The same status, diff, and sync workflow, pointed at a real Cloud Armor security policy.
npm install -g @gfargo/doorman
Pass --provider gcp, or set "provider": "gcp" in your config.
path becomes request.path, user_agent becomes a guarded header check. Every field maps to a documented Cloud Armor CEL expression — nothing silently dropped.
Cloud Armor has no separate rule id — a rule's required priority is simultaneously its evaluation order and its addressing key. Doorman assigns and relocates them automatically.
The full sync, diff, status, and download cycle — plus priority relocation and rule deletion — has been run against a real, disposable Cloud Armor policy, not just unit tests.
export GOOGLE_APPLICATION_CREDENTIALS="..." # optional, uses Application Default Credentials if unset export GOOGLE_CLOUD_PROJECT="..." export GCP_POLICY_NAME="..."
Nothing set yet? Doorman prompts you for credentials the first time it needs them.
doorman sync --provider gcp