- Home
- Firewall Management Software
- Google Cloud Firewall Policies
Google Cloud Firewall Policies
What it is
Google Cloud Firewall Policies let organizations apply hierarchical firewall rules across an organization or its folders. Rules can allow or deny connections, or pass evaluation to lower-level policies or VPC firewall rules using the goto_next action. A policy takes effect only after it is associated with an organization or folder; it cannot be assigned directly to a project. Rules can target VPC networks and VM service accounts, but not instance tags. With a security profile group, matching traffic can be sent through a firewall endpoint for Layer 7 inspection, including URL filtering and intrusion detection and prevention. Administrators can use the Google Cloud console, gcloud CLI, or documented Terraform resources. Logs are available in Cloud Logging. Identity and Access Management roles govern policy permissions. Essentials rules based on standard network attributes cost nothing. Hierarchical policies are priced per VM covered, while Standard and Enterprise plans list separate traffic and endpoint charges.
For and against
For
- Rules can allow, deny, or delegate evaluation
- Can target VPC networks and VM service accounts
- Layer 7 inspection includes URL filtering and intrusion detection
- Logs available in Cloud Logging
- Essentials rules cost nothing
Against
- Cannot assign hierarchical policies directly to projects
- Instance tags are not supported as rule targets
- Rule updates cannot be batched
- Logging covers TCP and UDP connections only
The verdict
Google Cloud Firewall Policies provide centralized hierarchical controls with several management and logging options. Buyers should account for attachment requirements, targeting limits, and per-VM policy charges where applicable.
Who it suits
The policies are intended for organization-wide administrators who need centralized firewall rules across folders and their resources. They may suit teams managing cloud firewall policies through the console, command line, or Terraform.
Plans and prices
Cloud NGFW Essentials
Rules based on standard network attributes, including IP ranges, ports, and protocols
Read 7 Oct 2026 · cloud.google.com
Hierarchical firewall policies (500 or fewer attributes)
Price calculated per VM per month · 500 or fewer rule attributes · no charge if policy applies to no VMs
Read 7 Oct 2026 · cloud.google.com
Hierarchical firewall policies (501 or more attributes)
Price calculated per VM per month · 501 or more rule attributes · no charge if policy applies to no VMs
Read 7 Oct 2026 · cloud.google.com
Cloud NGFW Standard
FQDN objects · threat intelligence
Read 7 Oct 2026 · cloud.google.com
Cloud NGFW Enterprise
Layer 7 IDPS and URL filtering · endpoint deployment charge
Read 7 Oct 2026 · cloud.google.com
On the record
- Compliance
- Google Cloud states that its services undergo independent verification and achieve security, privacy, and compliance certifications; the Google Cloud Services ISMS has ISO/IEC 27001 certification.cloud.google.com · read 7 Oct 2026
- Intended users
- The product is designed for organization-wide administrators who need to manage critical firewall rules centrally across folders and their resources.docs.cloud.google.com · read 7 Oct 2026
- Layer 7 inspection
- Hierarchical rules can use a security profile group to send matching traffic through a firewall endpoint for Layer 7 inspection, including URL filtering and intrusion detection and prevention.docs.cloud.google.com · read 7 Oct 2026
- Logging
- Firewall policy logs can be viewed in Cloud Logging and exported to destinations supported by Cloud Logging export.docs.cloud.google.com · read 7 Oct 2026
- Logging limit
- Firewall policy rules logging records only TCP and UDP connections, and existing connections might not produce entries until idle for at least 10 minutes.docs.cloud.google.com · read 7 Oct 2026
- Management tools
- Google documents management through the Google Cloud console and gcloud CLI, and documents a Terraform resource for firewall policy rules with logging enabled.docs.cloud.google.com · read 7 Oct 2026
- Other limits
- Hierarchical firewall policies do not support VPC networks using an RDMA network profile, and an individual rule can include IPv4 or IPv6 ranges but not both.docs.cloud.google.com · read 7 Oct 2026
- Policy attachment
- A policy is enforced only after it is associated with an organization or folder, and hierarchical policies cannot be assigned directly to projects.docs.cloud.google.com · read 7 Oct 2026
- Purpose
- Hierarchical firewall policies let organizations enforce consistent firewall rules across an organization or individual folders.docs.cloud.google.com · read 7 Oct 2026
- Rule evaluation
- Rules can allow or deny connections or use the goto_next action to delegate evaluation to lower-level policies or VPC firewall rules.docs.cloud.google.com · read 7 Oct 2026
- Rule updates
- Hierarchical policy rules are updated individually, and the documentation says there is no mechanism to batch update rules in a policy.docs.cloud.google.com · read 7 Oct 2026
- Security controls
- Identity and Access Management roles govern who can create, associate, modify, delete, and view effective hierarchical firewall policies and rules.docs.cloud.google.com · read 7 Oct 2026
- Targeting
- Rules can target VPC networks and VM service accounts, but hierarchical firewall policies do not support targeting by instance tags.docs.cloud.google.com · read 7 Oct 2026
