Cloud Compare / Cloud Armor, AWS WAF and Azure WAF

Cloud Armor, AWS WAF and Azure WAF

Google Cloud Armor and its AWS and Azure equivalents: where each attaches, features, DDoS tiers, pricing, and moving rules between them.

Google Cloud Armor combines a web application firewall (WAF) with DDoS protection for anything behind a Google Cloud load balancer. AWS and Azure split the same job across two services each: a WAF service and a DDoS service. This page maps Cloud Armor to its equivalents, feature by feature, and shows what changes when you move rules between them.

The short answer

Where each one attaches

A WAF only sees traffic that passes through the service it's attached to, so the first design question is the same in every cloud: what's the entry point?

Feature by feature

DDoS tiers compared

Pricing at a glance

US list prices for the WAF layer only, as of October 2026. All three charge for policies, rules and requests in some form; check each provider's calculator before deciding.

The same rule in each cloud

A rate limit of 100 requests per minute per client IP, blocking the excess, is a good way to see how the three models differ.

Cloud Armor (a throttle rule on the policy):

gcloud compute security-policies rules create 2000 --security-policy=sp-web-notes-test `
    --expression="true" --action=throttle `
    --rate-limit-threshold-count=100 --rate-limit-threshold-interval-sec=60 `
    --conform-action=allow --exceed-action=deny-429 --enforce-on-key=IP

AWS WAF (a rate-based rule in the web ACL's JSON):

{
  "Name": "rate-100-per-minute",
  "Priority": 20,
  "Statement": { "RateBasedStatement": { "Limit": 100, "EvaluationWindowSec": 60, "AggregateKeyType": "IP" } },
  "Action": { "Block": {} },
  "VisibilityConfig": { "SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": "rate100" }
}

Azure WAF on Application Gateway (a custom rule in the WAF policy; rate limit rules need a match condition, here "any client outside the internal range"):

{
  "name": "RateLimit100",
  "priority": 20,
  "ruleType": "RateLimitRule",
  "rateLimitDuration": "OneMin",
  "rateLimitThreshold": 100,
  "groupByUserSession": [ { "groupByVariables": [ { "variableName": "ClientAddr" } ] } ],
  "matchConditions": [ { "matchVariables": [ { "variableName": "RemoteAddr" } ],
                         "operator": "IPMatch", "negationConditon": true, "matchValues": [ "10.0.0.0/8" ] } ],
  "action": "Block"
}

(Yes, negationConditon is misspelled in Azure's own API. Copy it as it is.)

Moving rules between them

• Managed rules don't translate one to one. All three start from the OWASP Core Rule Set but tune and number rules differently. Map by intent (SQL injection, cross-site scripting, protocol attacks), not by rule ID, and expect a new round of false positives.
• Exclusions move with the application, not the WAF. List the fields your application legitimately sends that look like attacks (rich-text editors, search boxes, JSON APIs) and re-create the exclusions on the new platform.
• Start in observe mode: preview (Cloud Armor), Count (AWS WAF) or Detection (Azure WAF), for at least a week of real traffic, then enforce.
• Lock the origin. Whatever the WAF, make sure traffic can't bypass it: Cloud Armor backends accept only Google front-end ranges; ALBs behind CloudFront accept only CloudFront's managed prefix list; Front Door origins check the X-Azure-FDID header or use Private Link.
• Rate limits behave differently. Window lengths and how clients are counted differ (Cloud Armor and AWS WAF can key on headers or cookies; Azure groups by client address or geo). Re-test thresholds with real traffic rather than copying numbers.

Which to choose when

• Workload in one cloud: use that cloud's WAF. They're integrated with the load balancer, logging and identity, and none is clearly better at blocking common attacks once tuned.
• Need bots and fraud handled in the WAF: AWS WAF has the broadest built-in options (Bot Control, Fraud Control); Cloud Armor relies on reCAPTCHA; Azure's Bot Manager covers bot categories but not account takeover.
• Global site, one entry point: Cloud Armor on a global load balancer, AWS WAF on CloudFront, or Azure WAF on Front Door Premium are the equivalent designs.
• Multi-cloud or very large traffic: a third-party edge WAF and CDN in front of all three gives one rule set and one set of logs, at the cost of another vendor.

Compared as of October 2026. Service names, tiers and prices change; check the provider's documentation before deciding.