Example security policies

You can configure Google Cloud Armor security policies to protect your services from denial-of-service (DoS) and web attacks. These policies use Google's global infrastructure to secure your applications and control traffic flowing through load balancers.

This document provides example security policy configurations for various types of load balancers.

Configure security policies for external Application Load Balancers

The following are the high-level steps for configuring Cloud Armor security policies to enable rules that allow or deny traffic to the global external Application Load Balancer or the classic Application Load Balancer:

  1. Create a Cloud Armor security policy.
  2. Add rules to the security policy based on IP address lists, custom expressions, or preconfigured expression sets.
  3. Attach the security policy to a backend service of the global external Application Load Balancer or the classic Application Load Balancer for which you want to control access.
  4. Update the security policy as needed.

In the following example, you create two Cloud Armor security policies and apply them to different backend services.

Example in which two security policies are applied to different backend services.
Example in which two security policies are applied to different backend services (click to enlarge).

In the example, these are the Cloud Armor security policies:

  • mobile-clients-policy applies to external users of your games services.
  • internal-users-policy applies to your organization's test-network team.

You apply mobile-clients-policy to the games service, whose backend service is called games, and you apply internal-users-policy to the internal test service for the testing team, whose corresponding backend service is called test-network.