security profile from a resource

## Disconnecting from a virtual host {#virtual-host}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) containing the [security profile](../concepts/profiles.md).
  1. Navigate to **Smart Web Security**.
  1. In the left-hand panel, select ![shield-check](../../_assets/console-icons/shield-check.svg) **Security profiles**.
  1. Select the security profile to disconnect from the [virtual host](../../application-load-balancer/concepts/http-router.md#virtual-host) [Yandex Application Load Balancer](../../application-load-balancer/index.md).
  1. Navigate to the ![cubes-3-overlap](../../_assets/console-icons/cubes-3-overlap.svg) **Connected resources** tab.
  1. Next to the host in question, click ![options](../../_assets/console-icons/ellipsis.svg) and select ![disconnect](../../_assets/console-icons/arrow-shape-left-from-line.svg) **Disconnect from profile**.
  1. Confirm your action.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. To view a list of [HTTP routers](../../application-load-balancer/concepts/http-router.md) in the default folder, run this command:

     ```bash
     yc application-load-balancer http-router list
     ```

     Result:

     ```text
     +----------------------+-------------------+-------------+-------------+
     |          ID          |       NAME        | VHOST COUNT | ROUTE COUNT |
     +----------------------+-------------------+-------------+-------------+
     | ds7e9te73uak******** |  my-first-router  |           1 |           1 |
     +----------------------+-------------------+-------------+-------------+
     ```

  1. To view a list of [virtual hosts](../../application-load-balancer/concepts/http-router.md#virtual-host) for the selected HTTP router, run this command:

     ```bash
     yc application-load-balancer http-router get <HTTP_router_name_or_ID>
     ```

     Result:

     ```text
     id: ds7e9te73uak********
     name: my-first-router
     folder_id: b1gt6g8ht345********
     virtual_hosts:
       - name: test-virtual-host
         routes:
           - name: test-route
             http:
               match:
                 path:
                   prefix_match: /
               route:
                 backend_group_id: ds7e12p7l6j4********
                 timeout: 60s
                 auto_host_rewrite: false
         route_options:
           security_profile_id: fev3s055oq64********
     created_at: "2024-08-05T08:34:03.973000654Z"
     ```

     Names of virtual hosts are specified in the `virtual_hosts.name` parameter. The example above features only one virtual host: `test-virtual-host`.

  1. To disconnect a security profile from a virtual host, run this command:

     ```bash
     yc application-load-balancer virtual-host update <virtual_host_name> \
        --http-router-name <HTTP_router_name> \
        --security-profile-id ""
     ```

     Where:

     * `<virtual_host_name>`: Virtual host name from the previous step.
     * `--http-router-name`: [HTTP router](../../application-load-balancer/concepts/http-router.md) name. This is a required setting. Instead of the HTTP router name, you can provide its ID in the `http-router-id` parameter.
     * `--security-profile-id`: Security profile ID. This is a required setting.

     Result:

     ```text
     done (1s)
     name: test-virtual-host
     routes:
       - name: test-route
         http:
           match:
             path:
               prefix_match: /
           route:
             backend_group_id: ds7e12p7l6j4********
             timeout: 60s
             auto_host_rewrite: false
     route_options: {}
     ```

  For more information about the `yc application-load-balancer virtual-host update` command, see the [CLI reference](../../cli/cli-ref/application-load-balancer/cli-ref/virtual-host/update.md).

- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the relevant documentation on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  You can disconnect a Yandex Smart Web Security profile from a [Yandex Application Load Balancer](../../application-load-balancer/concepts/index.md) in the virtual host settings.

  1. In the Terraform configuration file, for the `yandex_alb_virtual_host` resource, delete `security_profile_id` under `route_options`.

      ```hcl
      resource "yandex_alb_virtual_host" "my-virtual-host" {
        name                    = "<virtual_host_name>"
        ...

        route_options {
          security_profile_id   = "<security_profile_ID>"
        }
      }
      ```

  1. Apply the changes:

       1. In the terminal, navigate to the configuration file directory.
       1. Make sure the configuration is correct using this command:
       
          ```bash
          terraform validate
          ```
       
          If the configuration is valid, you will get this message:
       
          ```bash
          Success! The configuration is valid.
          ```
       
       1. Run this command:
       
          ```bash
          terraform plan
          ```
       
          You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
       1. Apply the configuration changes:
       
          ```bash
          terraform apply
          ```
       
       1. Type `yes` and press **Enter** to confirm the changes.

  You can check the update using the [management console](https://console.yandex.cloud) or this [CLI](../../cli/index.md) command:

  ```bash
  yc alb http-router get <HTTP_router_ID>
  ```

- API {#api}

  Use the [update](../../application-load-balancer/api-ref/VirtualHost/update.md) REST API method for the [VirtualHost](../../application-load-balancer/api-ref/VirtualHost/index.md) resource or the [VirtualHostService/Update](../../application-load-balancer/api-ref/grpc/VirtualHost/update.md) gRPC API call in Application Load Balancer.

{% endlist %}

## Disconnecting from a domain {#domain}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) containing the security profile.
  1. Navigate to **Smart Web Security**.
  1. Select **Domain protection** → **Domains**.
  1. Select the domain.
  1. In the top-right corner, click ![image](../../_assets/console-icons/pencil.svg) **Edit**.
  1. Delete the connected security profile.
  1. Click **Save**.

{% endlist %}

## Disconnecting from an API gateway {#gateway}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) the API gateway is in.
  1. Navigate to **API Gateway**.
  1. Select the API gateway.
  1. In the top-right corner, click ![image](../../_assets/console-icons/pencil.svg) **Edit**.
  1. Delete the [x-yc-apigateway:smartWebSecurity](../../api-gateway/concepts/extensions/sws.md) extension from the API gateway specification.

{% endlist %}