Cloud Armor Security Policy Rule Hierarchy Admin Waf

What Google Cloud Armor Security Policies Are

Google Cloud Armor security policies are edge enforcement controls attached to backend services on external Application Load Balancers. They evaluate incoming HTTP(S) requests using priority-based rule evaluation where integer values range from 0 to 2147483646 (with the mandatory default rule fixed at 2147483647). Rules are evaluated in ascending numerical order (lowest priority number evaluated first). When a rule's match condition evaluates to true, Cloud Armor immediately executes the configured action (allow, deny, or throttle) and stops processing further rules.

How It Meets the Requirements

1. Corporate Admin Access (Priority 1000): Evaluated first. Traffic matching both the IP CIDR inIpRange(origin.ip, '198.51.100.0/24') and the L7 path expression request.path.matches('/admin/.*') is explicitly granted an allow action. Because rule evaluation terminates upon the first match, authorized administrative traffic bypasses downstream WAF evaluations.
2. Admin Restriction (Priority 2000): Evaluated second. Any non-corporate traffic matching request.path.matches('/admin/.*') is intercepted and denied (HTTP 403/404), ensuring unauthorized clients cannot access administrative endpoints.
3. OWASP Preconfigured WAF Protection (Priority 3000): Evaluated third. General traffic targeting standard customer endpoints is evaluated against preconfigured ModSecurity Core Rule Set expressions (evaluatePreconfiguredExpr('sqli-v33-stable') || evaluatePreconfiguredExpr('xss-v33-stable')). Malicious payloads are blocked.
4. Legitimate Traffic Fallthrough (Default Rule 2147483647): Requests that do not match the administrative path and pass WAF inspection reach the default rule set to allow.

Key Advantages

• Deterministic first-match enforcement: Guarantees privileged access for trusted corporate subnets before general path restrictions or WAF rules execute.
• Defense-in-depth: Combines Layer 3/4 network filtering (IP allowlists) with Layer 7 contextual filtering (URI paths and ModSecurity CRS rule sets).
• Granular rule precedence: Avoids false positives on administrative APIs while maintaining strict perimeter security for public-facing assets.