DDOS in Cloud Run

Question

I am currently running two containers on Cloud Run for my web app (React and Nodejs). I have been looking into how to prevent my apps from DDOS. Any suggestion?

Answer 1

1. Most GCP services sit behind Google Front End which mitigates and absorbs many Layer 4 and below attacks, such as SYN floods, IP fragment floods, port exhaustion, etc. I believe it's also the case for Cloud Run but don't have information to confirm that. You can enable HTTP(S) Load Balancing or SSL proxy Load Balancing as it provides this mechanism.

2. Regarding payments due to increased treffic, best way to solve that is to set API rate-limiting and Resource Quotas

3. Google Cloud Armor

4. If possible you should isolate your internal traffic from the external world.

Answer 2

For Cloud Run, you should use a global external HTTP(S) load balancer (classic) which provides automatic multi-tier, multi-layer DoS protections that further reduce the risk of "any DoS impact". In addition, you can use Cloud Armor to control access to your Google Cloud Platform resources by creating security policies and also Cloud Armor provides Layer 3 and 4 DoS attack protections and layer 7 DoS attack protection(Adaptive Protection) and more features(Managed Protection Plus).

*In detail, a global external HTTP(S) load balancer (classic) is based on Google Front End(GFE) which provides automatic multi-tier, multi-layer DoS protections that further reduce the risk of any DoS impact.

Actually, Google doesn't clearly mention which layers of DoS attacks a global external HTTP(S) load balancer (classic) can protect from. Google only says "any DoS impact". I guess "any DoS impact" can be layer 3, 4 and 7 DoS attacks.

I referred to:

Choosing a load balancer

feedbackGoogle Infrastructure Security Design Overview

DDoS protection and mitigation on GCP

Google Cloud Armor