Question

An e-commerce company runs a public web application behind a global external Application Load Balancer protected by Google Cloud Armor. During flash sales, individual clients sometimes send bursts of requests to the /api/checkout path, degrading the backend for everyone. The security team wants to allow legitimate traffic to continue but automatically throttle any single client IP that exceeds 100 requests per minute to that path, without permanently blocking the client. Which Cloud Armor configuration meets this requirement?

Accepted Answer

Create a throttle rule with rate_limit_options specifying a count of 100 per 60-second interval and enforce_on_key set to IP, matching requests to /api/checkout.

Answer

Create a rate-based ban rule with action 'deny(429)' that permanently blocks clients exceeding the threshold.

Answer

Enable Adaptive Protection on the security policy so it automatically learns and mitigates the traffic burst.

Answer

Configure Cloud NAT with a reduced minimum ports-per-VM setting to limit the number of concurrent client connections.