Skip to main content
Load Balancers

Search

GCP external: Global and regional application load balancer integration

© 2024 Cequence Security. All Rights Reserved.

GCP external: Global and regional application load balancer integration

  • Updated on
  • ~ minute read
Download PDF

The Cequence Google Cloud application load balancer (ALB) passive integration enables asynchronous collection and transmission of Google Cloud ALB access logs to the Cequence Unified API Protection (UAP) platform for transaction discovery and security analysis. This integration uses Google Cloud and Terraform automation for scalable, multi-region operation.

API flow

The integration processes traffic as follows:

  1. Downstream clients send API requests through the GCP Application Load Balancer (ALB).
  2. The ALB forwards the requests to the upstream API service.
  3. Transaction data is captured and stored in the form of logs.
  4. The ALB returns the response to the downstream client.
  5. Each request and response transaction is recorded as access logs by the ALB, then streamed to a centralized log bucket via a Log Sink.
  6. Cloud Scheduler triggers a Cloud Function every minute.
  7. The function retrieves newly written logs from the log bucket and forwards them to the Cequence UAP platform for analysis and threat detection.

Prerequisites

  • Google Cloud project
  • Terraform CLI
  • Google Cloud CLI
  • jq
  • IAM credentials with appropriate permissions
  • Service account with required permissions

Service account setup

The account you designate must have the required IAM permissions for the integration to function correctly. You may need additional roles such as Security Admin, Service Account Admin, or Service Usage Consumer, especially when new services require enablement in your project. When using a service account for the integration, assign the same service account to the Cloud Function via the cloud_function_service_account variable. This service account must exist before you apply the Terraform configuration.

The service account needs permissions to read logs and storage objects, send API calls externally, and write to other services if needed.

Cloud scheduler setup

Cloud Scheduler does not directly authenticate to your Cloud Function. Instead, it impersonates the scheduler_invoker service account, which is permitted because the configuration grants roles/iam.serviceAccountTokenCreator. The Cloud Function trusts requests from scheduler_invoker because the configuration grants roles/cloudfunctions.invoker. This configuration creates a secure, private, authenticated invocation with no public exposure. Terraform creates this service account based on the value you provide for var.scheduler_invoker_account_id.

GCP load balancer setup

If you don't already have a load balancer configured, follow these steps. If a load balancer exists, proceed to the installation section.

  1. In the GCP Console, click Create load balancer.
  2. Select the application type (HTTP/HTTPS or UDP/TCP) according to your requirements. Select HTTP/HTTPS Application Load Balancer.
  3. Select Public facing as the load balancer type.
  4. Choose Global or regional deployment as per your requirements.
  5. Select the load balancer generation (Global external or classic application load balancer) and click Next.
  6. Click Configure.

  7. Complete the frontend configuration:

    • Name
    • Description
    • Protocol
    • IPv4 version
    • Port

    Click Done when complete.

  8. Select backend configuration details and choose a valid backend bucket.
  9. Select routing rules (Simple host and path rule or Advanced host and path rule).
  10. Click Create and wait 5–10 minutes for your load balancer setup to complete.

Installation

Download and prepare the integration package

The Cequence UAP platform provides an integration package as a tarball. Download the package and extract its contents.

  1. Download the integration package.
  2. Extract the tarball: tar -xvzf cequence-gcp-alb.tar.gz
  3. Navigate to the scripts directory: cd cequence-gcp-alb/scripts
  4. Make all scripts executable: chmod +x *.sh
  5. Copy the example configuration: cp config.example.jsonc config.jsonc
  6. Edit the configuration file: vi config.jsonc

Configuration parameters

The config.jsonc file contains all settings for your integration deployment. This section describes the key parameters.

Google Cloud Configuration

  • project_id: Your GCP project ID.

Load Balancer Discovery Configuration

  • public_external_load_balancer_type: Set to global or regional.
  • autoDiscoverAllLBsOfThisKind: Set to true to automatically discover all load balancers of the type specified above, or false to manually select load balancers.
  • regionToDeploy: The region where global load balancer resources will be deployed.
  • loadBalancersToProcessManually: An array of load balancers to process manually. Only used when autoDiscoverAllLBsOfThisKind is false. For global load balancers, set region to global. For regional load balancers, set region to the actual region, such as us-east1 or us-west1.

Cequence UAP Platform Integration Details

  • cequence_auth_token_url: The authentication token endpoint.
  • cequence_transaction_endpoint_url: The transaction API endpoint.
  • cequence_client_id: Your client ID.
  • cequence_client_secret: Your client secret.
  • cequence_auth_enabled: Set to true to enable authentication.

Logging Configuration

  • bucket_name_prefix: The prefix for the log bucket name.
  • is_log_managed_externally: Set to false to have the integration manage the log bucket.

Cloud Function Configuration

  • cloud_function_name: The name of the Cloud Function.
  • cloud_function_service_account: The service account for the Cloud Function (must be pre-created).
  • function_storage_bucket_prefix: The prefix for the storage bucket containing function code.

Cloud Scheduler Configuration

  • schedule_frequency: The cron expression for scheduler frequency. Default is every minute (* * * * *).
  • cequence_scheduler_job_name: The name of the scheduler job.
  • scheduler_invoker_account_id: The ID of the scheduler invoker service account.

Log Sink Configuration

  • log_sink_name_prefix: The prefix for the log sink name.

Cequence Processing Configuration

  • cequence_disabled: Set to true to disable function invocation permissions.
  • cequence_log_level: The logging level (INFO, DEBUG, etc.).
  • cequence_batch_size: The number of transactions per batch.
  • cequence_batch_interval_ms: The interval between batches in milliseconds.
  • cequence_fetch_interval_ms: The interval between log fetches in milliseconds.
  • cequence_static_file_extensions: A regex pattern of static file extensions to filter.

Terraform Configuration

  • terraform_auto_approve: Set to true to automatically approve Terraform changes.
  • store_state_file_in_cloud: Set to true to store Terraform state in cloud storage.
  • terraform_remote_state_config: Configuration for remote state storage, including bucket name, prefix, and project.

Sample configuration

The following shows a sample config.jsonc file with typical values:

{
  "project_id": "PROJECT_ID",
  "public_external_load_balancer_type": "global",
  "autoDiscoverAllLBsOfThisKind": false,
  "regionToDeploy": "us-central1",
  "loadBalancersToProcessManually": [
    {
      "name": "backend-url-map-us-east1",
      "region": "global"
    }
  ],
  "cequence_auth_token_url": "https://auth.example.com/auth/realms/example/protocol/openid-connect/token",
  "cequence_transaction_endpoint_url": "https://edge.example.com/api-transactions",
  "cequence_client_id": "test-client-example",
  "cequence_client_secret": "test-example-secret",
  "cequence_auth_enabled": true,
  "bucket_name_prefix": "cequence-cloud-armor-logs",
  "is_log_managed_externally": false,
  "cloud_function_name": "cequence-log-processor",
  "cloud_function_service_account": "id-2345-compute-developer-gser@PROJECT_ID.iam.gserviceaccount.com",
  "function_storage_bucket_prefix": "cf-src",
  "schedule_frequency": "* * * * *",
  "cequence_scheduler_job_name": "cequence-process-armor-logs-job",
  "scheduler_invoker_account_id": "scheduler-invoker",
  "log_sink_name_prefix": "cequence-regional-log-sink",
  "cequence_disabled": false,
  "cequence_log_level": "INFO",
  "cequence_batch_size": "100",
  "cequence_batch_interval_ms": "5000",
  "cequence_fetch_interval_ms": "60000",
  "cequence_static_file_extensions": "/\\.(css|swf|bmp|bin|csv|oga|jsonld|eot|opus|mpkg|xul|tif|midi|ico|ics|jar|3g2|ogv|otf|zip|cda|ogx|rar|7z|tar|png|webp|webm|woff|pptx|mpeg|doc|odp|weba|odt|ods|aac|tiff|gif|vsd|js|mid|arc|avi|sh|epub|bz|jpeg|woff2|bz2|3gp|azw|jpg|xlsx|rtf|svg|ttf|wav|docx|xhtml|mp4|mp3|txt|git|gz|pdf|ppt|abw|mjs|csh|php|xls|ts)$/i",
  "terraform_auto_approve": true,
  "store_state_file_in_cloud": true,
  "terraform_remote_state_config": {
    "bucket_name": "ceq-gcp-terraform-state-lb",
    "prefix": "terraform/state",
    "project": "customer-engineering-test123"
  }
}

Initial deployment steps

Before running the integration, verify your Google Cloud authentication and install dependencies.

Validate Google Cloud authentication

Verify that you are logged in to Google Cloud:

gcloud auth login

This command opens your browser for authentication. Upon successful login, the system displays your authenticated user and current project.

Then run the Application Default Credentials command to authenticate your local development environment:

gcloud auth application-default login

This command opens a browser window for you to log in with your Google account and stores the credentials locally.

Install dependencies

Run the dependency installation script:

./install-dependencies.sh

Enable the integration

From the scripts directory, run the enable script:

./enable_alb_integration.sh

The script validates credentials, required APIs, and configuration before provisioning resources via Terraform and Google Cloud CLI tools. On successful completion, the script outputs resource details including deployed regions, function storage buckets, log bucket names, and scheduler job information.

Disable the integration

To remove all provisioned resources, run the disable script:

cd scripts
./disable_alb_integration.sh

The script removes all Terraform-managed resources and manually removes any remaining resources including log buckets, log sinks, Cloud Functions, Cloud Scheduler jobs, function storage buckets, and service accounts.

Testing

Verify log collection

Send requests to your load balancer endpoint, then wait for the scheduler cycle to complete. The default scheduler cycle time is one minute.

From the Google Cloud Console, monitor the Cloud Function logs to verify that the function processes log data successfully. Check the Cloud Function logs for output similar to this:

DEFAULT 2025-11-11T08:58:08.855946Z [Cequence] [DEBUG] Preparing to send 5 transactions to endpoint: https://cequence-bridge.example.com/api-transactions
DEFAULT 2025-11-11T08:58:08.856230Z [Cequence] [DEBUG] Token is valid and ready for use
DEFAULT 2025-11-11T08:58:08.856489Z [Cequence] [DEBUG] Sending request with payload size: 4767 bytes
DEFAULT 2025-11-11T08:58:09.255789Z [Cequence] [DEBUG] Successfully sent transactions to endpoint, received status code: 200

Verify end-to-end delivery

Send traffic to your load balancer and check the Cloud Function logs for processing events. From the Cequence UAP platform, verify that transactions are reaching the UAP dashboard.

Troubleshooting

Configuration errors

Review config.jsonc for missing or incorrect values. Verify that all required parameters are present and properly formatted.

Missing APIs

Ensure all necessary GCP APIs are enabled, including Cloud Functions, Logging, and Scheduler. Enable these from the GCP Console if needed.

IAM permission issues

Verify that IAM permissions are correct for both the deployment user and the service account. Missing permissions can prevent resource creation or cause runtime failures.

Missing logs

If logs are not appearing, verify connectivity and permissions for log buckets and log sinks. Check that the log sink is properly configured to route ALB logs to the designated bucket.

Cloud logging bucket soft-deletion

When a Cloud Logging bucket is deleted, it enters a 30-day soft-deletion state during which the bucket name cannot be reused, even though it no longer appears in the GCP UI. This can result in a "Bucket already exists" error when re-running the integration.

To resolve this, use a different bucket name by updating the bucket_name_prefix in config.jsonc.

If you re-enable the integration within the 30-day window, the script automatically restores (undeletes) the bucket. After 30 days, the bucket is permanently removed and the name becomes reusable.

Cloud scheduler IAM permission propagation

The Cloud Scheduler triggers a Cloud Function using the cloudfunctions.invoker permission. IAM policy updates typically propagate within seconds but may take 2–5 minutes in rare cases. During this propagation delay, Cloud Scheduler logs may show a "403 PERMISSION_DENIED" error.

The integration applies permissions both via Terraform and via gcloud commands to ensure proper configuration. If the issue persists beyond the propagation time, re-run the integration and update the bucket_name_prefix to avoid conflicts.

Was this article helpful?
Japanese (Japan)