Cloud Armor for DDoS and WAF in GCP - Step-by-Step Execution

Process Flow - Cloud Armor for DDoS and WAF

Client sends request

↓

Request hits GCP Load Balancer

↓

Cloud Armor evaluates request

↓

Allowed

↓

Backend service receives request

Requests from clients go through the load balancer where Cloud Armor checks them. Allowed requests go to backend; blocked requests are dropped to protect from attacks.

Execution Sample

GCP

1. Client sends HTTP request
2. Load Balancer receives request
3. Cloud Armor checks rules
4. If request matches block rule, drop it
5. Else, forward to backend

This flow shows how Cloud Armor filters requests to block attacks and allow safe traffic.

Process Table

Step	Request Source IP	Rule Matched	Action Taken	Result
1	198.51.100.23	No rule matched	Allow	Request forwarded to backend
2	203.0.113.45	IP block rule matched	Block	Request dropped
3	198.51.100.23	Rate limit exceeded	Block	Request dropped
4	198.51.100.23	No rule matched	Allow	Request forwarded to backend
5	192.0.2.10	WAF rule matched (SQLi)	Block	Request dropped
6	198.51.100.23	No rule matched	Allow	Request forwarded to backend

💡 Requests stop processing after Cloud Armor decides to allow or block based on rules.

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	After Step 5	After Step 6
Request Source IP	-	198.51.100.23	203.0.113.45	198.51.100.23	198.51.100.23	192.0.2.10	198.51.100.23
Rule Matched	-	No rule matched	IP block rule matched	Rate limit exceeded	No rule matched	WAF rule matched (SQLi)	No rule matched
Action Taken	-	Allow	Block	Block	Allow	Block	Allow
Result	-	Request forwarded to backend	Request dropped	Request dropped	Request forwarded to backend	Request dropped	Request forwarded to backend

Key Moments - 3 Insights

Why does a request get blocked even if the IP is not on a block list?

Because Cloud Armor also uses other rules like rate limiting and WAF rules (see steps 3 and 5 in execution_table) that can block requests based on behavior, not just IP.

What happens to requests after Cloud Armor blocks them?

Blocked requests are dropped immediately and do not reach the backend service, as shown in the 'Result' column for blocked steps.

Can a request be allowed if it matches some rules?

No, if a request matches a block rule, it is dropped. Only requests that do not match any block rules are allowed (see steps 1, 4, and 6).

Visual Quiz - 3 Questions

Look at the execution_table, what action is taken at step 2 for IP 203.0.113.45?

A Block

B Allow

C Rate limit

D Forward

💡 Hint

Check the 'Action Taken' column at step 2 in the execution_table.

At which step does a WAF rule block a request?

A Step 3

B Step 1

C Step 5

D Step 6

💡 Hint

Look for 'WAF rule matched' in the 'Rule Matched' column in the execution_table.

If the rate limit rule was removed, what would happen at step 3?

A Request would still be blocked

B Request would be allowed

C Request would be dropped for IP block

D Request would cause an error

💡 Hint

Refer to the 'Rule Matched' and 'Action Taken' columns at step 3 in the execution_table.

Concept Snapshot

Cloud Armor protects apps by checking incoming requests.
It blocks bad traffic like DDoS or attacks using rules.
Requests pass through load balancer, then Cloud Armor.
If a request matches block rules, it is dropped.
Allowed requests go to backend services safely.

Full Transcript

Cloud Armor works by inspecting incoming requests at the load balancer. It uses rules to detect bad traffic such as IP blocks, rate limits, or web attack patterns. When a request arrives, Cloud Armor checks if it matches any block rule. If yes, the request is dropped and does not reach the backend. If no rules match, the request is allowed and forwarded. This protects backend services from overload and attacks. The execution table shows different requests and how Cloud Armor decides to allow or block them based on rules. Variables like source IP, matched rule, and action change step by step. Key moments clarify why some requests are blocked even without IP blocks and what happens after blocking. The visual quiz tests understanding of these steps and rule effects.