External Application Load Balancer and Cloud Armor

The global external Application Load Balancer is the front door for most public web apps on Google Cloud. Cloud Armor plugs into it at Google’s edge to filter attacks before they reach your backends.

flowchart LR
  A["Attacker and users"] --> GFE["Google Front End<br/>anycast IP, TLS"]
  GFE --> CA["Cloud Armor policy shop-policy<br/>WAF, geo, rate limit"]
  CA -- "allowed" --> BS["Backend service web-backend"]
  CA -- "denied" --> D["HTTP 403 / 429"]
  BS --> APP["Regional MIG / Cloud Run"]
  %% step A: Requests from users and attackers arrive at the nearest Google Front End.
  %% step GFE: The load balancer terminates TLS with a Google-managed certificate; volumetric L3/L4 DDoS is absorbed here by default.
  %% step CA: The Cloud Armor policy on the backend service evaluates its rules from the lowest priority number.
  %% step D: Blocked requests get 403 or 429 at the edge and never reach your VMs.
  %% step BS: Allowed requests go to the backend service and on to healthy backends.

TLS certificates

• Google-managed certificates: Google issues and renews them once the domain’s DNS points to the LB IP.
• Certificate Manager: many certificates and wildcard certificates (DNS authorization), certificate maps.
• SSL policies set the minimum TLS version (for example TLS 1.2) and cipher profile.
• Add an HTTP-to-HTTPS redirect with a second forwarding rule on port 80 and a redirect URL map.

Cloud Armor security policies

A policy has ordered rules (priority 0 = first) plus a default rule at priority 2147483647 that allows or denies everything else.

Other features:

• Preview mode logs what a rule would do without enforcing it: start WAF rules in preview to find false positives.
• Adaptive Protection learns normal traffic and suggests rules against L7 DDoS.
• Edge security policies filter requests to Cloud CDN and backend buckets.
• Logs appear in Cloud Logging on the load balancer’s request logs.

gcloud compute security-policies create shop-policy --description="Shop WAF"
gcloud compute security-policies rules create 1000 --security-policy=shop-policy   --expression="evaluatePreconfiguredWaf('sqli-v33-stable')" --action=deny-403
gcloud compute backend-services update web-backend --global --security-policy=shop-policy

End-to-end design

DNS shop.example.com → static global IP → HTTPS proxy (managed cert, TLS 1.2+)
  → URL map → backend service (Cloud Armor, CDN) → regional MIG in 3 zones

Reserve the IP first (gcloud compute addresses create shop-ip --global) so it never changes when you rebuild the LB.

Traps: a managed certificate stays PROVISIONING until DNS points to the LB; Cloud Armor attaches to backend services, not to VMs; deny rules with too broad expressions can block health checks or your own monitoring.