External user or bot
Cloud / Knowledge library
Google Cloud Armor
Provides DDoS defense and web application filtering at Google's edge
Why learn Google Cloud Armor?
Teams use Google Cloud Armor to adopt web application firewall without building the complete underlying platform themselves.
The problem it solves
Filters malicious HTTP traffic using managed and custom security rules
Where it came from
Google Cloud Armor is Google Cloud's offering for web application firewall. Its closest catalog counterparts are Azure Web Application Firewall and AWS WAF; they address the same broad need but are not feature-for-feature identical.
Build your understanding
Work through these exercises in order. Try the task before opening a reference.
- Explain the main responsibility of Google Cloud Armor.
- Choose a workload that fits Google Cloud Armor.
- Identify one operational tradeoff of Google Cloud Armor.
- Compare Google Cloud Armor with Azure Web Application Firewall.
- Compare Google Cloud Armor with AWS WAF.
Documentation and sources
- Google Cloud products at a glance (docs.cloud.google.com)
Connect the ideas
Alternatives
Real World Example
Securing Global Retail API Endpoints
E-commerce retailers managing global API traffic for mobile and web storefronts.
The business problem
Unpredictable traffic spikes from malicious botnets and volumetric DDoS attacks threaten to overwhelm origin servers, causing service outages and latency for legitimate customers.
How this topic solves it
Google Cloud Armor provides DDoS defense and web application filtering at Google's edge, allowing the retailer to inspect incoming requests before they reach the application backend.
- Provision a global external HTTP(S) load balancer to serve as the entry point for application traffic.
- Create a security policy within Google Cloud Armor containing specific rules for traffic filtering.
- Configure custom rules to block known malicious IP ranges or rate-limit suspicious request patterns.
- Attach the security policy to the backend service of the load balancer to enforce filtering at the edge.
Explains how traffic flows from the internet through the edge security layer to the backend.
Cloud Armor Security Policy
Global HTTP(S) entry point
Application origin
- Client → Request → Google Edge
- Google Edge → Filtered Traffic → Load Balancer
- Load Balancer → Forwarded Request → Backend Service
Expected business outcome
Improved application availability and reduced infrastructure strain by filtering malicious traffic at the network edge before it reaches the origin.
Limitations and checks
Security policies are applied at the edge, meaning they cannot inspect encrypted payloads without proper TLS termination at the load balancer; verify effectiveness by checking the security logs for blocked request counts.