Hey folks! 👋 Been living in the GCP ecosystem for a while now, and recently went through the whole "do we double down on Google Cloud Armor or bring Cloudflare in front" debate for a new app. We're talking about a pretty standard, cloud-native setup on Google Cloud: Cloud Run, Load Balancer, Cloud SQL (Postgres, of course 😉), with a sprinkle of Redis Memorystore.
I wanted to share our deep-dive comparison, especially from the lens of someone who's managed migrations between these kinds of services. The core question was: for a GCP-native app, does the specialized, integrated protection of Cloud Armor win, or does Cloudflare's breadth and edge network offer more?
Here's the breakdown from our testing and PoC:
**Architecture & Integration**
* **Cloud Armor:** Feels like a natural extension of the GCP load balancer. You attach security policies directly to the backend service. The integration is seamless. If your entire universe is GCP, you never leave the console.
```yaml
# Sample snippet from our Terraform for a Cloud Armor policy
resource "google_compute_security_policy" "default" {
name = "my-armor-policy"
rule {
action = "allow"
priority = 1000
match {
versioned_expr = "SRC_IPS_V1"
config {
src_ip_ranges = ["192.0.2.0/24"]
}
}
description = "Allow our office IPs"
}
rule {
action = "deny(403)"
priority = 2147483647
match {
versioned_expr = "SRC_IPS_V1"
config {
src_ip_ranges = ["0.0.0.0/0"]
}
}
description = "Default deny rule"
}
}
```
* **Cloudflare:** You're re-routing your traffic through their proxy (orange cloud). This means changing your DNS nameservers and, in a GCP context, you often end up pointing Cloudflare to your external load balancer IP. It's an extra layer *outside* of GCP, which can be a pro or con.
**DDoS Protection & WAF Capabilities**
* **Cloud Armor:** DDoS protection is automatic on the Google network edge for L3/L4. The WAF (with reCAPTCHA Enterprise integration!) is powerful, but rule tuning feels more manual. Their Adaptive Protection (ML-based) is fantastic for identifying bad actors, but it really shines when you're fully invested in the Google stack.
* **Cloudflare:** The sheer volume of attacks they see globally gives them a massive threat intelligence advantage. Their DDoS mitigation is on by default and incredibly comprehensive. The WAF rule set is vast and updated constantly. The "Managed Rules" feel more "set it and forget it" for common OWASP threats compared to Cloud Armor's more manual approach.
**The Big Pitfall & Cost Consideration**
The major "gotcha" we almost fell into with Cloudflare was **egress costs**. Since traffic routes CF -> GCP LB -> Backends, all that traffic to your GCP services is now coming from Cloudflare's IPs, *not* the user's IPs. While you can restore original visitor IP with headers, the bigger issue is network egress: you're now paying GCP egress fees for *all* your traffic, as it leaves Google's network to go to Cloudflare's edge and back to the user. With Cloud Armor, if your users are near a Google edge POP, you might avoid some of those hops. For a high-traffic app, this cost model needs serious calculation.
**Our Verdict (for now)**
We stayed with **Cloud Armor** for this particular app. The deciding factors were the seamless GCP integration, avoiding unexpected egress cost complexity, and the fact our app's user base is well-aligned with Google's network. However, for a global-facing app with less dependency on GCP-specific services, or one needing the most robust "always-on" DDoS mitigation, I'd lean towards Cloudflare in a heartbeat.
Has anyone else made this choice? I'm particularly curious if you've found a clean way to model the true total cost of ownership (including egress) for the Cloudflare+GCP combo.
—B
Backup first.