How to protect your GCP apps from bad bots using Cloud Armor and Load Balancer?

Question

I have the Google Cloud Platform load balancer as a CDN and entry point to my running services.

As far as I know GCP load balancer offers out of the box DDoS protection even without custom Cloud Armor rules setup.

Is it also includes some protection against the "bad bots" which are scraping the info or sending spam?

If not, is there any way we can setup some rules using Cloud Armor to protect GCP services against such bots?

Answer 1

Since your question is very broad and not very precise I will just point out some of the main features & benefits of Cloud Armor and point you to some usefull documentation that will help you understand how to use configure and use it.

Cloud Armor key features are:

• Benefit from DDoS protection and WAF at Google scale
• Detect and mitigate attacks against your Cloud Load Balancing workloads
• Adaptive Protection (Preview) ML-based mechanism to help detect and block Layer 7 DDoS attacks
• Mitigate OWASP Top 10 risks and help protect workloads on-premises or in the cloud

WAF is a set of web application firewall rules that you can configure to protect your resources. Rules are written in a CEL language so have a look at this document to help you understand how they work.

Adaptive protection

helps you protect your Google Cloud applications, websites, and services against L7 distributed denial-of-service (DDoS) attacks such as HTTP floods and other high-frequency layer 7 (application-level) malicious activity. Adaptive Protection builds machine-learning models that do the following:

• Detect and alert on anomalous activity
• Generate a signature describing the potential attack
• Generate a custom Google Cloud Armor WAF rule to block the signature

Last but not least - what is OWASP ?

OWASP stands for the Open Web Application Security Project, an online community that produces articles, methodologies, documentation, tools, and technologies in the field of web application security.

The Top 10 OWASP vulnerabilities in 2021 are:

• Injection
• Broken authentication
• Sensitive data exposure
• XML external entities (XXE)
• Broken access control
• Security misconfigurations
• Cross site scripting (XSS)
• Insecure deserialization
• Using components with known vulnerabilities
• Insufficient logging and monitoring

Combining this together Cloud armomor gives you a wide array of tools to protect your infrastructure from anything you can think of - given you can understand WAF rules and master the skill of writing them.

You can also try to use Recaptcha Enterprise integrated with Cloud Armor to challenge all automated requests;

Google Cloud Armor provides effective management of automated clients' requests towards your backends through native integration with reCAPTCHA Enterprise. reCAPTCHA Enterprise uses advanced risk analysis techniques to distinguish between human users and automated clients. With the integration, reCAPTCHA Enterprise issues an encrypted token that contains the reCAPTCHA Enterprise assessment and associated attributes about the risk associated with the request. Google Cloud Armor deciphers this token without an additional request/response to the reCAPTCHA Enterprise server. Based on the token attributes, Google Cloud Armor lets you allow, block, or redirect the incoming requests.

Here's an example of redirecting to reCAPTCHA:

You can redirect a request to reCAPTCHA Enterprise to assess the user and serve manual challenges if necessary, without any additional reCAPTCHA Enterprise implementation. When human users share the same signature (such as URL paths or other L7 signatures) as a bot or an abusive system, this action provides a way for them to prove they are human and gain access, rather than being blocked. Only users who pass the assessment can acquire an exemption cookie and gain access to your service.