GCP Firewall Rules for Classic Application Load Balancer

Question

I have a cloud storage bucket which is hosted a static website on it. I configured a classic Application Load Balancer and the bucket as a the backend, URL and SSL certificate all configured properly and now it's open to the public internet. I have few buckets like this. Now I want to restrict one bucket access from the internet and allow from a specific ip only to access it. How I can create this firewall rule and attach it to the load balancer.

Answer 1

It is not possible to create a firewall rule to restrict access to a Google ALB. Since your buckets are accessed through the LB you cannot restrict access to one of them in this topology.

A roundabout way of doing this might be

• Setup nginx in a VM and add IP based access control to it and add your allowed IPs
• Route the LB requests for the bucket you want to restrict to the nginx VM
• nginx will pass through requests to the bucket for allowed IPs only.

You'll have to run a VM for this solution to work.