Securing GCP Cloud Run with Global HTTPS Load Balancing & Cloud Armor WAF

Exposing default Cloud Run endpoints (*.a.run.app) directly to the public internet leaves backend applications exposed to automated bot scanners, volumetric DDoS attacks, and web application security vulnerabilities.

Placing a Google Cloud Global External HTTP(S) Load Balancer with Cloud Armor Web Application Firewall (WAF) in front of your Cloud Run services provides enterprise enterprise-grade perimeter protection, custom domain SSL management, and granular IP rate limiting.

Security Architecture Flow

  [ Public Web Traffic ]
            │
            ▼
  [ GCP Global Anycast IP ]
            │
  [ Cloud Armor Security Policies ] ──(Filters SQLi, XSS, DDoS & Bots)
            │
  [ External HTTP(S) Load Balancer ]
            │ (Serverless NEG)
            ▼
  [ Cloud Run Service ] (Configured with --ingress=internal-and-cloud-load-balancing)

Step-by-Step Security Hardening

1. Restrict Cloud Run Ingress Settings

Lock down the Cloud Run service so it only accepts traffic coming through the Cloud Load Balancer, ignoring direct access attempts to the a.run.app default hostname:

gcloud run services update api-service \
  --region=us-central1 \
  --ingress=internal-and-cloud-load-balancing

2. Configure Cloud Armor WAF Rules

Apply pre-configured OWASP Top 10 threat detection rules to block SQL injection (SQLi) and Cross-Site Scripting (XSS):

# Create Cloud Armor Security Policy
gcloud compute security-policies create cloud-run-waf-policy --description="WAF Rules for Cloud Run"

# Add OWASP SQLi Protection Rule
gcloud compute security-policies rules create 1000 \
  --security-policy=cloud-run-waf-policy \
  --expression="evaluatePreconfiguredExpr('sqli-v33-stable')" \
  --action="deny-403" \
  --description="Block SQL Injection attempts"

Benefits