Cloud CDNAuthorCloudBrum editorial teamLast reviewed30 Oct 2026Reading time~12 minLevelBeginner to advanced

• A setting on the load balancerCloud CDN is enabled per backend on an external Application Load Balancer. Requests that hit the cache are served at the edge and never reach the load balancer’s backends, and misses go on to the origin as usual.
• Many kinds of originA Cloud Storage bucket through a backend bucket, instance groups, zonal and serverless network endpoint groups such as Cloud Run, and external servers reached through an internet NEG.
• Three cache modesUSE_ORIGIN_HEADERS caches only what the origin marks as cacheable. CACHE_ALL_STATIC also caches ordinary static content that has no headers. FORCE_CACHE_ALL caches everything successful, including responses that say private.
• A cache key you controlBy default the key includes the protocol, host and full URL. You can drop the protocol or the query string, keep only named parameters, and add headers or cookies on backend services.
• TTLs and stale answersSet a default, a client and a maximum TTL, cache errors briefly with negative caching, and let the edge serve a stale object for a while when the origin is slow or down.
• Signed URLs and cookiesPrivate content can be served from the cache when the request carries a signature made with a key that you hold, with an expiry time. Keys can be rotated without downtime.
• Protection at the edgeCloud Armor security policies sit in front of cached and uncached traffic alike. The load balancer terminates TLS with Google-managed or your own certificates.
• Media CDN for the heavy casesCloud CDN suits websites and APIs. Media CDN is the separate product, on YouTube’s delivery infrastructure, for very large streaming and download workloads.

External Application Load Balancer

Google’s layer 7 load balancer with a single global address. Cloud CDN is an option on its backends.

Backend service and backend bucket

A backend service points at servers (instance groups or endpoint groups). A backend bucket points at a Cloud Storage bucket. Either can have Cloud CDN switched on.

Cache mode

Decides what Cloud CDN caches: only what the origin marks cacheable, also plain static content, or everything successful.

Cache key

What makes two requests the same cached object: protocol, host, path and, optionally, query string parameters, headers and cookies.

TTL (default, client, max)

The default TTL applies when the origin sends none. The client TTL caps what browsers are told. The maximum TTL caps how long the edge keeps an object, whatever the origin says.

Negative caching

Caches error responses such as 404 for a short time, so a missing file doesn’t hit the origin on every request.

Serve while stale

Lets the edge return an expired object for a set time while it refreshes it from the origin.

Invalidation

A request that removes a path or a path prefix from all caches. It takes a few minutes and is meant for exceptions.

Signed URL and signed cookie

A request carrying an expiry, a key name and a signature that Cloud CDN checks against the keys on the backend.

Internet NEG

A group that points to an external host name, so Cloud CDN and the load balancer can front a server outside Google Cloud.

Cache fill

The traffic from the origin into the cache when an object isn’t there yet. It is billed separately from cache egress.

Custom response headers

Headers the load balancer adds to responses, including variables such as the cache status, which makes caching visible to testers.

Media CDN

A separate Google Cloud product for large-scale video and downloads, with its own configuration and pricing.

Serve a static site from a bucket through Cloud CDN with gcloud

1. Check that Cloud CDN fitsIt needs an external Application Load Balancer in front of the backend, so the site pays for the load balancer too. Plain TCP traffic or very large video are better served elsewhere.
2. Put the files in a bucketCreate a bucket near your users, upload the site, and set a sensible Cache-Control header on the objects. Public content must be readable by the load balancer’s path.
3. Create a backend bucket with CDN onPick a cache mode, set the default, client and maximum TTL, and turn on negative caching.
4. Build the load balancerReserve a global address, create a URL map, a Google-managed certificate for your domain, an HTTPS proxy and a forwarding rule.
5. Point DNS at the addressAdd an A record for your domain. The managed certificate becomes active once DNS points at the address, which can take a while.
6. Make caching visibleAdd a custom response header with the cache status variable, so you can see hit and miss in a browser or with curl.
7. Version your filesPut a hash in file names, so a release needs no invalidation. Invalidate only entry pages.
8. Protect and tuneAttach a Cloud Armor policy, review the cache key, and consider signed URLs for private content.
9. Watch the hit ratio and the billUse the load balancer logs and metrics to see cache hits, and review cache egress, cache fill and lookup charges.

• Set long TTLs on hashed assets and short ones on HTML, so most requests are answered at the edge.
• Keep the cache key small: drop the protocol and the query string unless they change the response.
• Use CACHE_ALL_STATIC for sites whose origin doesn’t send good headers, and fix the headers when you can.
• Turn on compression at the origin or load balancer for text, so responses are smaller.
• Use serve while stale and negative caching to absorb origin slowness and repeated misses.
• Place the origin near most users, since the first fetch for each edge location travels to it.
• Use HTTP/3 and TLS 1.3 on the load balancer, which clients negotiate automatically.
• Warm up important pages after a release by requesting them once, rather than letting the first visitors take the miss.

FinOps is the habit of managing cloud spend together with engineering. These are the FinOps checks that matter most for Cloud CDN.

• Raise the cache hit ratio: cache egress is cheaper than the load balancer’s data processing, and fills are paid once per object.
• Compress responses and size images, since cache egress is billed per GiB.
• Use versioned file names instead of invalidations.
• Reduce cache lookups by combining small files and removing needless requests, such as repeated polls.
• Keep forwarding rules to what you need, since each one has an hourly charge.
• Choose the region of the bucket and origin with care, because cache fill follows origin location.
• Use Cloud Armor rate limits to stop abusive traffic that would raise egress.
• Check whether Media CDN is cheaper for very large download or streaming workloads.
• Review logs for requests that can never be cached, and fix or move them.
• Add a budget alert and review the SKUs on the invoice every month.

• Use signed URLs or cookies for private content, short expiry times and rotated keys kept in Secret Manager.
• Keep buckets private where you can, and give the Cloud CDN service account read access instead of making objects public.
• Attach Cloud Armor policies for rate limits, geographic rules and managed protection.
• Terminate TLS on the load balancer with a modern SSL policy and a minimum TLS version.
• Allow only the load balancer and health check ranges to reach backends.
• Use FORCE_CACHE_ALL only for content that is the same for every visitor.
• Turn on request logging for the load balancer and send logs to a restricted bucket or Log Analytics.
• Restrict who can change load balancers, backends and cache settings with IAM, and alert on changes.
• Redirect HTTP to HTTPS with a separate front end on port 80.
• Review Security Command Center findings for the project and its load balancers.

Cloud Audit Logs record who changed load balancers and backends, Cloud Asset Inventory keeps the configuration history, Security Command Center reports posture, and Google’s compliance reports manager holds certifications. Google runs the edge and the load balancer. Cache settings, signing keys, origin protection and what is cached are yours.

• A higher cache hit ratio keeps cache fill and origin load down.
• Compress text responses and export images at the size they are shown.
• Use modern formats and HTTP/3 to cut transfer.
• Remove unused load balancers, backends and forwarding rules.
• Choose a Google Cloud region marked as low carbon for the origins, if data rules and latency allow it.
• Google’s Carbon Footprint report is per project and service group, so quote no Cloud CDN-only figure.

Purchase options

What you actually pay for

• Cache egress to visitors, by destination region
• Cache fill from the origin
• Cache lookup requests, and invalidations beyond any free allowance
• Forwarding rules and data processing on the load balancer
• Cloud Armor policies, rules and requests, if you attach one

A static site: a Cloud Storage bucket, a backend bucket with Cloud CDN, cache mode, TTLs and a cache status header, and the load balancer in front of it, with a Google-managed certificate. The CLI tab builds it, adds a signing key and invalidates a path; Terraform describes the same resources. The Python tab signs a URL with a key and invalidates a path through the Compute API, and the C# tab audits backends for FORCE_CACHE_ALL, wide cache keys and CDN switched off. Replace the project, domain and names with your own.

# Placeholders: replace the project and the domain with your own. The domain's DNS must point at the address created below.
PROJECT=my-project-id
BUCKET=$PROJECT-static-site
DOMAIN=static.example.com

# 1. A bucket for the site, readable by everyone, with one page. Cache-Control tells the edge and browsers how long to keep it.
gcloud storage buckets create gs://$BUCKET --project $PROJECT --location asia-south1 --uniform-bucket-level-access
gcloud storage buckets add-iam-policy-binding gs://$BUCKET --member allUsers --role roles/storage.objectViewer
echo '<h1>Hello from the edge</h1>' > index.html
gcloud storage cp index.html gs://$BUCKET/index.html --cache-control "public, max-age=300"

# 2. A backend bucket with Cloud CDN switched on. CACHE_ALL_STATIC also caches plain static files that carry no cache headers.
#    The custom header shows the cache status (hit or miss) on every response, which makes testing easy.
gcloud compute backend-buckets create site-bucket --project $PROJECT --gcs-bucket-name $BUCKET --enable-cdn \
  --cache-mode CACHE_ALL_STATIC --default-ttl 3600 --client-ttl 600 --max-ttl 86400 --negative-caching \
  --custom-response-header "X-Cache-Status: {cdn_cache_status}"

# 3. Put an external Application Load Balancer in front, with a global address, URL map, managed certificate, HTTPS proxy and forwarding rule.
gcloud compute addresses create site-ip --project $PROJECT --global
gcloud compute url-maps create site-map --project $PROJECT --default-backend-bucket site-bucket
gcloud compute ssl-certificates create site-cert --project $PROJECT --domains $DOMAIN --global
gcloud compute target-https-proxies create site-proxy --project $PROJECT --url-map site-map --ssl-certificates site-cert
gcloud compute forwarding-rules create site-rule --project $PROJECT --global --address site-ip --target-https-proxy site-proxy \
  --ports 443 --load-balancing-scheme EXTERNAL_MANAGED

# 4. Point DNS at this address, wait for the certificate to become ACTIVE, then ask for a page twice and read X-Cache-Status.
IP=$(gcloud compute addresses describe site-ip --project $PROJECT --global --format="value(address)")
echo "Create an A record: $DOMAIN -> $IP"
gcloud compute ssl-certificates describe site-cert --project $PROJECT --global --format="value(managed.status)"
curl -sI https://$DOMAIN/ | grep -i -E "^(HTTP|x-cache-status|age)"
curl -sI https://$DOMAIN/ | grep -i -E "^(HTTP|x-cache-status|age)"

# 5. After a release, invalidate the changed paths. Invalidation takes a few minutes to spread.
gcloud compute url-maps invalidate-cdn-cache site-map --project $PROJECT --path "/index.html" --async

# 6. For private files: add a signing key (keep the key file safe), then sign URLs with it.
head -c 16 /dev/urandom | base64 | tr +/ -_ > key-1.txt
gcloud compute backend-buckets add-signed-url-key site-bucket --project $PROJECT --key-name key-1 --key-file key-1.txt

# Placeholders: pass in your own values. The ones below are examples.
variable "project" {
  type = string
}

variable "domain" {
  type    = string
  default = "static.example.com"
}

provider "google" {
  project = var.project
}

resource "google_storage_bucket" "site" {
  name                        = "${var.project}-static-site"
  location                    = "ASIA-SOUTH1"
  uniform_bucket_level_access = true
}

# Public read. For private files use signed URLs instead and give the Cloud CDN service account read access.
resource "google_storage_bucket_iam_member" "public" {
  bucket = google_storage_bucket.site.name
  role   = "roles/storage.objectViewer"
  member = "allUsers"
}

resource "google_compute_backend_bucket" "site" {
  name        = "site-bucket"
  bucket_name = google_storage_bucket.site.name
  enable_cdn  = true

  cdn_policy {
    cache_mode        = "CACHE_ALL_STATIC"
    default_ttl       = 3600
    client_ttl        = 600
    max_ttl           = 86400
    negative_caching  = true
    serve_while_stale = 86400
  }

  custom_response_headers = ["X-Cache-Status: {cdn_cache_status}"]
}

resource "google_compute_global_address" "site" {
  name = "site-ip"
}

resource "google_compute_url_map" "site" {
  name            = "site-map"
  default_service = google_compute_backend_bucket.site.id
}

resource "google_compute_managed_ssl_certificate" "site" {
  name = "site-cert"

  managed {
    domains = [var.domain]
  }
}

resource "google_compute_target_https_proxy" "site" {
  name             = "site-proxy"
  url_map          = google_compute_url_map.site.id
  ssl_certificates = [google_compute_managed_ssl_certificate.site.id]
}

resource "google_compute_global_forwarding_rule" "site" {
  name                  = "site-rule"
  target                = google_compute_target_https_proxy.site.id
  ip_address            = google_compute_global_address.site.address
  port_range            = "443"
  load_balancing_scheme = "EXTERNAL_MANAGED"
}

output "address" {
  value = google_compute_global_address.site.address
}

# pip install google-cloud-compute
# Signs a URL for private content, and invalidates a path in the cache through the Compute API.
import base64
import datetime as dt
import hashlib
import hmac

from google.cloud import compute_v1


def sign_url(url, key_name, key_b64, expires):
    """Returns the URL with Expires, KeyName and Signature added. key_b64 is the URL-safe base64 key that was given to
    `gcloud compute backend-buckets add-signed-url-key`. The signature covers the whole URL, so don't change it afterwards."""
    expiry = int(expires.replace(tzinfo=dt.timezone.utc).timestamp()) if expires.tzinfo is None else int(expires.timestamp())
    separator = "&" if "?" in url else "?"
    to_sign = "%s%sExpires=%d&KeyName=%s" % (url, separator, expiry, key_name)
    digest = hmac.new(base64.urlsafe_b64decode(key_b64), to_sign.encode(), hashlib.sha1).digest()
    return "%s&Signature=%s" % (to_sign, base64.urlsafe_b64encode(digest).decode())


def invalidate(project, url_map, path, host=None):
    """Asks every cache to drop the path. A single trailing * removes a whole prefix. It takes a few minutes to spread."""
    rule = compute_v1.CacheInvalidationRule(path=path, host=host) if host else compute_v1.CacheInvalidationRule(path=path)
    operation = compute_v1.UrlMapsClient().invalidate_cache(project=project, url_map=url_map, cache_invalidation_rule_resource=rule)
    return operation.name


if __name__ == "__main__":
    key = open("key-1.txt").read().strip()
    expires = dt.datetime.now(dt.timezone.utc) + dt.timedelta(minutes=15)
    print(sign_url("https://static.example.com/private/report.pdf", "key-1", key, expires))
    print("invalidation operation:", invalidate("my-project-id", "site-map", "/index.html"))

// dotnet add package Google.Cloud.Compute.V1
// Audits the project's backends: FORCE_CACHE_ALL (private data can be cached), CDN switched off on a backend bucket,
// and cache keys that include the whole query string, which splits the cache.
using Google.Cloud.Compute.V1;

string project = Environment.GetEnvironmentVariable("GOOGLE_CLOUD_PROJECT") ?? throw new InvalidOperationException("Set GOOGLE_CLOUD_PROJECT first.");
int problems = 0;

BackendBucketsClient buckets = BackendBucketsClient.Create();
foreach (BackendBucket bucket in buckets.List(project))
{
    if (!bucket.EnableCdn)
    {
        Console.WriteLine($"backend bucket {bucket.Name}: Cloud CDN is switched off");
        problems++;
    }
    else if (bucket.CdnPolicy?.CacheMode == "FORCE_CACHE_ALL" && bucket.CdnPolicy.SignedUrlKeyNames.Count > 0)
    {
        Console.WriteLine($"backend bucket {bucket.Name}: FORCE_CACHE_ALL together with signed URLs, so check what is cached for whom");
        problems++;
    }
}

BackendServicesClient services = BackendServicesClient.Create();
foreach (BackendService service in services.List(project))
{
    if (!service.EnableCDN) continue;

    if (service.CdnPolicy?.CacheMode == "FORCE_CACHE_ALL")
    {
        Console.WriteLine($"backend service {service.Name}: FORCE_CACHE_ALL ignores private and no-store, so personal responses can be cached");
        problems++;
    }
    var key = service.CdnPolicy?.CacheKeyPolicy;
    if (key != null && key.IncludeQueryString && key.QueryStringWhitelist.Count == 0 && key.QueryStringBlacklist.Count == 0)
    {
        Console.WriteLine($"backend service {service.Name}: the whole query string is in the cache key, which splits the cache");
        problems++;
    }
}

Console.WriteLine(problems == 0 ? "No problems found." : $"{problems} problem(s) found.");
return problems == 0 ? 0 : 1;

Videos picked for this service. Each one is labelled with its source, opens on YouTube if you prefer, and loads only when you press play.

Typical origins are Cloud Storage and Cloud Run, in front of a load balancer from Cloud Load Balancing. Signing keys belong in Secret Manager, and metrics and logs go to Cloud Monitoring.