Some or all of the information on this page might not apply to Cloud de Confiance by S3NS. See Differences from Google Cloud for more details.

Example security policies

You can configure Google Cloud Armor security policies to protect your services from denial-of-service (DoS) and web attacks. These policies use Google's global infrastructure to secure your applications and control traffic flowing through load balancers.

This document provides example security policy configurations for various types of load balancers.

Create security policies

Use the Cloud de Confiance console or the gcloud CLI to create security policies. These instructions assume that you're configuring policies for an existing load balancer and backend service. For an example, see Create the example.

Console

To create rules and attach a security policy to a backend service, you do the following:

In the Cloud de Confiance console, go to the Cloud Armor policies page.

Go to Cloud Armor policies
Click Create policies.
In the Name field, enter the name of your policy.
Optional: Enter a description of the policy.
For Policy type choose Backend security policy or Edge security policy.
For Default rule action, select Allow to permit access by default, or select Deny to refuse access by default.

The default rule is the lowest priority rule that takes effect only if no other rule applies.
If you configure a Deny rule, select a deny status Response code. Cloud Armor returns this status code if a request is denied.
Click Next step.

Add more rules:

Click Add rule.
Optional: Enter a description for the rule.
Select the mode:
- Basic mode: allow or deny traffic based on IP addresses or IP ranges.
- Advanced mode: allow or deny traffic based on rule expressions.
In the Match field, specify the conditions that the rule applies to:
- Basic mode: enter IP addresses or IP ranges to match in the rule.
- Advanced mode: enter an expression to evaluate against incoming requests. See custom rules language attributes.
For Action, select Allow or Deny.
To enable preview mode, select Enable. In preview mode, Cloud Armor logs the rule's effect without enforcing it.
Enter the rule's Priority (0 to 2,147,483,646). See Rule evaluation order.
Click Done.
To add more rules, click Add rule. Otherwise, click Next step.

Apply policy to targets:

Click Add Target.
In the Target list, select a target.
To add more targets, click Add Target.
Click Done.
Click Create policy.

gcloud

To create a Cloud Armor security policy, use the gcloud compute security-policies create command.

Use the --type flag to specify CLOUD_ARMOR (backend) or CLOUD_ARMOR_EDGE (edge). If you omit the flag, Cloud Armor creates a backend security policy:
```
 gcloud compute security-policies create NAME \
     [--type=CLOUD_ARMOR|CLOUD_ARMOR_EDGE] \
     [--file-format=FILE_FORMAT | --description=DESCRIPTION] \
     [--file-name=FILE_NAME]
```
Replace the following:
- NAME: the name of the security policy
- FILE_FORMAT: the format of the file specified in --file-name; specify yaml or json
- DESCRIPTION: the description of the security policy
- FILE_NAME: the name of a file that contains either a YAML or JSON export of the security policy
The following command updates a policy, turns JSON parsing on, and changes the log level to VERBOSE:
```
 gcloud compute security-policies update my-policy \
     --json-parsing=STANDARD \
     --log-level=VERBOSE
```

To add rules to a security policy, use the gcloud compute security-policies rules create PRIORITY command.

 gcloud compute security-policies rules create PRIORITY  \
     [--security-policy POLICY_NAME] \
     [--description DESCRIPTION] \
     --src-ip-ranges IP_RANGE,... | --expression EXPRESSION \
     --action=[ allow | deny-403 | deny-404 | deny-502 ] \
     [--preview]

Replace the following:

PRIORITY: the rule priority. See Rule evaluation order
POLICY_NAME: the name of your security policy
DESCRIPTION: a description of the rule
IP_RANGE,...: a comma-separated list of IP address ranges
EXPRESSION: a Cloud Armor rules language expression

For example, the following command adds a rule to block traffic from 192.0.2.0/24 and 198.51.100.0/24. The rule has priority 1000:

 gcloud compute security-policies rules create 1000 \
     --security-policy my-policy \
     --description "block traffic from 192.0.2.0/24 and 198.51.100.0/24" \
     --src-ip-ranges "192.0.2.0/24","198.51.100.0/24" \
     --action "deny-403"

With the --preview flag added, the rule is added to the policy, but not enforced, and any traffic that triggers the rule is only logged.

 gcloud compute security-policies rules create 1000 \
     --security-policy my-policy \
     --description "block traffic from 192.0.2.0/24 and 198.51.100.0/24" \
     --src-ip-ranges "192.0.2.0/24","198.51.100.0/24" \
     --action "deny-403" \
     --preview

Use the --expression flag to specify a custom condition. See custom rules language attributes. The following command adds a rule to allow traffic from the IP address 1.2.3.4 that contains the string example in the User-Agent header:

 gcloud compute security-policies rules create 1000 \
     --security-policy my-policy \
     --expression "inIpRange(origin.ip, '1.2.3.4/32') && has(request.headers['user-agent']) && request.headers['user-agent'].contains('example')" \
     --action allow \
     --description "Block User-Agent 'example'"

The following command adds a rule to block requests if the request's cookie contains a specific value:

 gcloud compute security-policies rules create 1000 \
     --security-policy my-policy \
     --expression "has(request.headers['cookie']) && request.headers['cookie'].contains('cookie_name=cookie_value')" \
     --action "deny-403" \
     --description "Cookie Block"

The following command adds a rule to block requests from the region AU:

 gcloud compute security-policies rules create 1000 \
     --security-policy my-policy \
     --expression "origin.region_code == 'AU'" \
     --action "deny-403" \
     --description "AU block"

The following command adds a rule to block requests from the region AU that are not in the specified IP range:

 gcloud compute security-policies rules create 1000 \
     --security-policy my-policy \
     --expression "origin.region_code == 'AU' && !inIpRange(origin.ip, '1.2.3.0/24')" \
     --action "deny-403" \
     --description "country and IP block"

The following command adds a rule to block requests with a URI that matches a regular expression:

 gcloud compute security-policies rules create 1000 \
     --security-policy my-policy \
     --expression "request.path.matches('/example_path/')" \
     --action "deny-403" \
     --description "regex block"

The following command adds a rule to block requests if the Base64 decoded value of the user-id header contains a specific value:

 gcloud compute security-policies rules create 1000 \
     --security-policy my-policy \
     --expression "has(request.headers['user-id']) && request.headers['user-id'].base64Decode().contains('myValue')" \
     --action "deny-403" \
     --description "country and IP block"

The following command adds a rule that uses a preconfigured expression set to mitigate SQLi attacks:

 gcloud compute security-policies rules create 1000 \
     --security-policy my-policy \
     --expression "evaluatePreconfiguredWaf('sqli-v422-stable')" \
     --action "deny-403"

The following command adds a rule that uses a preconfigured expression to allow access from all IP addresses on a named IP address list:

 gcloud compute security-policies rules create 1000 \
     --security-policy my-policy \
     --expression "evaluatePreconfiguredWaf('sourceiplist-fastly')" \
      --action "allow"

Configure security policies for regional external Application Load Balancers

Follow the steps in this section to configure regionally scoped Cloud Armor security policies for regional external Application Load Balancers.

Protect regionally load balanced workloads

Follow the steps in this section to configure a security policy for a regionally scoped backend service:

Create a regionally scoped security policy.
```
 gcloud compute security-policies create POLICY_NAME \
     --type=CLOUD_ARMOR \
     --region=REGION
```
Replace the following:
- POLICY_NAME: the name of the security policy
- REGION: the region where to create the security policy
Attach the regionally scoped security policy to a regionally scoped backend service. Replace BACKEND_NAME with the name of your existing regionally scoped backend service.
```
 gcloud compute backend-services update BACKEND_NAME \
     --security-policy=POLICY_NAME \
     --region=REGION
```

Example: apply a regionally scoped security policy

In this example, as a security administrator, you want to satisfy a residency requirement that all backend workloads and WAF rules are deployed in a specific region. Assume you have already met the following conditions:

You created regionally scoped load-balanced backend services in the region.
You disabled any existing globally scoped security policies in your deployment.
You created and attached a regionally scoped security policy in the same region (as in the previous section).

You can add WAF rules and other advanced rules to your policy by using these commands:

Add a WAF rule to the policy:

gcloud compute security-policies rules create 1000 --action=deny-404 \
    --expression="evaluatePreconfiguredWaf('xss-v422-stable', ['owasp-crs-v042200-id941100-xss', 'owasp-crs-v042200-id941160-xss'])" \
    --security-policy=POLICY_NAME \
    --region=REGION

Replace the following:

POLICY_NAME: the name of the security policy
REGION: the region of the security policy

Add an advanced rule to the policy:

gcloud compute security-policies rules create 1000 --action=allow \
    --expression="has(request.headers['cookie']) && request.headers['cookie'].contains('80=EXAMPLE')" \
    --security-policy=POLICY_NAME \
    --region=REGION

Add a rate limiting rule to the policy:

gcloud compute security-policies rules create 1000 --action=throttle \
    --src-ip-ranges="1.1.1.1/32" \
    --rate-limit-threshold-count=1000 \
    --rate-limit-threshold-interval-sec=120 \
    --conform-action="allow" \
    --exceed-action="deny-429" \
    --enforce-on-key=IP \
    --ban-duration-sec=999 \
    --ban-threshold-count=5000 \
    --ban-threshold-interval-sec=60 \
    --security-policy=POLICY_NAME \
    --region=REGION

Replace the following:

POLICY_NAME: the name of the security policy
REGION: the region of the security policy

What's next

Create and view Cloud Armor security policies
Learn more about rate limiting.

Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2026-10-09 UTC.