You need to protect your GKE-hosted AI inference service from common web attacks and SQL injection, while also implementing rate limiting to prevent…

Google Cloud Armor is a Web Application Firewall (WAF) and DDoS mitigation service that operates at the edge of Google's network. It is the appropriate service for this scenario because it is specifically designed to protect applications from Layer 7 attacks. Cloud Armor's pre-configured WAF rules can detect and block common web attacks, including SQL injection and cross-site scripting (XSS). Furthermore, its security policies include advanced rate limiting capabilities, allowing you to control the number of requests from specific clients to prevent abuse and ensure service availability. It integrates directly with Google Cloud Load Balancing, which is used to expose GKE services.

A. Cloud Firewall: Cloud Firewall rules operate at Layer 4 (TCP/UDP) of the network stack. They cannot inspect application-layer (Layer 7) traffic to detect threats like SQL injection.

B. VPC Service Controls: This service creates a security perimeter to prevent data exfiltration from Google-managed services (e.g., BigQuery, Cloud Storage). It does not provide WAF or rate-limiting capabilities for GKE applications.

C. Identity-Aware Proxy (IAP): IAP is an identity-based access control service that enforces access policies for applications. Its primary function is authentication and authorization, not inspecting traffic for web attacks or providing rate limiting.

1. Google Cloud Documentation - Google Cloud Armor overview: "Google Cloud Armor security policies protect your application by providing Layer 7 filtering and by scrubbing incoming requests for common web attacks or other Layer 7 attributes... You can configure security policies with preconfigured WAF rules to help protect against attacks like cross-site scripting (XSS) and SQL injection (SQLi)."

Source: Google Cloud Documentation, "Google Cloud Armor overview", Section: "How Google Cloud Armor security policies work".

2. Google Cloud Documentation - Rate limiting overview: "Rate limiting is a feature of Google Cloud Armor that lets you throttle traffic to your backend services... This capability helps you protect your applications from a large volume of requests that might overwhelm your applications or consume a disproportionate share of resources."

Source: Google Cloud Documentation, "Rate limiting overview", First paragraph.

3. Google Cloud Documentation - VPC firewall rules: "VPC firewall rules let you allow or deny traffic to and from your virtual machine (VM) instances... VPC firewall rules are stateful. They operate at the network and transport layers."

Source: Google Cloud Documentation, "VPC firewall rules", Section: "Specifications".

4. Google Cloud Documentation - Identity-Aware Proxy overview: "Identity-Aware Proxy (IAP) lets you manage access to your applications... IAP works by verifying a user's identity and the context of their request to determine if they should be allowed to access an application."

Source: Google Cloud Documentation, "Identity-Aware Proxy overview", First paragraph.