借助 Cloud Armor Google Threat Intelligence，您可以根据多个类别的威胁情报数据允许或阻止流向全球外部应用负载均衡器和传统应用负载均衡器的流量，从而保护流量。如需详细了解 Google Threat Intelligence，请参阅应用 Google Threat Intelligence。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-14。"],[[["\u003cp\u003eGoogle Cloud Armor safeguards Google Cloud deployments from DDoS and application attacks like XSS and SQLi, offering both automatic and manually configurable protections.\u003c/p\u003e\n"],["\u003cp\u003eSecurity policies in Google Cloud Armor protect applications behind load balancers from various web-based attacks, including preconfigured options and custom rule creation.\u003c/p\u003e\n"],["\u003cp\u003ePreconfigured WAF rules within Google Cloud Armor, sourced from OWASP Core Rule Set 3.3.2, allow for the evaluation of many distinct traffic signatures without the need to manually define each one.\u003c/p\u003e\n"],["\u003cp\u003eCloud Armor Enterprise offers managed application protection with always-on DDoS protections and WAF rules, also providing DDoS attack telemetry visibility for subscribers.\u003c/p\u003e\n"],["\u003cp\u003eGoogle Cloud Armor's Adaptive Protection analyzes traffic patterns to identify L7 DDoS attacks, generating suggested WAF rules to mitigate them.\u003c/p\u003e\n"]]],[],null,["# Product overview\n\nGoogle Cloud Armor helps you protect your Google Cloud deployments from\nmultiple types of threats, including distributed denial-of-service (DDoS)\nattacks and application attacks like cross-site scripting (XSS) and SQL\ninjection (SQLi). Cloud Armor features\nsome automatic protections and some that you need to configure manually.\nThis document provides a high-level overview of these features, several of which\nare only available for global external Application Load Balancers and classic Application Load Balancers.\n\nSecurity policies\n-----------------\n\nUse Cloud Armor security policies to protect applications running behind\na load balancer from distributed denial-of-service (DDoS) and other web-based\nattacks, whether the applications are deployed on Google Cloud, in a hybrid\ndeployment, or in a multi-cloud architecture. Security policies can be configured\nmanually, with configurable match conditions and actions in a security policy.\nCloud Armor also features preconfigured security policies, which cover\na variety of use cases. For more information, see\n[Cloud Armor security policy overview](/armor/docs/security-policy-overview).\n\n### Rules language\n\nCloud Armor lets you define prioritized rules with configurable\nmatch conditions and actions in a security policy. A rule takes effect, meaning\nthat the configured action is applied, if the rule is the highest priority rule\nwhose attributes match the attributes of the incoming request.\nFor more information, see\n[Cloud Armor custom rules language reference](/armor/docs/rules-language-reference).\n\n### Preconfigured WAF rules\n\nGoogle Cloud Armor preconfigured WAF rules are complex web application firewall (WAF)\nrules with dozens of *signatures* that are compiled from open source industry\nstandards. Each signature corresponds to an attack detection\nrule in the rule set. Google offers these rules as-is. The rules allow\nCloud Armor to evaluate dozens of distinct traffic signatures by\nreferring to conveniently named rules, rather than requiring you to define\neach signature manually.\n\nCloud Armor preconfigured rules help protect your web applications\nand services from common attacks from the internet and help mitigate the\n[OWASP Top 10 risks](https://owasp.org/www-project-top-ten/).\nThe rule source is\n[OWASP Core Rule Set 3.3.2 (CRS)](https://github.com/coreruleset/coreruleset/).\n\nThese preconfigured rules can be tuned to disable noisy or otherwise unnecessary\nsignatures. For more information, see\n[Tuning Cloud Armor WAF rules](/armor/docs/rule-tuning).\n| **Note:** XML body parsing is not supported by Cloud Armor preconfigured WAF rule.\n\nGoogle Cloud Armor Enterprise\n-----------------------------\n\nCloud Armor Enterprise is the managed application protection service that helps\nprotect your web applications and services from distributed denial-of-service\n(DDoS) attacks and other threats from the internet. Cloud Armor Enterprise\nfeatures always-on protections for your load balancer, and gives you access to\nWAF rules.\n\nDDoS protection is automatically provided for global external Application Load Balancers,\nclassic Application Load Balancers, and external proxy Network Load Balancers, regardless of\ntier. The HTTP, HTTPS, HTTP/2, and QUIC protocols are all supported. In addition,\nCloud Armor Enterprise subscribers can\n[Access DDoS attack visibility telemetry](/armor/docs/ddos-visibility).\n\nFor more information, see\n[Cloud Armor Enterprise overview](/armor/docs/armor-enterprise-overview).\n\n### Google Threat Intelligence\n\nCloud Armor Google Threat Intelligence lets you secure your\ntraffic by allowing or blocking traffic to your global external Application Load Balancers and\nclassic Application Load Balancers based on several categories of threat intelligence data.\nFor more information about Google Threat Intelligence, see\n[Apply Google Threat Intelligence](/armor/docs/threat-intel).\n\n### Google Cloud Armor Adaptive Protection\n\nAdaptive Protection helps you protect your applications and services from L7\ndistributed denial-of-service (DDoS) attacks by analyzing patterns of traffic to\nyour backend services, detecting and alerting on suspected attacks, and\ngenerating suggested WAF rules to mitigate such attacks. These rules can be\ntuned to meet your needs. Adaptive Protection can be enabled on a per-\nsecurity policy basis, but it requires an active Cloud Armor Enterprise\nsubscription in the project.\n\nFor more information, see\n[Google Cloud Armor Adaptive Protection overview](/armor/docs/adaptive-protection-overview).\n\n### Advanced network DDoS protection\n\nAdvanced network DDoS protection provides additional protections for\nManaged Protection Plus subscribers who use network load balancers,\nprotocol forwarding, or VMs with public IP addresses. Advanced network DDoS protection\nprovides always-on attack monitoring and alerting, targeted attack mitigations,\nand mitigation telemetry. For more information, see\n[Configure advanced network DDoS protection](/armor/docs/advanced-network-ddos).\n\n\nHow Cloud Armor works\n---------------------\n\nCloud Armor provides always-on DDoS protection against network or protocol-based volumetric DDoS attacks. This protection is for applications or services behind load balancers. It is able to detect and mitigate network attacks in order to allow only well-formed requests through the load balancing proxies. The security policies enforce custom Layer 7 filtering policies, including pre-configured WAF rules that mitigate OWASP top 10 web application vulnerability risks. You can attach security policies to the backend services of the following load balancers:\n\n\u003cbr /\u003e\n\n- All external Application Load Balancers, including classic Application Load Balancers\n- Regional internal Application Load Balancer\n- Global external proxy Network Load Balancer (TCP/SSL)\n- Classic proxy Network Load Balancer (TCP/SSL)\n- External passthrough Network Load Balancer (TCP/UDP)\n\nCloud Armor security policies enable you to allow or deny access to\nyour deployment at the Google Cloud edge, as close as possible to\nthe source of incoming traffic. This prevents unwelcome traffic from consuming\nresources or entering your Virtual Private Cloud (VPC) networks.\nThe following diagram illustrates the location of the global external Application Load Balancers, classic Application Load Balancers, the Google network, and Google data centers.\n\n\u003cbr /\u003e\n\n[](/static/armor/images/ip-bl-wl-1.svg) Cloud Armor policy at network edge (click to enlarge)\n\nYou can use some or all of these features to protect your application. You can\nuse security policies to match against known conditions, create WAF rules to\nprotect against common attacks like those found in the [OWASP Core Rule\nSet 3.3.2](https://github.com/coreruleset/coreruleset/),\nand use Google Cloud Armor Enterprise's built-in protections against DDoS attacks.\n\n\nWhat's next\n-----------\n\n- [Examine common use cases for Cloud Armor](/armor/docs/common-use-cases)\n- [Learn about Google Cloud Armor Enterprise](/armor/docs/armor-enterprise-overview)\n- [Learn about Google Cloud Armor Adaptive Protection](/armor/docs/adaptive-protection-overview)"]]
