What is Cloud Armor?
Cloud Armor is Google’s DDoS protection and Web Application Firewall service for applications behind Google Cloud load balancers. The service operates at Google’s global edge network and blocks volumetric DDoS attacks at the network and transport layer as well as application-layer attacks before they reach the underlying infrastructure.
Cloud Armor is available in two pricing tiers: the Standard tier is billed on a pay-per-use basis and provides basic protection. Cloud Armor Enterprise (previously named Managed Protection Plus) charges a monthly flat fee plus usage costs, but adds Adaptive Protection, access to Google Threat Intelligence, and DDoS cost protection, under which Google covers attack-related cost spikes.
Core Features
- DDoS protection at Google’s global edge network against L3/L4 attacks
- Web Application Firewall with preconfigured rules against OWASP Top 10 threats
- Adaptive Protection with ML-based detection of Layer 7 DDoS patterns (Enterprise tier)
- Geo-based access control as well as IP allow and deny lists
- Custom rules via the Common Expression Language (CEL)
Typical Use Cases
E-commerce Protection: Securing online shops against DDoS attacks during sales events and protecting against automated abuse, combined with Google Cloud Fraud Defense (formerly reCAPTCHA Enterprise) for bot and fraud detection.
API Security: Rate limiting and WAF rules for public APIs to protect against abuse and exploitation.
Compliance Requirements: Supporting PCI DSS and other standards through application layer firewall rules.
Benefits
- Protection through Google’s global edge network
- No changes to application architecture required
- Automatic scaling for attacks of varying size
- Integrated logging and monitoring
Integration with innFactory
As a certified Google Cloud partner, innFactory supports you with Cloud Armor: selecting the right tier, architecture, migration, operations, and cost optimization.
Available Tiers & Options
Standard
- Pay-as-you-go with no base fee
- Basic DDoS and application protection
- WAF rules available
- No Adaptive Protection
- No DDoS cost protection
Enterprise
- Full Adaptive Protection with ML-based attack detection
- Access to Google Threat Intelligence
- DDoS cost protection (Google covers attack-related cost spikes)
- Monthly flat fee in addition to usage costs
Typical Use Cases
Frequently Asked Questions
What is Cloud Armor?
Cloud Armor is Google's DDoS protection and Web Application Firewall service for Google Cloud load balancers. It protects applications at Google's global edge network before attacks reach the underlying infrastructure.
What is the difference between Cloud Armor Standard and Enterprise?
Cloud Armor Standard is billed on a pay-per-use basis and provides basic DDoS and WAF protection. Cloud Armor Enterprise (formerly Managed Protection Plus) charges a monthly flat fee and adds Adaptive Protection, access to Google Threat Intelligence, and DDoS cost protection.
Which WAF rule sets are available?
Cloud Armor offers preconfigured rules against OWASP Top 10 threats such as SQL injection and cross-site scripting, as well as custom rules using the Common Expression Language (CEL).
Which backend services are protected?
Cloud Armor protects, among others, external and internal Application Load Balancers as well as external and regional Network Load Balancers. The exact list of supported load balancer types is documented in Google's official documentation.
Note: All product information on this page has been compiled with care, but is provided without guarantee and may be outdated or incomplete. Cloud services evolve rapidly — features, pricing, SLAs, and availability change frequently. Authoritative and up-to-date information can only be found on the official product page of Google Cloud (official documentation). This page does not represent an offer by Google Cloud.
