Google Cloud Armor

Question

I want to create new Cloud Armor policy for my website to prevent DDOS attack, which is hosted on GCP VM. So how do I prevent & configure from tcp , udp flood & ICMP. Also what are the IP's to put in to blacklist.

Please suggest me, Thanks

Answer 1

According to the official doucumentation

Google Cloud Armor security policies are available only for backend services behind an external HTTP(S) load balancer.

Google Cloud Armor security policies are made up of rules that filter traffic based on layer 3, 4, and 7 attributes. For example, you can specify conditions that match on an incoming request's IP address, IP range, region code, or request headers.

You can find a detailed explanation here:

Configuring Google Cloud Armor security policies

Answer 2

@Vittal

Regarding the last part of your question ( as the first part already answered ): "Also what are the IP's to put on to blacklist."

What to block is absolutely based on your business. But if your project is already a part of the "Adaptive Protection Plan", then you can use GCP Threat Intelligence PreConfigured rules like :

1. Blocking ToR Network. 2) Blocking Crawlers and Search Engine IP's 3) Blocking iplist-search-engines-crawlers

You can find more of these thread detection rules from the below article: https://cloud.google.com/armor/docs/threat-intelligence#configure-nti

Thanks Manoj