Build Cloud Armor WAF security policies with preconfigured rules and rate limiting.
Last verified: May 2026
Output will appear here...Google Cloud Armor provides DDoS protection and web application firewall (WAF) capabilities for applications behind Google Cloud Load Balancers. Security policies contain rules that evaluate incoming requests against conditions like IP address ranges, geographic locations, or WAF expression language predicates that inspect headers, cookies, and request bodies for attack patterns. This builder helps you create security policies with correct rule priorities, match conditions, preconfigured WAF rule sets (OWASP ModSecurity Core Rule Set), rate limiting configurations, and adaptive protection settings.
Your team's API has been getting hit with SQL injection attempts ramping up over the past week. The builder generates a Cloud Armor policy with: preconfigured `sqli-v33-stable` rule at sensitivity 1 in count mode, `xss-v33-stable` at sensitivity 1 in count mode, plus a rate-limit rule throttling >100 req/min from any source IP. After 3 days of count-mode validation, you flip the WAF rules to deny mode. SQL injection attempts drop to zero at the edge; legitimate traffic is unaffected. Backend ops team reports observable load reduction from blocked malicious traffic.
Always START Cloud Armor rules in `count` action mode (not `deny`). Count logs matches without blocking. Run for at least 1 week to identify false positives, then switch to deny. Going straight to `deny` with WAF rules guarantees blocking some legitimate users — and you won't know which until they complain.
Preconfigured WAF rules at sensitivity level 1 catch ~70% of attacks with very low false positive rate. Level 4 catches more but generates significant noise. Start at level 1, tune exceptions, only escalate sensitivity if you see actual attacks slipping through.
Adaptive Protection's auto-deploy mode is risky — ML-suggested rules can have unintended consequences. Always review suggested rules manually before deploy, at least for the first few months. Once you build confidence in the model's accuracy, you can enable auto-deploy at high confidence thresholds (e.g., 99%+).
The builder generates Cloud Armor security policies with rules at specified priorities. Each rule has: match condition (srcIpRanges, expression in CEL, preconfiguredWafConfig with rule set + sensitivity), action (allow, deny-403, redirect-to-recaptcha, throttle), and optional rateLimitOptions for rate limiting rules. Output is generated as gcloud compute security-policies commands and Terraform google_compute_security_policy resources.
Was this tool helpful?
Disclaimer: This tool runs entirely in your browser. No data is sent to our servers. Always verify outputs before using them in production. AWS, Azure, and GCP are trademarks of their respective owners.