GCP Cloud Armor cost: policies, rules, and requests

Quick answer

Cloud Armor standard bills about $5 per policy per month, about $1 per rule per month, and about $0.75 per million requests processed. Managed Protection Plus adds a monthly subscription with bundled DDoS and WAF features. The request charge dominates at scale, so the bill tracks traffic through protected backends.

Cloud Armor provides WAF and DDoS protection in front of Google Cloud load balancers. Its standard pricing has three small components plus an optional managed subscription, and at scale the per-request charge is what matters.

Policies, rules, and requests

Dimension	Rate (approximate)
Security policy	~$5 / month
Rule	~$1 / month
Requests processed	~$0.75 / million

A policy and its rules are a small fixed monthly cost. The request charge scales with traffic through the protected backend, so a high-traffic service pays mostly for requests, not for the handful of rules.

Standard vs Managed Protection Plus

Standard bills the components above as you use them. Managed Protection Plus is a monthly subscription that bundles advanced DDoS protection, WAF rules, and request processing, with predictable pricing for organizations that want the full feature set across many backends. Choose it when the bundled protection and predictable cost fit; otherwise standard is pay-as-you-go.

Controlling Cloud Armor cost

Keep rule sets lean (each rule is a small monthly fee, and fewer rules also evaluate faster), consolidate policies where backends share protection needs, and remember the request charge follows traffic, so the same caching and CDN that reduce backend load also reduce Cloud Armor request volume, the caching lever again.

FAQ

How is GCP Cloud Armor priced?

Standard Cloud Armor bills about $5 per security policy per month, about $1 per rule per month, and about $0.75 per million requests processed. Managed Protection Plus is a monthly subscription bundling DDoS and WAF features with predictable pricing.

What drives Cloud Armor cost at scale?

The per-request charge. Policies and rules are small fixed monthly fees, but request processing at about $0.75 per million scales with traffic through the protected backend, so high-traffic services pay mostly for requests.

Should I use standard Cloud Armor or Managed Protection Plus?

Use standard, pay-as-you-go pricing for a few backends with modest protection needs. Choose Managed Protection Plus when you want bundled advanced DDoS and WAF protection across many backends with predictable subscription pricing.

How do I reduce Cloud Armor cost?

Keep rule sets lean since each rule is a small monthly fee, consolidate policies where backends share needs, and reduce backend traffic with caching and a CDN, which also reduces the per-request Cloud Armor charge.

Does Cloud Armor charge per rule?

Yes, about $1 per rule per month, on top of about $5 per policy per month. These are small fixed costs; the variable, and usually larger, cost is the per-million-requests charge that scales with traffic.

Does C3X estimate Cloud Armor cost?

C3X prices the google_compute_security_policy resource and its rules from your Terraform, so the policy and rule fees appear before deploy. Request volume depends on traffic, which you provide as a usage assumption.

What to do next

Price your protection before you deploy. C3X reads your Terraform and prices Cloud Armor and the rest of your stack against a live catalog. Start with the quickstart.