Create a Cloud Armor Security Policy with DDoS Protection for Load Balancer Backends via gcloud

Create and Attach a Cloud Armor Security Policy Using gcloud

To protect a load balancer backend from DDoS attacks and application-layer threats, create a Cloud Armor security policy in Google Cloud, attach it to the backend service, and define rules that allow or deny traffic. The gcloud CLI provides a consistent, scriptable workflow for this entire process, from initial policy creation to rule refinement and logging.

Prerequisites

• A Google Cloud project with billing enabled and the Compute Engine API active.
• The gcloud CLI installed and configured with a service account or user account that has the roles/compute.securityAdmin or equivalent permissions.
• A global or regional HTTP(S) load balancer already configured with at least one backend service.

Create the Cloud Armor Security Policy

Use the gcloud compute security-policies create command to define the policy. Replace POLICY_NAME with a descriptive name and PROJECT_ID with your project ID.

gcloud compute security-policies create POLICY_NAME \ --description "DDoS protection policy for LB backends" \ --project PROJECT_ID

Add Security Rules to the Policy

After creating the policy, add rules that control traffic. A typical DDoS mitigation setup starts with a high-precedence rule to drop obvious malicious patterns, followed by an allow rule for legitimate traffic. Precedence values range from 0 (highest) to 2147483647 (lowest); rules are evaluated in ascending order.

• Use gcloud compute security-policies rules create to add each rule.
• Set the action to deny for blocking or allow for permitting.
• Use src-ip-ranges to target specific IPs, CIDR blocks, or '*' for all traffic.
• Enable preconfigured WAF rulesets such as sqli-steering and xss-steering for OWASP top-10 coverage.

gcloud compute security-policies rules create 1000 \ --security-policy POLICY_NAME \ --action deny-403 \ --description "Block known bad IPs" \ --src-ip-ranges "203.0.113.0/24" \ --project PROJECT_IDgcloud compute security-policies rules create 2147483647 \ --security-policy POLICY_NAME \ --action allow \ --description "Allow all other traffic" \ --src-ip-ranges "*" \ --project PROJECT_ID

Attach the Policy to a Backend Service

The security policy protects the backend, not the frontend. Attach it to the backend service that fronts your instances or NEGs.

gcloud compute backend-services update BACKEND_SERVICE_NAME \ --security-policy POLICY_NAME \ --global \ --project PROJECT_ID

Replace BACKEND_SERVICE_NAME with the name of your existing backend service. For regional backends, omit the --global flag and add --region REGION.

Configure DDoS Protection Options

Cloud Armor provides two tiers of DDoS protection: Standard, which is included at no charge, and Advanced, which requires a Cloud Armor license. The gcloud command to set the tier is applied at the backend service level.

Monitor and Refine with Logging

Enable Cloud Armor logging to review matched rules and attack patterns. Create a log sink in Cloud Logging or use the security policy commands to inspect rule matches over time.

gcloud compute security-policies describe POLICY_NAME \ --project PROJECT_ID \ --format "table(rules.priority, rules.action, rules.match.config.srcIpRanges)"

Summary of Key gcloud Commands

• gcloud compute security-policies create — creates the policy object.
• gcloud compute security-policies rules create — adds allow or deny rules with precedence.
• gcloud compute backend-services update — attaches the policy to a backend service.
• gcloud compute backend-services update with --enable-cloud-armor — activates DDoS protection.

Iterate on rules as traffic patterns evolve, using logging to validate that legitimate traffic is unaffected while malicious traffic is blocked.