advancedGCP

Your application is experiencing DDoS attacks and bot traffic targeting your GCP-hosted APIs. How do you configure Cloud Armor WAF policies with rate limiting, bot management, and adaptive protection? Walk through a production-grade setup.

⚡

Quick Answer

Configure Cloud Armor security policies with preconfigured WAF rules (OWASP Top 10), rate-based throttling per IP, bot management with reCAPTCHA Enterprise integration, and enable Adaptive Protection for ML-based anomaly detection. Attach policies to backend services behind the Global HTTP(S) Load Balancer.

Detailed Answer

Cloud Armor Architecture

Cloud Armor operates at the edge of Google's global network, inspecting traffic before it reaches your backend services. It integrates with the Global External HTTP(S) Load Balancer (both Classic and Advanced) and can protect GKE Services, Cloud Run, Cloud Functions, and external backends via Internet NEGs. Cloud Armor policies consist of ordered rules evaluated from highest to lowest priority, with a default rule at priority 2147483647.

WAF Rules and OWASP Protection

Cloud Armor provides preconfigured WAF rule sets based on the OWASP ModSecurity Core Rule Set. These cover SQL injection (sqli-v33-stable), cross-site scripting (xss-v33-stable), local/remote file inclusion (lfi-v33-stable, rfi-v33-stable), and remote code execution (rce-v33-stable). In production, enable these in detection-only mode first, analyze logs for false positives, then switch to blocking. Custom rules using Cloud Armor's expression language can match on headers, paths, query parameters, and geographic origin.

Rate Limiting Strategy

Cloud Armor supports rate-based banning: when a client exceeds a threshold (e.g., 100 requests per 60 seconds), subsequent requests are blocked for a configurable ban duration. Rate limiting can be scoped per IP, per IP+path, or per HTTP header value (useful for API key-based limiting). For API endpoints, implement tiered rate limits: aggressive limits on authentication endpoints (10 req/min), moderate limits on API calls (100 req/min), and lenient limits on static content.

Bot Management and Adaptive Protection

reCAPTCHA Enterprise integration enables invisible bot detection without user friction. Cloud Armor can evaluate reCAPTCHA tokens and block requests with low scores. Adaptive Protection uses ML models trained on your traffic patterns to detect and alert on volumetric attacks, providing auto-generated rules that you can approve for deployment. This catches attacks that static rules miss, such as slow-rate application-layer DDoS.

Monitoring and Incident Response

Cloud Armor logs to Cloud Logging with detailed match information including which rule triggered, the request details, and the action taken. Create dashboards showing blocked request rates, top attacking IPs, and geographic distribution. Set up alerts for sudden spikes in blocked requests or Adaptive Protection alerts. During an active attack, use Cloud Armor's emergency IP denylist to rapidly block attacking ranges.

# Create Cloud Armor security policy gcloud compute security-policies create api-protection \ --type=CLOUD_ARMOR \ --description="Production API protection policy" # Rule 1: Block known bad IPs and Tor exit nodes (priority 100) gcloud compute security-policies rules create 100 \ --security-policy=api-protection \ --expression="origin.region_code == 'KP' || evaluateThreatIntelligence('iplist-tor-exit-nodes')" \ --action=deny-403 \ --description="Block sanctioned countries and Tor" # Rule 2: Rate limit authentication endpoints (priority 200) gcloud compute security-policies rules create 200 \ --security-policy=api-protection \ --expression="request.path.matches('/api/v[0-9]+/auth/.*')" \ --action=throttle \ --rate-limit-threshold-count=10 \ --rate-limit-threshold-interval-sec=60 \ --conform-action=allow \ --exceed-action=deny-429 \ --enforce-on-key=IP \ --ban-threshold-count=50 \ --ban-threshold-interval-sec=120 \ --ban-duration-sec=600 \ --description="Rate limit auth endpoints, ban repeat offenders" # Rule 3: OWASP SQL injection protection (priority 300) gcloud compute security-policies rules create 300 \ --security-policy=api-protection \ --expression="evaluatePreconfiguredWaf('sqli-v33-stable', {'sensitivity': 1})" \ --action=deny-403 \ --description="Block SQL injection attempts" # Rule 4: OWASP XSS protection (priority 310) gcloud compute security-policies rules create 310 \ --security-policy=api-protection \ --expression="evaluatePreconfiguredWaf('xss-v33-stable', {'sensitivity': 1})" \ --action=deny-403 \ --description="Block XSS attempts" # Rule 5: General API rate limiting (priority 500) gcloud compute security-policies rules create 500 \ --security-policy=api-protection \ --expression="request.path.matches('/api/.*')" \ --action=throttle \ --rate-limit-threshold-count=200 \ --rate-limit-threshold-interval-sec=60 \ --conform-action=allow \ --exceed-action=deny-429 \ --enforce-on-key=IP \ --description="General API rate limiting" # Rule 6: reCAPTCHA bot detection for sensitive endpoints (priority 400) gcloud compute security-policies rules create 400 \ --security-policy=api-protection \ --expression="request.path.matches('/checkout/.*') && token.recaptcha_action.score < 0.3" \ --action=deny-403 \ --description="Block bots on checkout flow" # Enable Adaptive Protection gcloud compute security-policies update api-protection \ --enable-layer7-ddos-defense \ --layer7-ddos-defense-rule-visibility=STANDARD # Attach policy to backend service gcloud compute backend-services update api-backend \ --security-policy=api-protection --global # Monitor blocked requests gcloud logging read ' resource.type="http_load_balancer" jsonPayload.enforcedSecurityPolicy.outcome="DENY" ' --limit=20 --format=json --freshness=1h

Your application is experiencing DDoS attacks and bot traffic targeting your GCP-hosted APIs. How do you configure Cloud Armor WAF policies with rate limiting, bot management, and adaptive protection? Walk through a production-grade setup.

More GCP questions