Question

Your security team wants to allow a large SaaS partner's published IP ranges to reach your global external Application Load Balancer while blocking all other source IPs. The partner distributes their egress ranges as a curated list that Google maintains and updates automatically. You must implement this in a Cloud Armor security policy with minimal ongoing maintenance and without exceeding rule limits from listing hundreds of individual CIDRs. Which approach should you use?

Accepted Answer

Create a Cloud Armor security-policy rule whose match expression references the partner named IP address list (address-group / named IP list), set the rule action to allow, and add a default deny rule at the lowest priority.

Answer

Add every partner CIDR block as separate allow rules in the Cloud Armor policy and rely on rule priority to deny remaining traffic.

Answer

Configure a VPC firewall rule with the partner CIDRs as source ranges and attach it to the load balancer backend instances.

Answer

Enable Cloud Armor Adaptive Protection so it automatically learns and allowlists the partner's traffic patterns.