An enterprise hosts an e-commerce platform behind an external Application Load Balancer with an attached Google Cloud Armor security policy. The security engineering team has the following access and threat protection requirements for a backend service: Allow corporate administrators connecting from the CIDR range 198.51.100.0/24 to access administrative endpoints matching request.path.matches('/admin/.*') without being blocked by general WAF inspection. Block all other external clients attempting to access any endpoints under /admin/.*. Inspect all non-admin public traffic against preconfigured WAF rules for SQL injection (sqli-v33-stable) and Cross-Site Scripting (xss-v33-stable), denying matched exploits. Allow all remaining legitimate customer traffic. How should the Cloud Armor security policy rules and priorities be configured to enforce these requirements correctly?

Priority 1000: Allow corporate admin CIDR and `/admin/.*` path. Priority 2000: Deny all other requests matching `/admin/.*`. Priority 3000: Deny requests matching preconfigured SQLi and XSS WAF expressions. Default Rule (2147483647): Allow all traffic.: What Google Cloud Armor Security Policies Are Google Cloud Armor security policies are edge enforcement controls attached to backend services on external Application Load Balancers. They evaluate incoming HTTP(S) requests using priority-based rule evaluation where integer values range from 0 to 2147483646 (with the mandatory default rule fixed at 2147483647). Rules are evaluated in ascending numerical order (lowest priority number evaluated first). When a rule's match condition evaluates to true, Cloud Armor immediately executes the configured action (allow, deny, or throttle) and stops processing further rules. How It Meets the Requirements Corporate Admin Access (Priority 1000): Evaluated first. Traffic matching both the IP CIDR inIpRange(origin.ip, '198.51.100.0/24') and the L7 path expression request.path.matches('/admin/.*') is explicitly granted an allow action. Because rule evaluation terminates upon the first match, authorized administrative traffic bypasses downstream WAF evaluations. Admin Restriction (Priority 2000): Evaluated second. Any non-corporate traffic matching request.path.matches('/admin/.*') is intercepted and denied (HTTP 403/404), ensuring unauthorized clients cannot access administrative endpoints. OWASP Preconfigured WAF Protection (Priority 3000): Evaluated third. General traffic targeting standard customer endpoints is evaluated against preconfigured ModSecurity Core Rule Set expressions (evaluatePreconfiguredExpr('sqli-v33-stable') || evaluatePreconfiguredExpr('xss-v33-stable')). Malicious payloads are blocked. Legitimate Traffic Fallthrough (Default Rule 2147483647): Requests that do not match the administrative path and pass WAF inspection reach the default rule set to allow. Key Advantages Deterministic first-match enforcement: Guarantees privileged access for trusted corporate subnets before general path restrictions or WAF rules execute. Defense-in-depth: Combines Layer 3/4 network filtering (IP allowlists) with Layer 7 contextual filtering (URI paths and ModSecurity CRS rule sets). Granular rule precedence: Avoids false positives on administrative APIs while maintaining strict perimeter security for public-facing assets.