Google Cloud Armor helps protect your Google Cloud deployments from threats such as distributed denial-of-service (DDoS) attacks and application attacks like cross-site scripting (XSS) and SQL injection (SQLi). This document provides a high-level overview of the protections built in to Cloud Armor, as well as the options you can manually configure to help provide protection to your services.
Security policies
Cloud Armor security policies are collections of Cloud Armor rules that are applied to requests destined for a protected resource in the order configured by the policy.
Use Cloud Armor security policies to help protect your applications and services from DDoS and other web-based attacks. While security policies are frequently used to protect applications running behind a load balancer, they also protect other resources not running behind a load balancer, such as VM instances with external IP addresses. You must manually configure security policies by using match conditions and actions. Cloud Armor also provides preconfigured security policies for a variety of use cases. For more information, see Cloud Armor security policy overview.Rules language
Use Cloud Armor to create rules using the custom rules language to craft complex conditions and define the action to take against matching requests. A rule takes effect when it is the highest priority rule that matches the attributes of an incoming request. For more information, see Cloud Armor custom rules language reference.
Preconfigured WAF rules
Cloud Armor preconfigured WAF rules are complex web application firewall (WAF) rules that include dozens of signatures compiled from open source industry standards. Each signature identifies a specific attack pattern within the rule set.
Cloud Armor provides these rules as-is, so you can evaluate many distinct traffic signatures by referring to named rules. This approach eliminates the need to manually define each signature.
Cloud Armor preconfigured rules add a layer of protection to your web applications and services from common internet attacks and help mitigate the OWASP Top 10 risks. The preconfigured rules are based on the OWASP ModSecurity Core Rule Set (CRS), and Cloud Armor supports CRS 4.22, 3.3, and 3.0. We recommend that you don't use a lower version than 4.22
You can tune these preconfigured rules to disable noisy or unnecessary signatures. For more information, see Tuning Cloud Armor WAF rules.
How Cloud Armor works
Cloud Armor provides always-on protection from L3 and L4 volumetric and network protocol-based DDoS attacks, with automated inline mitigations in real time and with no latency impact. This protection is for applications or services behind load balancers. Cloud Armor is able to detect and mitigate network attacks in order to allow only well-formed requests through the load balancing proxies.
Cloud Armor can help protect from L7 (Application layer) threats including L7 DDoS like HTTP floods, but this protection requires a user-configured security policy with proactive rules in place. The security policies enforce custom L7 filtering policies, including preconfigured WAF rules that mitigate OWASP top 10 web application vulnerability risks. You can attach security policies to the backend services of Cloud Armor provides always-on protection from Layer 3 and Layer 4 (L3 and L4) volumetric and network protocol-based DDoS attacks, with automated inline mitigations in real time and with no latency impact. This protection is for applications or services behind load balancers. Cloud Armor is able to detect and mitigate network attacks in order to allow only well-formed requests through the load balancing proxies.
Cloud Armor can help to protect your system from L7 (Application layer) threats including L7 DDoS attacks like HTTP floods, but this protection requires a user-configured security policy with proactive rules in place. When these rules are in place, these security policies enforce custom L7 filtering policies, including preconfigured WAF rules that mitigate OWASP top 10 web application vulnerability risks. You can attach security policies to the backend services of regional external Application Load Balancers.
Cloud Armor security policies allow you to permit or deny access to your deployment at the Google Cloud edge, close to the traffic source. This prevents unwanted traffic from consuming resources or entering your Virtual Private Cloud (VPC) networks.
You can use some or all of these features to protect your application. Use security policies to match against known conditions, and create WAF rules to protect against common attacks like those in the ModSecurity Core Rule Set 4.22.