Google Cloud Armor is a web application firewall (WAF) and distributed denial-of-service (DDoS) mitigation service that defends web applications and APIs from Layer 7 threats like SQL injection (SQLi), cross-site scripting (XSS), and remote file inclusion (RFI). Google Cloud Armor operates as part of Google Cloud's global load balancing infrastructure to inspect incoming client traffic at the network edge before requests ever hit backend infrastructure. The service uses preconfigured rule sets derived from the OWASP ModSecurity Core Rule Set (CRS), allowing administrators to apply built-in detection signatures against every incoming HTTP(S) request.
The request path follows a strict order across Google Cloud's network boundary:
Preconfigured WAF rules are added to security policies using Google Cloud Armor's custom rules language reference. These rules target common OWASP Top 10 vulnerabilities, including SQLi, XSS, and RFI. Each preconfigured rule set includes a rule ID and a sensitivity level that governs how aggressively the signatures match incoming traffic. For example, using the sqli-v33-stable rule set at sensitivity level 2 ensures protection against complex JSON-based SQL injection bypasses that might go undetected at lower sensitivity settings.
Administrators can inspect all preconfigured expressions by executing the gcloud compute security-policies list-preconfigured-expression-sets command in the Google Cloud CLI. The output lists available expression sets, such as sqli-canary and xss-canary, along with the specific rule IDs and sensitivity levels included in each set. For example, the sqli-canary set includes signatures like owasp-crs-v030001-id942110-sqli at sensitivity 2, whereas xss-canary contains owasp-crs-v030001-id941110-xss at sensitivity 1.
Preconfigured WAF rules operate with specific technical boundaries and evaluation constraints:
StudyCerts
StudyCertsContent-Type header.allow, as matched exclusion patterns are automatically allowed past that specific rule.Web Application and API Protection (WAAP) unites Google Cloud Armor, reCAPTCHA Enterprise, and Apigee into a layered defense architecture for web and mobile APIs. In a WAAP deployment, incoming HTTP(S) traffic first hits Google Cloud Armor for DDoS protection and OWASP Core Rule Set inspection. Once cleared by Google Cloud Armor, requests pass to reCAPTCHA to assess risk scores and differentiate between legitimate human users and automated bots. Finally, validated API traffic routes through Apigee to verify API keys and access tokens before reaching backend microservices.
Common Expression Language (CEL) is the evaluation language used in Google Cloud Armor to build custom security rules based on Layer 7 HTTP(S) attributes. CEL rules allow administrators to inspect origin IP addresses, HTTP request headers, cookies, query parameters, and URI paths at the edge of the Google network. By applying CEL expressions, Google Cloud Armor can enforce specific actionsâsuch as allow, deny, rate-limit, or redirectâbefore malicious traffic reaches backend workloads.
CEL expressions evaluate boolean logic against Layer 7 traffic fields to decide whether an assigned security action triggers. Operators and standard functions check conditions such as IP subnets using inIpRange(origin.ip, '192.0.2.1/24') or confirm header presence with has(request.headers['header-name']). Expressions also perform substring and pattern matching, such as checking if a header contains a specific MIME type using request.headers['content-type'].contains('multipart/form-data'). When a CEL expression evaluates to true, Google Cloud Armor executes the configured rule action on that request.
Administrators can link custom request attributes with preconfigured WAF rules in a single CEL expression using logical operators like && and ||. Functions such as evaluatePreconfiguredWaf('xss-stable') or evaluatePreconfiguredExpr('sqli-stable') invoke OWASP CRS signatures across headers, URLs, and request bodies. Combining specific URI path filters or header checks with preconfigured rules limits deep packet inspection only to vulnerable endpoints, reducing operational overhead and preventing false alarms on non-vulnerable paths. Furthermore, specific signature IDs can be selectively activated within an expression using the opt_in_rule_ids parameter.
Preconfigured WAF expressions inside CEL support sensitivity levels from 1 to 4, which correspond to OWASP CRS paranoia levels. Lower sensitivity levels evaluate high-confidence detection signatures to prevent false positives, while higher sensitivity levels inspect complex attack obfuscation techniques at a higher risk of catching legitimate traffic. Sensitivity values are passed directly inside the CEL function call, such as evaluatePreconfiguredWaf('nodejs-v33-stable', {'sensitivity': 1}). If no sensitivity level is explicitly provided in the expression, Google Cloud Armor evaluates all signatures within the specified rule set by default.
Google Cloud Armor security policies attach directly to backend services managed by a global external Application Load Balancer or a classic Application Load Balancer. Backend services can route validated requests to internal Google Cloud workloads or external servers via an internet network endpoint group (internet NEG). When client traffic arrives, Google Cloud Armor evaluates security policy rules in priority order, executing actions on matching criteria and dropping denied traffic at the edge. Telemetry, inspection logs, and security alerts generated during evaluation export directly to Cloud Logging, Cloud Monitoring, and Security Command Center.
Tuning WAF signatures in Google Cloud Armor is the operational process of modifying preconfigured rules to block real web attacks while permitting valid application traffic. To prevent false positives in production environments, administrators adjust rule set sensitivity, implement granular field exclusions, and evaluate rule behavior in preview mode before active enforcement.
Google Cloud Armor preconfigured WAF rules are organized into rule sets by attack category (such as SQLi or XSS), with each signature mapped to a sensitivity level. The sensitivity setting controls matching aggressiveness, where lower sensitivity levels apply only high-confidence signatures to reduce false alarms. Administrators tune rule sets (such as sqli-v33-stable) globally across a policy; for example, lowering a rule set's sensitivity from level 2 to level 1 decreases detection strictness. Sensitivity adjustments apply across the entire rule set rather than individual signatures, and updates propagate across Google's edge infrastructure within several minutes.
Signature exclusions allow administrators to bypass WAF inspection for specific, safe portions of an HTTP request that would otherwise trigger a false positive. Exclusions target specific request components, including request headers, cookies, query parameters, or URIs. For instance, if an administrative tool submits legitimate database queries through a query parameter like ?query=SELECT, an exclusion can skip SQLi evaluation for that specific parameter. Exclusions attach directly to a preconfigured WAF rule within a security policy, and rules with exclusions cannot use the allow action because excluded matching fields are automatically permitted through that rule.
Before enforcing rules in a live production environment, administrators can run Google Cloud Armor rules in preview mode to verify behavior using Cloud Logging. In preview mode, Google Cloud Armor evaluates incoming traffic and logs matching requests without executing the blocking or redirecting action. Engineers analyze these preview logs to verify whether legitimate traffic would be blocked, making necessary sensitivity or exclusion adjustments. Once validated, administrators transition the rule from preview mode to enforced, guaranteeing threat protection without interrupting legitimate users.
allow because matching exceptions are automatically permitted.deny or redirect, allowing administrators to tune rules before activation.Google Cloud Armor processes only the first 8 KB of the request body when evaluating preconfigured WAF rules. Any content located beyond the 8 KB boundary is not inspected by the preconfigured rule engine.
Preview mode allows Google Cloud Armor to evaluate incoming traffic against security rules and log the match results in Cloud Logging without actually blocking or redirecting requests. This enables engineers to identify false positives on legitimate user traffic and adjust sensitivity or add exclusions before turning on active enforcement.
A preconfigured WAF rule with an exclusion cannot be set to an allow action because the exclusion itself automatically allows the specified request elements to bypass inspection. Applying an allow action to the rule would create conflicting logic regarding how non-excluded matching elements are handled.
Professional Cloud Network Engineer
Prepare and test your skills
Prepare and test your skills