Cloud Armor Security Policy (WAF)
A global Cloud Armor WAF policy with preconfigured OWASP SQLi and XSS rules enforcing by default, an optional per-client rate limit, and custom IP allow/deny rules - attachable to many backends.
Part of: GCP Production Landing Zone
Verification
Live-testedReally deployed to a cloud sandbox, verified against its outputs and assertions, then destroyed - with the teardown confirmed.
Conformance
- Static validation (fmt · validate · tflint)
- Security scan clean (Checkov)
- Plan test superseded by live test
Provenance
- SHA-256 checksum
- Cosign signature
Functional
- Live-tested - applied, verified, destroyed
Last verified 2026-06-30 · how we verify
Verify this download
cosign · sha-256Don't take our word for it. Every release is signed with cosign - check the bytes against our pinned public key before you trust them.
# 1. Our pinned public key - fetch once, trust out-of-band
curl -O https://www.iac-bazaar.com/cosign.pub
# 2. This module's Sigstore bundle
curl -o gcp-cloud-armor-1.0.0.sigstore.json \
https://www.iac-bazaar.com/api/artifacts/gcp-cloud-armor/signature
# 3. Verify the tarball you downloaded
cosign verify-blob \
--key cosign.pub \
--bundle gcp-cloud-armor-1.0.0.sigstore.json \
gcp-cloud-armor-1.0.0.tar.gz
# → Verified OK
# 4. (optional) confirm the checksum too
echo "7814c7c6158d58ccc1518b5601a2edb7e2c64777069fb357bee3640c1327c578 gcp-cloud-armor-1.0.0.tar.gz" | sha256sum -cUse it from the registry
terraform · opentofumodule "cloud_armor" {
source = "www.iac-bazaar.com/iac-bazaar/gcp-cloud-armor/gcp"
version = "1.0.0"
}Paid module — needs a purchase (or a subscription that covers it) plus a registry token from /account/tokens. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract — every input name, type, default and description, plus every output — is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every Free module. This one is Professional, so its contract unlocks when you buy it.
Documentation
gcp-cloud-armor
A standalone Cloud Armor security policy — a global WAF for HTTP(S) backend
services — with a mandatory default rule and the preconfigured OWASP Core Rule
Set WAF rules (SQL injection, cross-site scripting and the Log4j
CVE-2021-44228 / log4shell cve-canary rule) wired in, plus an
optional per-client rate-limit rule. The policy is not attached to any
backend; reference its name from a backend service's security_policy field so
one policy can guard many backends. Works with Terraform and OpenTofu
(>= 1.6), Google provider >= 7.0, < 8.0.
Secure defaults:
- SQLi, XSS and log4shell (
cve-canary) preconfigured WAF rules on and enforcing (deny(403)), not in preview — flipwaf_preview = trueto tune sensitivity first. - Default rule allows traffic so attaching the policy never black-holes a
backend; switch
default_rule_actionto a deny for a default-deny allowlist. - Adaptive Protection (L7 DDoS) is opt-in — it needs Cloud Armor Enterprise.
Upgrade notes
- The Log4j / log4shell (
cve-canary) rule is now enabled by default at priority1002, enforcingwaf_action(defaultdeny(403)). If you are upgrading a policy that already has a rule at priority1002, move that rule or setwaf_log4j_priorityto a free slot before applying. Setenable_waf_log4j = falseto opt out of the rule entirely.
Requirements
| Requirement | Version |
|---|---|
| Terraform / OpenTofu | >= 1.6 |
hashicorp/google | >= 7.0, < 8.0 |
The Compute Engine API (compute.googleapis.com) must be enabled in the
project.
License
Commercial — IaC Bazaar EULA. © IaC Bazaar. Original work (not derived from a third-party module).
Usage code & full reference unlock after purchase
The complete copy-paste usage, the full input/output reference, and operational notes ship with your licence - shown here and bundled in the download.
- Usage
- Inputs
- Outputs