Skip to content
Back to Cloud Services

GCP Cloud CDN

Global CDN with 200+ POPs, cache keys, signed URLs, and Cloud Armor integration.

GCPIntermediate

Why

Cloud CDN caches at 200+ POPs, cutting latency and origin load. Free tier: 1TB egress.

Integrates with Cloud Armor for WAF. Cache fill from Cloud Storage is free.

When

Use for static assets, video, API acceleration. Avoid for content needing no caching or single-region only.

How

1. Enable — on HTTP(S) Load Balancer backend bucket/service 2. Cache mode — CACHE_ALL_STATIC, USE_ORIGIN_HEADERS, FORCE_CACHE_ALL 3. Cache key — host, path, query string (whitelist params) 4. TTL — max-age from origin, or override in CDN config 5. Signed URLs — time-limited, for premium content 6. Cloud Armor — WAF rules, DDoS protection, geo blocking 7. Invalidation — gcloud compute url-maps invalidate-cdn-path 8. Compression — gzip/brotli auto for text

Example

# Enable CDN on backend bucket gcloud compute backend-buckets create cdn-backend \ --gcs-bucket-name my-static \ --enable-cdn \ --cache-mode CACHE_ALL_STATIC \ --default-ttl 3600 # Cloud Armor WAF rule gcloud compute security-policies create waf-policy \ --description "WAF rules" gcloud compute security-policies rules create 1000 \ --security-policy waf-policy \ --expression "evaluatePreconfiguredExpr('sqli-stable')" \ --action deny-403 # Attach to backend gcloud compute backend-services update my-backend \ --security-policy waf-policy

Common Problems

  • ⚠Cache key too broad — includes all query params, low hit rate
  • ⚠Invalidation slow + costly — version assets instead
  • ⚠Cloud Armor false positives — tune rules, monitor denies

Best Practices

  • ✓Whitelist query params in cache key — improves hit rate for tracking params
  • ✓Use Cloud Armor preconfigured rules — OWASP top 10, tuned by Google
  • ✓Version assets not invalidate — app.[hash].js caches forever

FAQ

What is GCP Cloud CDN and what problem does it solve?

Global CDN with 200+ POPs, cache keys, signed URLs, and Cloud Armor integration. It lets developers deploy, store, and scale without self-managing infrastructure — a core reference for cloud service selection.

How do I get started with GCP Cloud CDN in 5 minutes?

Two steps to run it: (1) Enable — on HTTP(S) Load Balancer backend bucket/service; (2) Cache mode — CACHE_ALL_STATIC, USE_ORIGIN_HEADERS, FORCE_CACHE_ALL. Validate on the free tier first, then wire into production.

What is the #1 pitfall with GCP Cloud CDN?

The most frequent issue is: Cache key too broad — includes all query params, low hit rate. Run a pre-launch checklist item by item, and add policy/config scanning in CI.

What are the best practices for GCP Cloud CDN?

Best practices for GCP Cloud CDN include: Whitelist query params in cache key — improves hit rate for tracking params; Use Cloud Armor preconfigured rules — OWASP top 10, tuned by Google; Version assets not invalidate — app.[hash].js caches forever. The first one — "Whitelist query params in cache key — improves hit rate for tracking params" — should be a team default baked into your IaC templates.

How do I control cost and avoid bill surprises with GCP Cloud CDN?

Three ways to prevent overspend: (1) tag every resource with env/team and enable billing alarms; (2) set budget thresholds to trigger Slack/email alerts; (3) review idle resources in Cost Explorer regularly and clean them up. Most GCP Cloud CDN options offer a free tier — validate within free quota before scaling.