Google Cloud Armor Pricing 2026: Standard vs Enterprise, Per-Policy, Per-Rule, Per-Request
Cloud Armor is Google Cloud's WAF and DDoS service. Standard tier publishes per-policy, per-rule, and per-request rates that match AWS WAF on structure but charge slightly more per million requests at $0.75 (global) or $0.60 (regional). Enterprise ships Adaptive Protection (ML detection) and bundles up to 100 protected resources at $3,000 per month annual.
Last verified June 2026
What it costs
Google Cloud Armor prices on a standard (per policy + per rule + per request) or enterprise subscription basis. The cheapest published entry point is $5.00 per policy per month (Standard). Full tier list below, taken from the live vendor pricing page.
- Tier 1Standard global$5 per policy per month + $1 per rule per month + $0.75 per million requests
- Tier 2Standard regional$5 per policy per month + $1 per rule per month + $0.60 per million requests
- Tier 3Enterprise Paygo$200 per month, includes up to 2 protected resources
- Tier 4Enterprise Annual$3,000 per month, includes up to 100 protected resources
- Tier 5Adaptive ProtectionIncluded with Enterprise tiers
What this vendor is best for
GCP-hosted apps fronted by Global External HTTPS Load Balancer who want WAF, DDoS and adaptive ML in one bill.
- GCP-hosted apps fronted by the Global External HTTPS Load Balancer.
- Teams that want WAF + Layer 3/4/7 DDoS + adaptive ML in one bill.
- Buyers happy to start on Standard (per-resource) and migrate to Enterprise Annual at 10+ protected resources.
- Anyone needing Adaptive Protection's ML-driven attack-pattern detection without negotiating an enterprise contract.
Hidden costs to watch
- Enterprise Paygo at $200/mo covers 2 protected resources only; the third resource pushes you into Enterprise Annual at $3,000/mo.
- Adaptive Protection only ships with Enterprise tiers; Standard does not include ML detection.
- Cloud Logging ingestion of Cloud Armor logs carries the standard Cloud Logging per-GB rate.
- reCAPTCHA Enterprise for credential-stuffing protection is a separate SKU with its own per-assessment fee.
- Cross-region egress from the Global External HTTPS Load Balancer is billed by Google Cloud networking, not the WAF SKU.
Worked example at 100M requests per month, Standard tier
Cloud Armor Standard global, one policy, 10 custom rules, 100M requests per month. Illustrative example, not a real company.
- 1.Policy base fee$5.00
- 2.10 custom rules at $1.00 each$10.00
- 3.100M requests at $0.75 / million (global)$75.00
- 4.Preconfigured WAF rules (OWASP CRS)$0.00
- 5.Adaptive Protection (Standard, not included)$0.00
Standard vs Enterprise tier
Standard tier is the right pick for one or two protected resources where ML detection is not required. Enterprise Paygo at $200 per month covers up to 2 resources and ships Adaptive Protection. Enterprise Annual at $3,000 per month covers up to 100 resources. Past 10 resources Annual is mathematically cheaper than per-resource Standard, before the ML benefit.
Source
Every number on this page is taken from https://cloud.google.com/armor/pricing, retrieved 2026-06-19. Re-check before signing a contract; vendors change pricing without notice.