Cloud Load BalancingAuthorCloudBrum editorial teamLast reviewed30 Oct 2026Reading time~12 minLevelBeginner to advanced

• One address for the worldA global external load balancer has a single anycast IP address. Visitors enter Google’s network at the nearest edge location, and traffic is carried to the closest backend that has capacity, in any region.
• Application and Network familiesApplication Load Balancers work on HTTP and HTTPS. Proxy Network Load Balancers terminate TCP connections, with optional TLS. Passthrough Network Load Balancers forward packets untouched, so the backend sees the client’s address.
• URL mapsA URL map matches host, path and header rules and then routes, redirects or rewrites. It can split traffic by weight between backends, which makes canary releases a configuration change, and it can mirror requests to a test backend.
• Backends of many kindsManaged and unmanaged instance groups, network endpoint groups for VMs and containers, serverless NEGs for Cloud Run, Cloud Run functions and App Engine, internet NEGs for servers outside Google Cloud, and Cloud Storage buckets.
• Health checks and failoverHealth checks over HTTP, HTTPS, gRPC or TCP take unhealthy backends out of rotation. Outlier detection ejects backends that return errors, and traffic overflows to other zones or regions when a backend is full.
• Cloud Armor and TLSCloud Armor security policies add WAF rules, rate limits and geographic controls in front of the backends. Google-managed certificates and SSL policies handle TLS at the edge.
• Nothing to size or warm upThere are no load balancer instances to choose or to pre-warm. Capacity is Google’s concern, so the limits that you plan around are your backends' capacity and your quotas.
• Two network tiersPremium Tier carries traffic across Google’s own network from the nearest edge. Standard Tier hands it to the public internet earlier at a lower price, and is available for regional external load balancers only.

Forwarding rule

A rule that owns an IP address and port, and sends the traffic that arrives there to a target proxy or a backend service.

Target proxy

The component that terminates the connection for Application and proxy Network Load Balancers. It holds certificates and the URL map.

URL map

Routing rules for an Application Load Balancer: which host and path goes to which backend service or bucket, and what is redirected or rewritten.

Backend service

Describes a group of backends and how to use them: protocol, timeout, health check, balancing mode, session affinity, logging and Cloud Armor policy.

Network endpoint group (NEG)

A set of endpoints used as a backend: VM IP and ports, a serverless service, an internet host name or an on-premises address.

Health check

A probe that decides whether a backend can take traffic. Google’s probe addresses are 130.211.0.0/22 and 35.191.0.0/16, and firewalls must allow them.

Balancing mode and capacity

Utilization, rate or connections decide how much a backend should receive before the load balancer prefers another. A capacity scaler adjusts it.

Session affinity

Sends a client to the same backend, by client IP, cookie or header, when the application needs it.

Network Service Tier

Premium or Standard. It decides how far traffic travels inside Google’s network, and it changes egress price and which load balancers you can use.

Proxy and passthrough

A proxy load balancer ends the client connection and opens a new one to the backend. A passthrough load balancer forwards packets, so the original connection and client IP reach the backend.

Serverless NEG

A backend that points at a Cloud Run, Cloud Run functions or App Engine service, so that serverless apps can sit behind a load balancer with a custom domain, Cloud Armor and CDN.

Proxy-only subnet

A subnet that regional Envoy-based load balancers use for their proxies. It needs to exist in each region and network where you create one.

Cloud Armor policy

A set of rules, including WAF, rate limiting and IP allow and deny lists, attached to a backend service.

Put a Cloud Run service behind a global load balancer with gcloud

1. Choose the load balancerFor web traffic from the internet use a global external Application Load Balancer. For TCP or UDP use a Network Load Balancer, proxy or passthrough. For traffic inside a network use an internal one.
2. Create the backendHere a serverless NEG points at a Cloud Run service. For VMs you would use an instance group or a zonal NEG and add a health check.
3. Create the backend service and turn on loggingUse the external managed scheme, enable request logging and keep full sampling at first, so you can see what happens to real traffic.
4. Attach a Cloud Armor policyStart with a rate limit and managed rules, and tune them with the logs.
5. Build the front endA global address, a URL map, a Google-managed certificate, an HTTPS proxy and a forwarding rule on port 443.
6. Add the redirectA second forwarding rule on port 80 uses a URL map that only redirects to HTTPS.
7. Point DNS and wait for the certificateCreate an A record to the address. The managed certificate becomes active after DNS resolves.
8. Open the firewall for health checks (VM backends)Allow the health check ranges to reach the backend port, or every backend will look unhealthy.
9. Watch the logs and metricsThe log field statusDetails explains every error response. Alert on 5xx rates, latency and backend health.

• Use a global external Application Load Balancer with backends in the regions where your users are, so each request travels to the nearest healthy one.
• Keep the backend keep-alive timeout above 600 seconds for global external load balancers, to avoid reused-connection errors.
• Choose the balancing mode that fits: rate for web requests, utilization for CPU-bound work, connections for long-lived flows.
• Turn on Cloud CDN for cacheable content, so many requests never reach the backends.
• Use HTTP/2 and HTTP/3 on the front end and let clients negotiate them.
• Use outlier detection and health checks with sensible thresholds, so bad backends leave quickly and return only when healthy.
• Set the backend service timeout to the longest request you expect, not an arbitrary high value.
• Place backends and data close together, because a fast load balancer can’t hide a slow database.

FinOps is the habit of managing cloud spend together with engineering. These are the FinOps checks that matter most for Cloud Load Balancing.

• Share one IP address and forwarding rule between several services with host and path rules, where the design allows.
• Delete unused forwarding rules, addresses and backends, since each bills by the hour.
• Put Cloud CDN in front of cacheable content, because cache hits don’t pass through the load balancer.
• Compare Premium and Standard Network Service Tier for regional external load balancers.
• Cut data processed with compression and caching, since it is billed per GiB.
• Watch egress, which is billed separately from load balancing, and keep traffic in-region where you can.
• Add Cloud Armor rate limits, which stop abusive traffic that would otherwise raise data charges.
• Check whether Cloud Run’s own domain mapping or a simple regional load balancer is enough before building a global one.
• Review the logging sample rate, since logs have their own cost at very high volume.
• Label resources by team and set a budget alert on the project.

• Attach Cloud Armor policies with rate limits, managed WAF rules and, where needed, geographic restrictions.
• Use Google-managed certificates and a modern SSL policy with a minimum TLS version.
• Redirect HTTP to HTTPS on a separate port-80 front end.
• Allow only Google’s health check ranges and the load balancer’s addresses to reach backends, and keep backends off public IPs.
• Use Identity-Aware Proxy for internal tools that need per-user access control.
• Turn on request logging, and send logs to a restricted sink for audit.
• Restrict who can change load balancers, URL maps and Cloud Armor policies with IAM, and alert on changes.
• Use private connectivity (internal load balancers, Private Service Connect) for services that shouldn’t be public.
• Keep secrets out of URL maps and headers, and use Secret Manager for credentials.
• Review Security Command Center findings for the project, including open firewall rules.

Cloud Audit Logs show who changed a load balancer or policy, Cloud Asset Inventory stores past configurations, Security Command Center reports posture, and Google’s compliance reports manager holds certifications. Google runs the load balancing infrastructure. Routing design, Cloud Armor rules, certificates, firewall rules for backends and what the logs keep are yours.

• Delete idle forwarding rules, addresses and backends.
• Use Cloud CDN and compression so fewer bytes cross the network.
• Keep backends in a region close to users and data, and use autoscaling so capacity follows load.
• Merge services behind shared load balancers where it is safe to do so.
• If data rules and latency allow, place backends in a Google Cloud region that Google marks as low carbon.
• Google’s Carbon Footprint report is per project and service group, so quote no Cloud Load Balancing-only figure.

Purchase options

What you actually pay for

• Forwarding rule hours, by type of rule
• Data processed through the load balancer, per GiB
• Network egress to the internet and between regions
• Cloud Armor policies, rules and requests, and Cloud CDN charges
• Reserved external IP addresses that aren’t in use

A Cloud Run service behind a global external Application Load Balancer: a serverless NEG, a backend service with logging, a Cloud Armor rate limit, a URL map, a Google-managed certificate, an HTTPS front end and an HTTP front end that redirects. The CLI tab builds it and reads the error logs; Terraform describes the same resources. The Python tab counts recent 5xx responses by the reason the load balancer logged, and the C# tab audits backend services for missing Cloud Armor and logging, and HTTP proxies that don’t redirect. Replace the project, region, service and domain with your own.

# Placeholders: replace the project, the region, the Cloud Run service and the domain with your own.
PROJECT=my-project-id
REGION=asia-south1
SERVICE=hello
DOMAIN=app.example.com

# 1. A serverless network endpoint group that points at an existing Cloud Run service. Cloud Run needs no health check:
#    the load balancer treats the whole service as one backend and Cloud Run scales behind it.
gcloud compute network-endpoint-groups create hello-neg --project $PROJECT --region $REGION \
  --network-endpoint-type serverless --cloud-run-service $SERVICE

# 2. A backend service for the global external Application Load Balancer, with request logging at full sampling.
gcloud compute backend-services create hello-backend --project $PROJECT --global --load-balancing-scheme EXTERNAL_MANAGED \
  --protocol HTTPS --enable-logging --logging-sample-rate 1.0
gcloud compute backend-services add-backend hello-backend --project $PROJECT --global \
  --network-endpoint-group hello-neg --network-endpoint-group-region $REGION

# 3. A Cloud Armor policy that slows any client sending more than 100 requests a minute. Attach it to the backend service.
gcloud compute security-policies create edge-policy --project $PROJECT --description "Rate limit per client"
gcloud compute security-policies rules create 1000 --project $PROJECT --security-policy edge-policy --expression "true" \
  --action throttle --rate-limit-threshold-count 100 --rate-limit-threshold-interval-sec 60 \
  --conform-action allow --exceed-action deny-429 --enforce-on-key ip
gcloud compute backend-services update hello-backend --project $PROJECT --global --security-policy edge-policy

# 4. The front end: a global address, a URL map, a Google-managed certificate, an HTTPS proxy and a forwarding rule.
gcloud compute addresses create app-ip --project $PROJECT --global
gcloud compute url-maps create app-map --project $PROJECT --default-service hello-backend
gcloud compute ssl-certificates create app-cert --project $PROJECT --domains $DOMAIN --global
gcloud compute target-https-proxies create app-proxy --project $PROJECT --url-map app-map --ssl-certificates app-cert
gcloud compute forwarding-rules create app-https --project $PROJECT --global --address app-ip --target-https-proxy app-proxy \
  --ports 443 --load-balancing-scheme EXTERNAL_MANAGED

# 5. A second front end on port 80 that only redirects to HTTPS, on the same address.
cat > redirect.yaml <<YAML
name: app-redirect
defaultUrlRedirect:
  httpsRedirect: true
  redirectResponseCode: MOVED_PERMANENTLY_DEFAULT
YAML
gcloud compute url-maps import app-redirect --project $PROJECT --global --source redirect.yaml --quiet
gcloud compute target-http-proxies create app-http-proxy --project $PROJECT --url-map app-redirect
gcloud compute forwarding-rules create app-http --project $PROJECT --global --address app-ip --target-http-proxy app-http-proxy \
  --ports 80 --load-balancing-scheme EXTERNAL_MANAGED

# 6. Point DNS at the address and wait for the certificate to become ACTIVE. Later, the logs explain every 5xx: statusDetails says why.
IP=$(gcloud compute addresses describe app-ip --project $PROJECT --global --format="value(address)")
echo "Create an A record: $DOMAIN -> $IP"
gcloud compute ssl-certificates describe app-cert --project $PROJECT --global --format="value(managed.status)"
gcloud logging read 'resource.type="http_load_balancer" AND httpRequest.status>=500' --project $PROJECT --limit 5 --freshness 1h \
  --format="table(timestamp,httpRequest.status,jsonPayload.statusDetails)"

# Placeholders: pass in your own values. The ones below are examples.
variable "project" {
  type = string
}

variable "region" {
  type    = string
  default = "asia-south1"
}

variable "cloud_run_service" {
  type    = string
  default = "hello"
}

variable "domain" {
  type    = string
  default = "app.example.com"
}

provider "google" {
  project = var.project
  region  = var.region
}

# A serverless network endpoint group that points at an existing Cloud Run service.
resource "google_compute_region_network_endpoint_group" "hello" {
  name                  = "hello-neg"
  region                = var.region
  network_endpoint_type = "SERVERLESS"

  cloud_run {
    service = var.cloud_run_service
  }
}

# Cloud Armor: slow any client that sends more than 100 requests a minute.
resource "google_compute_security_policy" "edge" {
  name        = "edge-policy"
  description = "Rate limit per client"

  rule {
    action   = "throttle"
    priority = 1000

    match {
      versioned_expr = "SRC_IPS_V1"

      config {
        src_ip_ranges = ["*"]
      }
    }

    rate_limit_options {
      conform_action = "allow"
      exceed_action  = "deny(429)"
      enforce_on_key = "IP"

      rate_limit_threshold {
        count        = 100
        interval_sec = 60
      }
    }
  }

  rule {
    action   = "allow"
    priority = 2147483647

    match {
      versioned_expr = "SRC_IPS_V1"

      config {
        src_ip_ranges = ["*"]
      }
    }
  }
}

resource "google_compute_backend_service" "hello" {
  name                  = "hello-backend"
  load_balancing_scheme = "EXTERNAL_MANAGED"
  protocol              = "HTTPS"
  security_policy       = google_compute_security_policy.edge.id

  backend {
    group = google_compute_region_network_endpoint_group.hello.id
  }

  log_config {
    enable      = true
    sample_rate = 1.0
  }
}

resource "google_compute_global_address" "app" {
  name = "app-ip"
}

resource "google_compute_url_map" "app" {
  name            = "app-map"
  default_service = google_compute_backend_service.hello.id
}

resource "google_compute_managed_ssl_certificate" "app" {
  name = "app-cert"

  managed {
    domains = [var.domain]
  }
}

resource "google_compute_target_https_proxy" "app" {
  name             = "app-proxy"
  url_map          = google_compute_url_map.app.id
  ssl_certificates = [google_compute_managed_ssl_certificate.app.id]
}

resource "google_compute_global_forwarding_rule" "https" {
  name                  = "app-https"
  target                = google_compute_target_https_proxy.app.id
  ip_address            = google_compute_global_address.app.address
  port_range            = "443"
  load_balancing_scheme = "EXTERNAL_MANAGED"
}

# A second front end on port 80 that only redirects to HTTPS, on the same address.
resource "google_compute_url_map" "redirect" {
  name = "app-redirect"

  default_url_redirect {
    https_redirect         = true
    redirect_response_code = "MOVED_PERMANENTLY_DEFAULT"
    strip_query            = false
  }
}

resource "google_compute_target_http_proxy" "redirect" {
  name    = "app-http-proxy"
  url_map = google_compute_url_map.redirect.id
}

resource "google_compute_global_forwarding_rule" "http" {
  name                  = "app-http"
  target                = google_compute_target_http_proxy.redirect.id
  ip_address            = google_compute_global_address.app.address
  port_range            = "80"
  load_balancing_scheme = "EXTERNAL_MANAGED"
}

output "address" {
  value = google_compute_global_address.app.address
}

# pip install google-cloud-logging
# Counts the load balancer's 5xx responses of the last hour by status code and by the reason the load balancer logged (statusDetails).
import collections
import datetime as dt

from google.cloud import logging as cloud_logging

client = cloud_logging.Client()

# Some of the reasons you will meet, and what they point at:
#   response_sent_by_backend                  the application itself answered with a 5xx
#   backend_timeout                           the backend didn't answer within the backend service timeout
#   failed_to_connect_to_backend              the load balancer couldn't open a connection (health, firewall or the service is down)
#   denied_by_security_policy                 a Cloud Armor rule blocked the request
#   client_disconnected_before_any_response   the client gave up first, which isn't a server fault


def error_report(minutes=60, limit=1000):
    """Returns a Counter of (HTTP status, statusDetails) for recent errors, most common first when you call .most_common()."""
    since = (dt.datetime.now(dt.timezone.utc) - dt.timedelta(minutes=minutes)).strftime("%Y-%m-%dT%H:%M:%SZ")
    log_filter = 'resource.type="http_load_balancer" AND httpRequest.status>=500 AND timestamp>="%s"' % since
    counts = collections.Counter()
    for entry in client.list_entries(filter_=log_filter, order_by=cloud_logging.DESCENDING, max_results=limit):
        payload = entry.payload if isinstance(entry.payload, dict) else {}
        status = (entry.http_request or {}).get("status")
        counts[(status, payload.get("statusDetails", "unknown"))] += 1
    return counts


if __name__ == "__main__":
    for (status, details), count in error_report().most_common(10):
        print("%5d  HTTP %s  %s" % (count, status, details))

// dotnet add package Google.Cloud.Compute.V1
// Audits the project's load balancers: external backend services without a Cloud Armor policy or without request logging,
// and HTTP proxies whose URL map serves content on port 80 instead of redirecting to HTTPS.
using Google.Cloud.Compute.V1;

string project = Environment.GetEnvironmentVariable("GOOGLE_CLOUD_PROJECT") ?? throw new InvalidOperationException("Set GOOGLE_CLOUD_PROJECT first.");
int problems = 0;

BackendServicesClient services = BackendServicesClient.Create();
foreach (BackendService service in services.List(project))
{
    bool external = service.LoadBalancingScheme.StartsWith("EXTERNAL");
    if (external && string.IsNullOrEmpty(service.SecurityPolicy))
    {
        Console.WriteLine($"backend service {service.Name}: no Cloud Armor policy is attached");
        problems++;
    }
    if (service.LogConfig == null || !service.LogConfig.Enable)
    {
        Console.WriteLine($"backend service {service.Name}: request logging is off");
        problems++;
    }
}

TargetHttpProxiesClient proxies = TargetHttpProxiesClient.Create();
UrlMapsClient maps = UrlMapsClient.Create();
foreach (TargetHttpProxy proxy in proxies.List(project))
{
    string mapName = proxy.UrlMap.Split('/').Last();
    UrlMap map = maps.Get(project, mapName);
    if (map.DefaultUrlRedirect == null)
    {
        Console.WriteLine($"HTTP proxy {proxy.Name}: URL map {mapName} serves content over plain HTTP instead of redirecting to HTTPS");
        problems++;
    }
}

Console.WriteLine(problems == 0 ? "No problems found." : $"{problems} problem(s) found.");
return problems == 0 ? 0 : 1;

Videos picked for this service. Each one is labelled with its source, opens on YouTube if you prefer, and loads only when you press play.

Typical backends are Cloud Run services, Compute Engine instance groups and Google Kubernetes Engine workloads, with Cloud CDN switched on for cacheable content. Logs and metrics go to Cloud Monitoring.