MARK MIRCHANDANI: Get ready.
Here it comes.
PRIYANKA VERGADIA: [GASPS] That was close.
MARK MIRCHANDANI: Whew!
It's a good thing we had this defense.
But what happens when someone attacks my cloud
infrastructure?
PRIYANKA VERGADIA: Well, no problem.
That's why we've got Cloud Armor.
MARK MIRCHANDANI: Wait.
Armor made of clouds?
PRIYANKA VERGADIA: No, Cloud Armor for Google Cloud.
MARK MIRCHANDANI: Oh.
PRIYANKA VERGADIA: Yeah.
With Google Cloud Armor, you can protect your network
and infrastructure against denial
of service attacks, monitor security, and much more.
MARK MIRCHANDANI: Oh.
Well, that sounds like a must have.
How do we get started?
PRIYANKA VERGADIA: Yeah, let's jump right in.
[MUSIC PLAYING]
Let's start with what is Cloud Armor, and how does it help.
Cloud Armor it's a network security
offering for protecting your Google Cloud
deployments against Layer 3 through Layer 7
DDoS attacks by leveraging Google's global edge
infrastructure and DDoS defense expertise.
Cloud Armor works with global HTTP/HTTPS load balancer,
which provides built-in infrastructure DDoS defense.
You can create rules using combination of Layer 3
to 7 parameters and geolocation to protect your deployment.
You can also use predefined rules
to defend against cross-site scripting and SQL injection
defenses.
Create the policy and apply to more than one service.
In Stackdriver Logging, you can see
if the policy was matched and applied
to the incoming request.
You don't always have to apply the policy and rules in Access
or Deny mode.
You can understand the access patterns
by using Preview mode to ensure you
are blocking correct traffic.
You can also enforce access control
based on IPv4 and IPv6 addresses or CIDR blocks.
All right, enough talk.
Now let's see how to set up Cloud Armor.
On Google Cloud console, choose Network Security
under Networking, and then Create Policy.
Give your policy a name.
Select the rule action from Allow and Deny.
Then Add Rule.
Give your rule a description.
Under Conditions, choose a type.
Right now, under the beta release,
you can select IP address ranges.
Provide the matching criteria with IP address range
and select the action Allow or Deny.
Initially, you may want to just preview
the traffic under this rule.
So select Enable checkbox to just review.
Priority determines the order in which the rules are checked.
So accordingly, we're just going to set 1,000 in this case.
Now, the last step is to set up targets.
Targets are GCP resources that you want to control access to.
You will need to have a predefined, load-balanced
target.
So select that as one of the targets that you want.
You will see the policy create on the dashboard.
In order to test if the policy worked, access the backend.
In Google Cloud console, navigate to Stackdriver Logging
and expand the recent log.
And you will see the enforced security policy
under JSON Payload.
There you have it.
You just created a simple backless policy in Cloud Armor
and verified that it worked in Stackdriver Logging.
So Mark, that's how easy it is to set up Cloud Armor.
MARK MIRCHANDANI: Wow, with all that security,
everyone should be using it to keep their network safe.
PRIYANKA VERGADIA: That's right.
And you can get started right now
using Google Cloud Armor to protect yourself from attacks.
Woo.
Don't forget to like, subscribe, and comment below.
MARK MIRCHANDANI: And if you want to get in contact with us,
click the link below.
[MUSIC PLAYING]