הגדרת מדיניות להגבלת קצב של יצירת בקשות

$ cat >custom-groups-policy.yaml <<EOF
name: projects/PROJECT_ID/locations/LOCATION/rateLimitPolicies/custom-groups-policy
description: Rate limit each API key based on custom tags.
httpRules:
# Match on traffic on the custom tag header.
- to:
    destination:
      headerSet:
        headers:
        - name: "x-custom-group-tag"
          value:
            exact: "group1"

    rateLimitActions:
      - rateLimitBucket: rl_group1_rpm_limit

- to:
    destination:
      headerSet:
        headers:
        - name: "x-custom-group-tag"
          value:
            exact: "group2"

    rateLimitActions:
      - rateLimitBucket: rl_group2_rpm_limit

rateLimitBuckets:
- name: rl_group1_rpm_limit
  # Set threshold for ALL the traffic matching this bucket.
  keys:
  - keyType: ALL

  defaultLimit:
    countLimit:
      count: 10000
      interval: 1
      intervalUnit: MINUTES

- name: rl_group2_rpm_limit
  # Set threshold for ALL the traffic matching this bucket.
  keys:
  - keyType: ALL

  defaultLimit:
    countLimit:
      count: 20000
      interval: 1
      intervalUnit: MINUTES

targets:
- resource: projects/PROJECT_ID/regions/LOCATION/forwardingRules/FORWARDING_RULE_NAME
EOF

gcloud network-security service-rate-limit-policies import custom-groups-policy \
 --source=custom-groups-policy.yaml \
 --location=LOCATION \
 --project=PROJECT_ID

$ cat >all-clients-policy.yaml <<EOF
name: projects/PROJECT_ID/locations/LOCATION/rateLimitPolicies/all-clients-policy
description: Service rate limiting example.
httpRules:
  # Match on all traffic.

  # Service rate limiting bucket
- rateLimitActions:
  - rateLimitBucket: rl_default_rpm_limit

rateLimitBuckets:
- name: "rl_default_rpm_limit"
  # Match on 'ALL' requests for this bucket.
  keys:
  - keyType: ALL

  defaultLimit:
    countLimit:
      count: 10000
      interval: 1
      intervalUnit: MINUTES

targets:
- resource: projects/PROJECT_ID/regions/LOCATION/forwardingRules/FORWARDING_RULE_NAME
EOF

gcloud network-security service-rate-limit-policies import all-clients-policy \
 --source=all-clients-policy.yaml \
 --location=LOCATION \
 --project=PROJECT_ID

$ cat >host-and-api-key-policy.yaml <<EOF
name: projects/PROJECT_ID/locations/LOCATION/rateLimitPolicies/host-and-api-key-policy
description: Rate limit each api key.
httpRules:
  # Match on traffic to example.com
- to:
    destination:
      hosts:
      - exact: "example.com"

  rateLimitActions:
    - rateLimitBucket: rl_default_rpm_limit

rateLimitBuckets:
- name: rl_default_rpm_limit
  # Identify API key from its header, say 'x-api-key'.
  keys:
  - header: "x-api-key"
    keyType: HTTP_HEADER

  defaultLimit:
    countLimit:
      count: 1000
      interval: 5
      intervalUnit: MINUTES

  # Override the threshold for specific API key 'abc123'.
  userOverrides:
  - overrideKey:
      httpHeaders:
      - header: "x-api-key"
        value: "abc123"
    limit:
      countLimit:
        count: 10000
        interval: 5
        intervalUnit: MINUTES

targets:
- resource: projects/PROJECT_ID/regions/LOCATION/forwardingRules/FORWARDING_RULE_NAME
EOF

gcloud network-security service-rate-limit-policies import host-and-api-key-policy \
 --source=host-and-api-key-policy.yaml \
 --location=LOCATION \
 --project=PROJECT_ID

$ cat >path-and-client-name-policy.yaml <<EOF
name: projects/PROJECT_ID/locations/LOCATION/rateLimitPolicies/path-and-client-name-policy
description: Simple API rate limiting example.
httpRules:
  # Match on traffic to /public .
- to:
    destination:
      paths:
      - exact: "/public"

  # Default RPM bucket
  rateLimitActions:
  - rateLimitBucket: rl_default_rpm_limit

rateLimitBuckets:
- name: "rl_default_rpm_limit"
  # Identify client by its client cert name
  keys:
  - keyType: PRINCIPAL
    principalType: CLIENT_CERT_COMMON_NAME
  defaultLimit:
    countLimit:
      count: 100
      interval: 1
      intervalUnit: MINUTES

targets:
- resource: projects/PROJECT_ID/regions/LOCATION/forwardingRules/FORWARDING_RULE_NAME

EOF

gcloud network-security service-rate-limit-policies import path-and-client-name-policy \
 --source=path-and-client-name-policy.yaml \
 --location=LOCATION \
 --project=PROJECT_ID