203101 - Failed to Update Cloud Armor Security Policy Rule

Agent error code #203101 indicates that the agent could not update (patch) the Cloud Armor security policy rule in GCP. The error message includes additional detail about the underlying cause (e.g., authentication, authorization, or timeout).

This error occurs during the PATCH phase of a grant or revocation operation, after the rule was successfully retrieved.

Common causes include:

• The service account lacks compute.securityPolicies.update permission (see also #203002)
• The security policy or rule was deleted between the GET and PATCH operations
• A GCP organization policy is preventing modifications to security policies
• The GCP API returned an error during the update

Steps to Resolve

Check IAM Permissions

1. Ensure the service account has the compute.securityPolicies.update permission
2. The compute.securityPolicies.get permission alone is not sufficient — update permission is also required
3. See error #203002 for detailed IAM troubleshooting steps

Verify the Security Policy and Rule Still Exist

1. In the GCP Console, navigate to Network Security > Cloud Armor
2. Confirm the security policy and its rule at the configured priority have not been deleted

Check Organization Policies

1. Some GCP organizations enforce policies that restrict modifications to security policies
2. Contact your GCP organization administrator if restrictions are in place