# Google Cloud Armor

Canonical: https://inetgeek.com/waf/google-cloud-armor/

Google Cloud's web application firewall and DDoS protection, billed per policy-hour, per rule-hour and per million requests.

## Who it suits

Google Cloud workloads needing a documented availability commitment: 99.99% for globally-scoped security policies, at the same $5 per policy and $1 per rule AWS charges.

Consider something else if Your policies are regional. The SLA drops to 99.9% for regionally-scoped backend policies, so the commitment depends on an architecture choice rather than on the tier you bought — and the Enterprise tiers that bundle request volume carry a one-year commitment.

## iScore

67 / 100 (80% interval 63–71), rank 3 of 4 in waf — interval overlaps the next rank, so this is an ordering, not a finding.

inetGeek's own reading, computed from sourced facts against category peers by disclosed rules. Not a provider claim. Intervals are 80%; a provider with few documented facts is pulled toward the category middle rather than scored on what little is known.
Method: https://inetgeek.com/iscore/. Full output with every criterion's basis: https://inetgeek.com/scores.json. Every waf peer ranked: https://inetgeek.com/waf/google-cloud-armor/alternatives/

- Price: 69 (62–75), weight 50%, 0 of 2 criteria scored; scored for peers, not here — undocumented or stated without a number or a yes/limited/no: free_tier, minimum_paid_price
- Trust and compliance: 47 (39–54), weight 30%, 1 of 2 criteria scored; scored for peers, not here — undocumented or stated without a number or a yes/limited/no: pci_dss
- Evidence: 92 (92–92), weight 20%, 4 of 4 criteria scored

## What the documentation says

### Pricing

- Entry paid plan: $0.006849315 per security-policy hour on the Standard tier — $5 a month — plus $0.001369863 per rule-hour, which is $1 a month. The hourly figures carry nine decimal places because they are a monthly price divided by 730. ([source](https://cloud.google.com/armor/pricing), read 2026-09-15)
- Pricing model: Per policy-hour, per rule-hour and per million requests on the Standard tier, with the two Enterprise tiers replacing all three with "All included" and a data processing fee instead. Enterprise Annual carries a one-year time commitment where Standard carries none. Bot management is billed separately under reCAPTCHA pricing. ([source](https://cloud.google.com/armor/pricing), read 2026-09-15)

### Infrastructure

- Uptime SLA: 99.99% for globally-scoped security policies and 99.9% for regionally-scoped backend policies. The commitment depends on how the policy is scoped rather than on what you pay, which is unusual — every other SLA in this corpus is bought with a tier. ([source](https://cloud.google.com/armor/sla), read 2026-09-15)

### Inference

- Rate limits: $0.60 per million requests against regionally scoped security policies on Standard. The Enterprise tiers include request volume rather than metering it, so the per-request charge disappears at the point the commitment appears. ([source](https://cloud.google.com/armor/pricing), read 2026-09-15)

## Compared with

- [Google Cloud Armor vs AWS WAF](https://inetgeek.com/compare/aws-waf-vs-google-cloud-armor/)
- [Google Cloud Armor vs Cloudflare WAF](https://inetgeek.com/compare/google-cloud-armor-vs-cloudflare-waf/)
- [Google Cloud Armor vs Sucuri](https://inetgeek.com/compare/google-cloud-armor-vs-sucuri/)