Moving an IP Allowlist to Cloud Armor: When the Deferred Upgrade Comes Due
15 min readMigrating an app-layer IP check to Cloud Armor on an external load balancer: why the ingress lock is the part that actually matters, the carve-out a task queue forces, and an X-Forwarded-For reversal that 403s every user at cutover.
GCPCloud ArmorCloud RunSecurity
