Security & Privacy / Web Application Firewall (WAF) Software
Google Cloud Armor Review, Pricing, Pros & Cons
Google Cloud Armor is Google Cloud's edge security service for applying WAF, access-control, rate-limiting, and DDoS protections to supported load-balanced applications, APIs, CDN origins, and selected network endpoints.
Research by Global Tool Radar Research SystemEvidence checked: Aug 12, 2026AI-assisted · No Global Tool Radar hands-on testView research methodology
A compact view of who this tool fits, what it costs, and what to confirm before choosing it.
Best for
Applications can use supported Google Cloud load-balancer or CDN attachment points: Cloud Armor enforces policies at Google's edge and supports Google Cloud, hybrid, and multicloud backends behind supported front ends.
The team wants metered entry or Enterprise controls without a commitment: Standard and Enterprise Paygo retain no-commitment routes, while Enterprise Paygo bundles WAF policy, rule, and request usage.
More buying conditions
The organization needs centrally governed advanced DDoS and WAF operations: Enterprise adds full Adaptive Protection, hierarchical policies, threat intelligence, advanced network DDoS protection, and attack visibility.
Not for
A standalone WAF must protect an origin without Google Cloud load-balancing integration: Preconfigured WAF rules require backend services behind a supported load balancer, and load-balancing limits apply.
The purchase must include full API discovery, schema governance, and security testing: Cloud Armor protects REST, JSON, and GraphQL-over-HTTP traffic with WAF inspection but does not establish a full API security lifecycle.
More buying conditions
The buyer needs one bundled price for WAF, bot assessment, load balancing, CDN, logging, and support: reCAPTCHA and infrastructure services have separate billing, and Enterprise also meters protected-resource overages and outbound data processing.
Pricing
Standard meters security policies, rules, and requests. Enterprise Paygo charges per enrolled project with two protected resources included. Enterprise Annual charges per billing account with 100 protected resources included and a one-year commitment. Enterprise routes also meter protected-resource overages and outbound data processing.
Cloud Armor Enterprise Paygo · $200 USD · per project · per month · Enterprise Paygo project rate · no commitment
Free or trial access
Permanent free plan: none established. Product-specific time-limited trial: none established. Generic Google Cloud credits and try-free calls to action are not Cloud Armor plans or trials.
Product scope
Product functionality and purchase scope
This profile covers the current Google Cloud Armor Standard tier and the Cloud Armor Enterprise Paygo and Annual commercial routes, including WAF policies, rules, request metering, Enterprise features, and exact-product data-processing charges.
Product checked: Aug 12, 2026
Functionality reviewed
Cloud Armor Standard pay-as-you-go tier
Cloud Armor Enterprise Paygo route
Cloud Armor Enterprise Annual route
Backend, edge, network-edge, and hierarchical Cloud Armor security policies where supported
Cloud Armor integrations with supported Google Cloud load balancers, Cloud CDN, Media CDN, GKE, and hybrid or multicloud backends
Non-target functionality excluded from scoring
reCAPTCHA as a separately billed risk-assessment service
Cloud Load Balancing, Cloud CDN, Media CDN, Cloud Logging, Cloud Monitoring, and Security Command Center charges
The wider Google Cloud Network Security portfolio, including Cloud NGFW and Network Security Integration
Generic Google Cloud free credits, trial calls to action, contact-sales routes, and custom procurement
API discovery, API posture management, schema validation, authentication analysis, and API security testing not documented as Cloud Armor capabilities
Pricing plans
Google Cloud Armor pricing table
Pricing checked: Aug 12, 2026
Official factConfidence 99%1 linked source
Standard has no subscription charge but bills each policy, rule, and request unit. Enterprise Paygo is USD 200 per project per month with no commitment and two protected resources included. Enterprise Annual is USD 3000 per billing account per month with a one-year commitment and 100 protected resources included. Enterprise data processing, protected-resource overages, reCAPTCHA, load balancing, and CDN services can add cost.
$0.006849315 USD · per security policy · per hour · Standard security-policy usage · usage based · no commitment
$0.001369863 USD · per rule · per hour · Standard rule usage · usage based · no commitment
$0.75 USD · per 1,000,000 globally scoped requests · per usage unit · Standard global request usage · usage based · no commitment
$0.60 USD · per 1,000,000 regionally scoped requests · per usage unit · Standard regional request usage · usage based · no commitment
Basic Adaptive Protection alerting: Minimal anomaly details without attack signatures or suggested rules; Available without an Enterprise subscription.
Teams that need core Cloud Armor WAF and DDoS controls with granular usage billing and no Enterprise subscription.
$3000 USD · per billing account · per month · Enterprise Annual billing-account rate · one-year commitment
Included protected resources: 100 protected resources; Across enrolled projects under the subscribed billing account before overage.
DDoS response support eligibility: Premium Cloud Customer Care and successful posture review; The attacked workload project must be enrolled in Annual; additional cross-project conditions apply.
Billing accounts needing centralized Enterprise coverage, larger included resource capacity, lower data-processing rates, and Annual-only DDoS services.
Plan upgrade triggers
Verified plan boundaries that can change the required edition.
Cloud Armor Standard → Cloud Armor Enterprise Paygo
Need full Adaptive Protection alerts, advanced network DDoS protection, Google Threat Intelligence, hierarchical policies, or bundled WAF usage without a commitment.
Calculate additional usage only where the plan allowance, unit, and period are established. Published rates are shown separately when an estimate is not available.
Enterprise Paygo protected-resource overage
$200.00 USD / protected resource
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
Enterprise Annual protected-resource overage
$30.00 USD / protected resource
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
Enterprise Paygo load-balancing and Compute data processing through 100 TiB
$0.08 USD / GiB transferred to the internet
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
Enterprise Paygo load-balancing and Compute data processing from 100 TiB through 500 TiB
$0.06 USD / GiB transferred to the internet
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
Enterprise Paygo load-balancing and Compute data processing above 500 TiB
$0.05 USD / GiB transferred to the internet
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
Enterprise Paygo CDN data processing through 100 TiB
$0.04 USD / GiB transferred to the internet
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
Enterprise Paygo CDN data processing from 100 TiB through 500 TiB
$0.03 USD / GiB transferred to the internet
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
Enterprise Paygo CDN data processing from 500 TiB through 1 PiB
$0.03 USD / GiB transferred to the internet
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
Enterprise Paygo CDN data processing above 1 PiB
$0.02 USD / GiB transferred to the internet
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
Enterprise Annual load-balancing and Compute data processing through 100 TiB
$0.05 USD / GiB transferred to the internet
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
Enterprise Annual load-balancing and Compute data processing from 100 TiB through 500 TiB
$0.04 USD / GiB transferred to the internet
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
Enterprise Annual load-balancing and Compute data processing above 500 TiB
$0.03 USD / GiB transferred to the internet
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
Enterprise Annual CDN data processing through 100 TiB
$0.03 USD / GiB transferred to the internet
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
Enterprise Annual CDN data processing from 100 TiB through 500 TiB
$0.02 USD / GiB transferred to the internet
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
Enterprise Annual CDN data processing from 500 TiB through 1 PiB
$0.02 USD / GiB transferred to the internet
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
Enterprise Annual CDN data processing above 1 PiB
$0.01 USD / GiB transferred to the internet
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
This calculation compares usage with the published allowance on the same unit and period basis. It excludes taxes, negotiated terms, and unverified packaging conditions.
What is included, connected, or sold separately
Product scope
What is included, connected, or sold separately
Material capabilities are separated by their verified relationship to the target product.
reCAPTCHA bot risk assessment and token enforcementAdd-on
Cloud Armor evaluates reCAPTCHA tokens and can redirect for assessment, but reCAPTCHA usage is billed separately on every tier.
Network Security console and API administrationNative integration
Cloud Armor appears under the Network Security console and uses Network Security resources for selected features; this is an administrative context, not another Cloud Armor plan.
The score uses the category-specific buying dimensions below and their displayed weights.
This page is based on public product information, official sources, structured feature data, and multi-model AI evaluation. It is not a hands-on lab test unless explicitly stated. Confidence percentages describe our research indicators, not the probability that a claim is true or a measured accuracy rate.
Evidence confidence
85%
AI claim confidence
99%
Required-field evidence status
100%
Evidence freshness
54%
Field traceability
100%
Model agreement
90%
Why this confidence level
Evidence confidence uses source level and claim-to-source support; AI claim confidence is shown separately.
Required-field evidence status measures whether weighted required claims have evidence links; it does not mean every product behavior was independently verified.
8 of 8 weighted claims have evidence links.
8 A1 documentary official sources and 1 A2 official product sources are linked.
2 independent review sources are retained, including 0 professional sources with an explicit hands-on method.
4 weighted claims are past the review window.
No blocking evidence conflict was identified.
Protection efficacy20%
81
Leverages OWASP rules and rate limits to block threats, but does not parse XML request bodies and caps inspection at 64 kB.
Policy accuracy and tuning17%
75
Preconfigured WAF inspection supports request-body parsing for REST, JSON, and GraphQL-over-HTTP, which can improve rule targeting for modern application traffic. The score is reduced because XML body parsing is unsupported and the request-body inspection limit can leave some payloads outside full inspection coverage.
Application and API coverage15%
77
Coverage includes supported load-balanced applications, APIs, CDN origins, and hybrid or multicloud endpoints fronted by Google Cloud load balancing, but any origin without a supported attachment point stays outside the protection path.
Security operations14%
76
Supported response actions include allow, deny, throttle, rate-based ban, redirect, and request decoration with logging and monitoring hooks, while Annual DDoS response support additionally requires Premium Cloud Customer Care, project enrollment, and a successful posture review.
Performance and reliability13%
79
Global edge enforcement and supported policy types support consistent protection delivery across Google Cloud ingress points. The score is tempered because the facts do not establish measurable latency, propagation timing guarantees, or end-to-end reliability SLOs.
Deployment and integrations11%
83
Native integration with supported load balancers, Cloud CDN, Media CDN, GKE, reCAPTCHA, Cloud Logging, Cloud Monitoring, and Security Command Center, plus internet network endpoint groups for hybrid backends, anchors deployment inside Google Cloud architectures.
Support and total cost10%
60
Standard meters each security policy, rule, and request unit with no subscription, Enterprise Paygo charges USD 200 per project per month with two included protected resources and no commitment, and Enterprise Annual charges USD 3000 per billing account per month with a one-year commitment and 100 included protected resources, while reCAPTCHA, Enterprise data-processing, load-balancing, CDN, overages, and Premium Care conditions add further cost components.
Public review signals
Google Cloud Armor earns favorable exact-product ratings
Retained exact-product review profiles are favorable overall. Reviewers commonly value Google Cloud integration, scalable DDoS protection, and straightforward policy deployment; recurring cautions concern pricing complexity, technical setup, documentation, and limits in some application and bot-defense cases.
Public review signals updated: Aug 12, 2026
Commonly reported strengths
Strong integration with Google Cloud load balancing and services
Scalable DDoS protection and traffic controls
Straightforward policy deployment for Google Cloud teams
Commonly reported concerns
Pricing and support costs can be difficult to forecast
Configuration requires Google Cloud networking expertise
Some reviewers report gaps in application-edge cases and bot defense
G24/5
Review count
23 reviews
Source context
Google Cloud Armor on G2Exact product
View sourceHistory baseline established: Aug 12, 2026
Gartner Peer Insights4.4/5
Rating count
63 ratings
Source context
Google Cloud Armor on Gartner Peer InsightsExact product
View sourceHistory baseline established: Aug 12, 2026
Score77Pricing modelStandard meters security policies, rules, and requests. Enterprise Paygo charges per enrolled project with two protected resources included. Enterprise Annual charges per billing account with 100 protected resources included and a one-year commitment. Enterprise routes also meter protected-resource overages and outbound data processing.Use caseprotect load-balanced web applications and APIs with edge WAF, DDoS defense, rate limiting, and adaptive threat controlsCompany sizeEnterprise, Mid-market
Structured tags
Google Cloud Armor tag profile
Company size
Enterprise
Mid-market
Key features
Google Cloud Armor core capabilities
Preconfigured OWASP Core Rule Set protections and custom L3-to-L7 rule language
Allow, deny, throttle, rate-based ban, redirect, and request-decoration actions where supported
Global edge enforcement with supported backend, edge, network-edge, and hierarchical policy types
REST, JSON, and GraphQL-over-HTTP request-body parsing for preconfigured WAF inspection
Adaptive Protection anomaly detection with full signatures and suggested rules on Enterprise
Cloud Logging, Cloud Monitoring, and Security Command Center visibility
Detailed strengths and purchase cautions
Pros
Why it is worth considering
It supports preconfigured OWASP Core Rule Set protections together with custom L3-to-L7 rule language, which lets security teams combine managed inspection with application-specific policy where the plan and attachment point support it.
It offers global edge enforcement and multiple policy types, which supports protection across supported backend, edge, network-edge, and hierarchical policy placements.
It includes Cloud Logging, Cloud Monitoring, and Security Command Center visibility, which can support incident review and operational handoff within the Google Cloud environment.
It has native integrations with reCAPTCHA, Cloud CDN, Media CDN, GKE, and supported load balancers, which can simplify use in Google Cloud-centered architectures.
Cons
What to confirm before buying
Standard receives only basic Adaptive Protection anomaly alerts without attack signatures or suggested rules, so teams needing full Adaptive Protection need Enterprise.
reCAPTCHA assessment is separately billed on every tier, so bot-assessment costs are not bundled into the WAF subscription.
Preconfigured WAF request-body inspection is limited to a configurable maximum of 64 kB and XML body parsing is unsupported, which constrains inspection coverage for some payload types.
Preconfigured WAF rules require supported load-balanced backend services or another documented attachment point, so deployment fit depends on the fronting architecture.
Cross-model buying perspectives
Multi-AI review
Cross-model buying perspectives
Multiple AI models assess this tool against the same buying criteria, so you can compare scores, confidence, fit, cautions, and final views.
AI assessment updated: Sep 22, 2026
Score comparisonGeminiGPTxAIRange
Protection efficacy8283776
Policy accuracy and tuning7876717
Application and API coverage85737412
Security operations8072758
Performance and reliability88787018
Deployment and integrations8581834
Support and total cost70545516
waf attack detection blocking8584787
waf policy tuning control8080764
waf api bot protection fit75716510
waf performance availability90827218
waf event visibility response8074796
Where models differ
Performance and reliability: 70–88 (18-point range)
Google Cloud Armor provides global, edge-enforced security with flexible usage and subscription plans, but deployment is restricted to workloads using supported Google Cloud load-balancer architectures.
Review confidence
82/100
Model details
Strengths
Delivers native global edge enforcement with hierarchical policy controls across supported GKE, CDN, and load balancer configurations.
Allows protection of hybrid and multicloud applications when routed through supported Google Cloud load balancing backends.
Provides granular custom L3-to-L7 rules with support for allow, deny, throttle, rate-based ban, redirect, and request-decoration actions.
Cautions
Limits preconfigured WAF request-body inspection to a maximum of 64 kB and lacks support for XML body parsing.
Requires an Enterprise upgrade to receive full Adaptive Protection signatures and suggested rules, leaving Standard with only minimal anomaly alerts.
Exposes teams to rule propagation times of several minutes and requires careful governance to prevent verbose logs from recording sensitive request data.
GPTAI-assisted buyer perspective76
Google Cloud Armor fits Google Cloud teams that need edge-enforced WAF, rate limiting, DDoS controls, and Google Cloud security integrations on supported load-balanced applications, while accepting that some advanced protections, logging, and bot assessment features are plan- or service-dependent.
Review confidence
76/100
Model details
Strengths
It supports preconfigured OWASP Core Rule Set protections together with custom L3-to-L7 rule language, which lets security teams combine managed inspection with application-specific policy where the plan and attachment point support it.
It offers global edge enforcement and multiple policy types, which supports protection across supported backend, edge, network-edge, and hierarchical policy placements.
It includes Cloud Logging, Cloud Monitoring, and Security Command Center visibility, which can support incident review and operational handoff within the Google Cloud environment.
It has native integrations with reCAPTCHA, Cloud CDN, Media CDN, GKE, and supported load balancers, which can simplify use in Google Cloud-centered architectures.
Cautions
Standard receives only basic Adaptive Protection anomaly alerts without attack signatures or suggested rules, so teams needing full Adaptive Protection need Enterprise.
reCAPTCHA assessment is separately billed on every tier, so bot-assessment costs are not bundled into the WAF subscription.
Preconfigured WAF request-body inspection is limited to a configurable maximum of 64 kB and XML body parsing is unsupported, which constrains inspection coverage for some payload types.
Preconfigured WAF rules require supported load-balanced backend services or another documented attachment point, so deployment fit depends on the fronting architecture.
xAIAI-assisted buyer perspective73
Google Cloud Armor fits teams protecting applications and APIs behind supported Google Cloud load balancers that need edge OWASP rules, rate limiting, and DDoS controls, with Enterprise required for full Adaptive Protection and advanced options, while buyers must plan for load-balancing prerequisites, tiered metering or subscription costs, separate reCAPTCHA billing, and request-body inspection limits.
Review confidence
73/100
Model details
Strengths
Preconfigured OWASP Core Rule Set protections and custom L3-to-L7 rules support allow, deny, throttle, rate-based ban, redirect, and request-decoration actions at the edge for supported load-balanced backends.
Cloud Armor Enterprise adds Adaptive Protection with attack signatures and suggested rules that go beyond the basic anomaly alerts available without an Enterprise subscription.
Native integrations with Cloud Logging, Cloud Monitoring, Security Command Center, supported load balancers, Cloud CDN, Media CDN, GKE, and reCAPTCHA keep enforcement and visibility inside Google Cloud operations.
Hybrid and multicloud applications can be covered when they are exposed through a supported Google Cloud load balancer such as an internet network endpoint group backend.
Cautions
Preconfigured WAF enforcement requires a supported Google Cloud load-balancer backend service or other documented Cloud Armor attachment point, so unprotected origin architectures remain outside scope.
Preconfigured WAF request-body inspection is limited to a configurable maximum of 64 kB and does not support XML body parsing, which can leave larger or XML payloads only partially inspected.
reCAPTCHA bot assessment and token enforcement remain subject to separate reCAPTCHA billing on every tier even when Cloud Armor rules consume tokens or redirect for assessment.
Total cost combines Standard per-policy, per-rule, and per-request meters or Enterprise Paygo and Annual subscriptions with possible protected-resource overages, Enterprise data-processing fees, load-balancing charges, CDN usage, logging, and Premium Care conditions for Annual DDoS response support.
Research transparency
How this page was researched
A compact record of the evidence used, what was not tested, and which conclusions still need verification.
Official sources
9
Broad product review sources
2
Marketplace and app-store sources
0
Editorial sources
0
Latest evidence check
Aug 12, 2026
Research basis
Global Tool Radar generated this assessment from structured facts linked to public sources. No Global Tool Radar hands-on test is recorded in this page's research data. Any external hands-on assessment is identified separately and does not affect the Global Tool Radar score.
Conflict handling
No unresolved evidence conflict is currently recorded.
Verified findingsPermanent free plan: none established. Product-specific time-limited trial: none established. Generic Google Cloud credits and try-free calls to action are not Cloud Armor plans or trials.
Standard meters security policies, rules, and requests. Enterprise Paygo charges per enrolled project with two protected resources included. Enterprise Annual charges per billing account with 100 protected resources included and a one-year commitment. Enterprise routes also meter protected-resource overages and outbound data processing.
Preconfigured OWASP Core Rule Set protections and custom L3-to-L7 rule language
Allow, deny, throttle, rate-based ban, redirect, and request-decoration actions where supported
Global edge enforcement with supported backend, edge, network-edge, and hierarchical policy types
REST, JSON, and GraphQL-over-HTTP request-body parsing for preconfigured WAF inspection
Adaptive Protection anomaly detection with full signatures and suggested rules on Enterprise
Cloud Logging, Cloud Monitoring, and Security Command Center visibility
Native integration with reCAPTCHA, Cloud CDN, Media CDN, GKE, and supported load balancers
USD 0.006849315 per security policy per hour, plus USD 0.001369863 per rule per hour and request charges for Cloud Armor Standard
Standard has no subscription charge but bills each policy, rule, and request unit. Enterprise Paygo is USD 200 per project per month with no commitment and two protected resources included. Enterprise Annual is USD 3000 per billing account per month with a one-year commitment and 100 protected resources included. Enterprise data processing, protected-resource overages, reCAPTCHA, load balancing, and CDN services can add cost.
Verification notes and unresolved itemsCurrent official USD rates were retained only where the exact tier, priced unit, and rate period were visible.
The monthly Enterprise rates come from the current tier comparison
payment timing is not publicly established and was not inferred from the monthly denominator.
Standard hourly policy and rule prices reflect the visible hourly pricing state.
Generic free-credit, try-free, contact-sales, and quote calls to action were excluded. reCAPTCHA, Cloud Load Balancing, CDN, logging, monitoring, support plans, and the broader Network Security portfolio were not treated as Cloud Armor plans.
Are Cloud Armor Standard and Cloud Armor Enterprise separate products?
No. Google documents Standard and Enterprise as two Cloud Armor service tiers. Enterprise has Paygo and Annual commercial routes.
Does Cloud Armor Standard include full Adaptive Protection?
No. Standard receives basic anomaly alerts without attack signatures or suggested rules; full alerts require Cloud Armor Enterprise.
Is reCAPTCHA included in Cloud Armor pricing?
Cloud Armor integrates with reCAPTCHA for bot assessment and token enforcement, but reCAPTCHA usage remains subject to separate reCAPTCHA billing on every tier.
Does Cloud Armor require Cloud CDN?
No. Cloud CDN is an optional native integration. WAF enforcement does require a supported load-balancer backend service or another documented Cloud Armor attachment point.
Is Network Security another Cloud Armor plan?
No. Network Security is a Google Cloud portfolio, console, and API context used by Cloud Armor and other services; it is not a Cloud Armor pricing tier.
Can Cloud Armor protect hybrid or multicloud applications?
Yes, when those applications are exposed through a supported Google Cloud load balancer, such as by using an internet network endpoint group as the backend.
Popular comparisons
Common Google Cloud Armor comparisons
Only high-scoring and nearby tools from the same subcategory are shown, avoiding comparisons between unrelated use cases.