Google Cloud Armor named IP address lists

Google Cloud Armor named IP address lists let you reference lists of IP addresses and IP ranges that are maintained by third-party providers. You can configure named IP address lists within a security policy. You do not have to manually specify each IP address or IP range individually.

Named IP address lists are available to all while in beta. When named IP address lists become generally available, they will only be accessible for projects enrolled in the Google Cloud Armor Managed Protection Plus tier.

In this document, the terms IP address and IP address list include IP address ranges.

Named IP address lists are lists of IP addresses grouped under different names. The name typically refers to the provider. Named IP address lists are not subject to the quota limit on the number of IP addresses per rule.

Named IP address lists are not security policies. You incorporate them into a security policy by referencing them as expressions the same way that you reference a preconfigured rule.

For example, if a third-party provider has an IP address list of {ip1, ip2, ip3....ip_N_} under the name provider-a, you can create a security rule that allows all IP addresses that are in the provider-a list and excludes IP addresses that are not in that list:

gcloud beta compute security-policies rules create 1000 \
    --security-policy POLICY_NAME \
    --expression "evaluatePreconfiguredExpr('provider-a')" \
    --action "allow"

You cannot create your own custom named IP address lists. This feature is available only with respect to named IP address lists that are maintained by third-party providers that partner with Google. If such named IP address lists do not meet your needs, you can create a security policy where the rules allow or deny access to your resources based on the IP address from which requests originate. For more information, see Configuring security policies.

Allowing traffic only from permitted third-party providers

A typical use case is to create an allowlist containing the IP addresses of a permitted third-party partner to ensure that only traffic coming from this partner can access the load balancer and the backends.

For example, CDN providers need to pull content from origin servers at regular intervals to distribute them to their own caches. A partnership with Google provides a direct connection between CDN providers and the Google network edge. CDN users on Google Cloud can use this direct connection during origin pulls. In this case, the CDN user might want to build a security policy that only allows traffic coming from that particular CDN provider.

In this example, a CDN provider publishes its IP address list 23.235.32.0/20, 43.249.72.0/22, ⋯,. A CDN user configures a security rule that only allows traffic coming from these IP addresses. As a result, two CDN provider access points are allowed (23.235.32.10 and 43.249.72.10) and their traffic is therefore permitted. Traffic from the unauthorized access point 198.51.100.1 is blocked.

Google Cloud Armor named IP address.
Google Cloud Armor named IP address (click to enlarge)

Simplifying configuration and management by using preconfigured rules

CDN providers often use IP addresses that are well-known and that many CDN users need to use. These lists change over time, as providers add, remove, and update the IP addresses.

Using a named IP address list in a security policy rule simplifies the process of configuring and managing IP addresses because Google Cloud Armor automatically synchronizes information from CDN providers on a daily basis. This eliminates the time-consuming and error-prone process of maintaining a large IP address list manually.

The following is an example of a preconfigured rule that allows all traffic from a provider:

evaluatePreconfiguredExpr('provider-a') => allow traffic

IP address list providers

The IP address list providers in the following table are supported for Google Cloud Armor. These are CDN providers that have partnered with Google. Their IP address lists are published through individual public URLs.

These partners provide separate lists of IPv4 addresses and IPv6 addresses. Google Cloud Armor uses the provided URLs to fetch lists, and then converts the lists into named IP address lists. You refer to the lists by the names in the table.

For example, the following code creates a rule in the security policy POLICY_NAME with priority 750, incorporating the named IP address list from Cloudflare and allowing access from those IP addresses:

gcloud beta compute security-policies rules create 750 \
    --security-policy POLICY_NAME \
    --expression "evaluatePreconfiguredExpr('sourceiplist-cloudflare')" \
    --action "allow"
Provider URL(s) IP address list name
Fastly https://api.fastly.com/public-ip-list sourceiplist-fastly
Cloudflare

https://www.cloudflare.com/ips-v4

https://www.cloudflare.com/ips-v6

sourceiplist-cloudflare
Imperva

https://my.imperva.com/api/integration/v1/ips

Access to Imperva's list requires a POST request. You can use the following command as well:

curl -d "" https://my.imperva.com/api/integration/v1/ips

sourceiplist-imperva

Synchronizing IP address lists

Google Cloud Armor synchronizes IP address lists with each provider only when it detects changes that are in a valid format. Google Cloud Armor performs basic syntax validation on the IP addresses in all lists.

What's next