Skip to content
SPECIFICTION
Get listed

Google Cloud Firewall Policies

cloud.google.com

From $0.02/mo Free plan WebAPI
Visit cloud.google.com
Spec score 8.0 #6 of 29 in Firewall Management Software

What it is

Google Cloud Firewall Policies provide hierarchical firewall rules for organizations that need to apply controls across an organization or selected folders. Rules can allow or deny connections, or pass evaluation onward to lower-level policies or VPC firewall rules. A hierarchical policy becomes active only when associated with an organization or folder; it cannot be assigned directly to a project. Rules can target VPC networks and VM service accounts, but not instance tags. When configured with a security profile group, matching traffic can be sent through a firewall endpoint for Layer 7 inspection, including URL filtering and intrusion detection and prevention. Administrators can manage policies in the Google Cloud console or with gcloud CLI; Google also documents Terraform support for rules with logging enabled. Logs are available in Cloud Logging and can be exported to its supported destinations. Identity and Access Management roles govern policy permissions. Essentials rules based on standard network attributes are free; hierarchical policy charges are listed per covered VM and depend on rule-attribute count.

Spec sheet

Purpose
Hierarchical firewall policies let organizations enforce consistent firewall rules across an organization or individual folders.Read 7 Oct 2026 · docs.cloud.google.com
Intended users
The product is designed for organization-wide administrators who need to manage critical firewall rules centrally across folders and their resources.Read 7 Oct 2026 · docs.cloud.google.com
Compliance
Google Cloud states that its services undergo independent verification and achieve security, privacy, and compliance certifications; the Google Cloud Services ISMS has ISO/IEC 27001 certification.Read 7 Oct 2026 · cloud.google.com
Layer 7 inspection
Hierarchical rules can use a security profile group to send matching traffic through a firewall endpoint for Layer 7 inspection, including URL filtering and intrusion detection and prevention.Read 7 Oct 2026 · docs.cloud.google.com
Logging
Firewall policy logs can be viewed in Cloud Logging and exported to destinations supported by Cloud Logging export.Read 7 Oct 2026 · docs.cloud.google.com
Logging limit
Firewall policy rules logging records only TCP and UDP connections, and existing connections might not produce entries until idle for at least 10 minutes.Read 7 Oct 2026 · docs.cloud.google.com
Management tools
Google documents management through the Google Cloud console and gcloud CLI, and documents a Terraform resource for firewall policy rules with logging enabled.Read 7 Oct 2026 · docs.cloud.google.com
Other limits
Hierarchical firewall policies do not support VPC networks using an RDMA network profile, and an individual rule can include IPv4 or IPv6 ranges but not both.Read 7 Oct 2026 · docs.cloud.google.com
Policy attachment
A policy is enforced only after it is associated with an organization or folder, and hierarchical policies cannot be assigned directly to projects.Read 7 Oct 2026 · docs.cloud.google.com
Rule evaluation
Rules can allow or deny connections or use the goto_next action to delegate evaluation to lower-level policies or VPC firewall rules.Read 7 Oct 2026 · docs.cloud.google.com
Rule updates
Hierarchical policy rules are updated individually, and the documentation says there is no mechanism to batch update rules in a policy.Read 7 Oct 2026 · docs.cloud.google.com
Security controls
Identity and Access Management roles govern who can create, associate, modify, delete, and view effective hierarchical firewall policies and rules.Read 7 Oct 2026 · docs.cloud.google.com
Targeting
Rules can target VPC networks and VM service accounts, but hierarchical firewall policies do not support targeting by instance tags.Read 7 Oct 2026 · docs.cloud.google.com

Plans and prices

Cloud NGFW Essentials Free No charge for Essentials rules. Rules based on standard network attributes, including IP ranges, ports, and protocols Read 7 Oct 2026 · cloud.google.com
Hierarchical firewall policies (500 or fewer attributes) Free $0.001369863 / 1 hour per VM covered by the policy. Price calculated per VM per month · 500 or fewer rule attributes · no charge if policy applies to no VMs Read 7 Oct 2026 · cloud.google.com
Hierarchical firewall policies (501 or more attributes) Free $0.002054795 / 1 hour per VM covered by the policy. Price calculated per VM per month · 501 or more rule attributes · no charge if policy applies to no VMs Read 7 Oct 2026 · cloud.google.com
Cloud NGFW Standard $0.02 a month $0.0193 / 1 gibibyte evaluated; billed for eligible internet ingress and egress traffic. FQDN objects · threat intelligence Read 7 Oct 2026 · cloud.google.com
Cloud NGFW Enterprise $1.75 a month $1.75 / 1 hour per deployed endpoint, plus $0.0193 / 1 gibibyte inspected. Layer 7 IDPS and URL filtering · endpoint deployment charge Read 7 Oct 2026 · cloud.google.com

Every Google Cloud Firewall Policies plan and price →

Strong points and limits

Strong points

  • Rules can allow, deny, or delegate evaluation.
  • Policies can cover organizations or folders.
  • Rules can target VPC networks and VM service accounts.
  • Layer 7 inspection includes URL filtering and intrusion prevention.
  • Policy logs are available in Cloud Logging.

Limits

  • Hierarchical policies cannot attach directly to projects.
  • Rules cannot target instance tags.
  • Logging records only TCP and UDP connections.
  • Policy rules must be updated individually.

Who it suits

It is intended for organization-wide administrators who need centrally managed firewall rules across folders and their resources. It suits teams managing cloud policies through the console, gcloud CLI, or documented Terraform support.

Verdict

Google Cloud Firewall Policies centralize hierarchical firewall controls and provide logging and access management options. The attachment requirements, rule-targeting limits, and per-VM policy pricing should be understood before deployment.

Where Specifiction places it

Alternatives to Google Cloud Firewall PoliciesAll alternatives →