Google Cloud Armor Managed Protection is the managed application protection service that helps protect your web applications and services from distributed denial-of-service (DDoS) attacks and other threats from the internet. Managed Protection helps protect applications deployed on Google Cloud, on-premises, or on other infrastructure providers.
Google Cloud Armor Standard versus Managed Protection Plus
Google Cloud Armor is offered in two service tiers, Standard and Managed Protection Plus:
Google Cloud Armor Standard includes a pay-as-you go pricing model, always-on protection from volumetric and protocol-based DDoS attacks across your globally load-balanced infrastructure, and access to Google Cloud Armor web application firewall (WAF) rule capabilities, including preconfigured WAF rules for OWASP Top 10 protection.
Managed Protection Plus includes a monthly subscription that includes all the features of Google Cloud Armor Standard, as well as bundled Google Cloud Armor WAF usage (including rules, policy, and HTTP(S) requests), third-party named IP address lists, and Adaptive Protection. Managed Protection Plus subscribers also get access to DDoS bill protection and DDoS response team services.
All projects that include HTTP(S) Load Balancing, TCP Proxy Load Balancing, or SSL Proxy Load Balancing are automatically enrolled in Google Cloud Armor Standard. After subscribing to Managed Protection Plus at the billing account level, users can choose to enroll individual projects attached to the billing account in Managed Protection Plus.
The following table summarizes the two service tiers.
| Google Cloud Armor Standard | Managed Protection Plus | |
|---|---|---|
| Billing method | Pay-as-you-go | Monthly subscription + Data Processing Fee (see Pricing) |
| DDoS attack protection |
|
|
Google Cloud Armor WAF | Per policy, per rule, per request (see Pricing) | Included with Plus subscription |
| Resource limits | Up to quota limit | Up to quota limit |
| Preconfigured WAF rules | Yes | Yes |
| Time commitment | N/A | One year |
| Named IP address lists | No | Yes |
| Adaptive Protection | Alerting only | Yes |
| DDoS response support | N/A | Yes (w/ Premium Support) |
| DDoS bill protection | N/A | Yes |
Subscribing to Managed Protection Plus
To use the additional services and capabilities in Managed Protection Plus, you must first subscribe to Managed Protection Plus. After your Managed Protection Plus subscription is activated for the billing account, you must then enroll individual projects in Managed Protection Plus.
After a project is enrolled in Managed Protection Plus, the forwarding rules for HTTP(S) Load Balancing, SSL Proxy Load Balancing, and TCP Proxy Load Balancing within the project are added to the subscription. In addition, all backend services and backend buckets are counted as protected resources and are metered for the Managed Protection Plus monthly subscription cost. The backend services and backend buckets in Managed Protection Plus are aggregated across all enrolled projects in a billing account.
DDoS response support
Google Cloud Armor Managed Protection distributed denial-of-service (DDoS) response support lets you receive 24/7 help and potential custom mitigations from DDoS attacks from the same team that protects all Google services. You can engage DDoS support during an attack to help mitigate the attack, or you can reach out proactively to plan for an upcoming high volume or potentially viral event (one which might attract an unusually high amount of visitors).
To engage DDoS response support, see Engaging DDoS response support.
DDoS bill protection
Google Cloud Armor DDoS bill protection provides credits for future Google Cloud usage for some increases in the bills from Cloud Load Balancing, Google Cloud Armor, and network internet, inter-region, and inter-zone egress as a result of a verified DDoS attack. If a claim is recognized and a credit is provided, the credit cannot be used to offset existing usage; the credit can only apply to future usage. The following table demonstrates what resources are covered by DDos bill protection:
| Endpoint Type | Covered Usage Increase |
|---|---|
| External HTTP(S) Load Balancing, external TCP Proxy Load Balancing, external SSL Proxy Load Balancing | Cloud Load Balancing
|
Google Cloud Armor
|
|
Network egress
|
To engage DDoS bill protection, see Engaging DDoS bill protection.
Terms and limitations
To learn more about the terms and limitations of Managed Protection Plus, see the Service Specific Terms page and follow these steps:
- Click Service Terms.
- Scroll to 9. Google Cloud Armor – Managed Protection Plus.
What's next
- Subscribe and enroll projects in Managed Protection Plus
- Troubleshoot issues
- Use the custom rules language reference