Google Cloud Armor
Google Cloud Armor is a security service that blocks malicious requests and large-scale attacks in front of public services. You attach WAF rules, geographic policies, and rate limits directly to Cloud Load Balancing.
▶Architecture Diagram
🔗 RelationshipDashed line animations indicate the flow direction of data or requests
Once a service is public, normal users are mixed with scanners and attack traffic. If those requests reach the backend unchanged, both cost and outage risk grow quickly.
Teams once operated separate firewalls and WAF appliances on their own. As cloud services consolidated traffic behind global front doors, applying managed L7 security at that same edge became the natural model.
Cloud Armor works as a security policy attached to Cloud Load Balancing. Each request is evaluated against WAF rules, IP or geography conditions, and rate limits before any allowed request is sent to the backend service.
Cloud Armor and Cloud IAM both restrict access, but Cloud Armor filters public HTTP(S) traffic at the edge while Cloud IAM controls API and resource permissions for identities. Use Cloud Armor when the problem is internet request patterns; use IAM when the problem is what users or service accounts are allowed to do.
Well suited to protecting public APIs, web applications, and multi-region services. It does not replace service-to-service authentication or identity-based authorization inside the backend.