Cloud Armor
WAF and DDoS protection at the Google edge.
Problem it solves: Public endpoints attract bots, injection attempts and floods.
Where it sits: At the edge, before load balancers or gateways.
When to use
- Any internet-facing endpoint.
When not to use
- As the only security layer; authorisation still belongs in services.
Failure modes
- False positives block real users.
- Rule evaluation adds latency under attack traffic.
Metrics to watch
- Blocked req/s
- False-positive reports
- Added latency (ms)
Alternatives
- CDN-integrated bot protection
- Rate limiter
Configuration in Labs (illustrative defaults)
- Instances (count) = 2 — Identical copies behind this logical component. Capacity scales linearly in this model.
- Capacity per instance (req/s) = 100000 — Maximum requests one instance completes per second before it saturates.
- Base service time (ms) = 1 — Processing time per request at zero load. Queueing adds to this as utilisation rises.
Vendor examples (pattern only): Google Cloud managed service. Simulated as a generic “Firewall / WAF”.