Load Balancer Comparison

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122

# Global HTTP Load Balancer with Cloud CDN
resource "google_compute_global_address" "default" {
  name = "global-lb-ip"
}
 
resource "google_compute_global_forwarding_rule" "default" {
  name       = "global-http-rule"
  target     = google_compute_target_https_proxy.default.id
  port_range = "443"
  ip_address = google_compute_global_address.default.address
}
 
resource "google_compute_target_https_proxy" "default" {
  name             = "https-proxy"
  url_map          = google_compute_url_map.default.id
  ssl_certificates = [google_compute_managed_ssl_certificate.default.id]
}
 
resource "google_compute_managed_ssl_certificate" "default" {
  name = "managed-cert"
  managed {
    domains = ["api.example.com"]
  }
}
 
# URL Map for path-based routing
resource "google_compute_url_map" "default" {
  name            = "url-map"
  default_service = google_compute_backend_service.default.id
  
  host_rule {
    hosts        = ["api.example.com"]
    path_matcher = "api-paths"
  }
  
  path_matcher {
    name            = "api-paths"
    default_service = google_compute_backend_service.api_v1.id
    
    path_rule {
      paths   = ["/v2/*"]
      service = google_compute_backend_service.api_v2.id
    }
    
    path_rule {
      paths   = ["/static/*"]
      service = google_compute_backend_service.static.id
    }
  }
}
 
# Backend Service with Cloud CDN and Cloud Armor
resource "google_compute_backend_service" "default" {
  name                  = "backend-service"
  protocol              = "HTTP"
  port_name             = "http"
  timeout_sec           = 30
  enable_cdn            = true  # Cloud CDN enabled
  
  # Cloud Armor security policy
  security_policy = google_compute_security_policy.default.id
  
  backend {
    group           = google_compute_instance_group_manager.default.instance_group
    balancing_mode  = "UTILIZATION"
    max_utilization = 0.8
    capacity_scaler = 1.0
  }
  
  # Health check
  health_checks = [google_compute_health_check.default.id]
  
  # Connection draining
  connection_draining_timeout_sec = 30
  
  # Cloud CDN configuration
  cdn_policy {
    cache_mode = "CACHE_ALL_STATIC"
    default_ttl = 3600
    max_ttl     = 86400
    negative_caching = true
  }
}
 
# Cloud Armor security policy
resource "google_compute_security_policy" "default" {
  name = "security-policy"
  
  # Default rule
  rule {
    action   = "allow"
    priority = "2147483647"
    match {
      versioned_expr = "SRC_IPS_V1"
      config {
        src_ip_ranges = ["*"]
      }
    }
    description = "Default allow rule"
  }
  
  # Rate limiting rule
  rule {
    action   = "rate_based_ban"
    priority = "1000"
    match {
      versioned_expr = "SRC_IPS_V1"
      config {
        src_ip_ranges = ["*"]
      }
    }
    rate_limit_options {
      conform_action = "allow"
      exceed_action  = "deny(429)"
      enforce_on_key = "IP"
      rate_limit_threshold {
        count        = 1000
        interval_sec = 60
      }
    }
  }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113

# Azure Application Gateway v2
resource "azurerm_application_gateway" "main" {
  name                = "app-gateway"
  resource_group_name = azurerm_resource_group.main.name
  location            = azurerm_resource_group.main.location
  
  sku {
    name     = "Standard_v2"
    tier     = "Standard_v2"
  }
  
  # Auto-scaling
  autoscale_configuration {
    min_capacity = 2
    max_capacity = 10
  }
  
  # Gateway IP configuration
  gateway_ip_configuration {
    name      = "gateway-ip-config"
    subnet_id = azurerm_subnet.gateway.id
  }
  
  # Frontend IP
  frontend_ip_configuration {
    name                 = "frontend-ip"
    public_ip_address_id = azurerm_public_ip.gateway.id
  }
  
  # Frontend port
  frontend_port {
    name = "https-port"
    port = 443
  }
  
  # SSL certificate
  ssl_certificate {
    name                = "gateway-cert"
    key_vault_secret_id = azurerm_key_vault_certificate.gateway.secret_id
  }
  
  # HTTP listener
  http_listener {
    name                           = "https-listener"
    frontend_ip_configuration_name = "frontend-ip"
    frontend_port_name             = "https-port"
    protocol                       = "Https"
    ssl_certificate_name           = "gateway-cert"
    host_name                      = "api.example.com"
  }
  
  # Backend pool
  backend_address_pool {
    name         = "backend-pool"
    ip_addresses = var.backend_ips
  }
  
  # Backend HTTP settings
  backend_http_settings {
    name                  = "http-settings"
    cookie_based_affinity = "Disabled"
    port                  = 8080
    protocol              = "Http"
    request_timeout       = 30
    
    connection_draining {
      enabled           = true
      drain_timeout_sec = 30
    }
  }
  
  # Health probe
  probe {
    name                = "health-probe"
    protocol            = "Http"
    path                = "/health"
    host                = "api.internal"
    interval            = 30
    timeout             = 30
    unhealthy_threshold = 3
  }
  
  # URL path map for routing
  url_path_map {
    name                               = "path-map"
    default_backend_address_pool_name  = "backend-pool"
    default_backend_http_settings_name = "http-settings"
    
    path_rule {
      name                       = "api-v2"
      paths                      = ["/api/v2/*"]
      backend_address_pool_name  = "api-v2-pool"
      backend_http_settings_name = "http-settings"
    }
  }
  
  # Request routing rule
  request_routing_rule {
    name                       = "routing-rule"
    rule_type                  = "PathBasedRouting"
    http_listener_name         = "https-listener"
    url_path_map_name          = "path-map"
    priority                   = 100
  }
  
  # WAF configuration (if using WAF_v2 SKU)
  # waf_configuration {
  #   enabled          = true
  #   firewall_mode    = "Prevention"
  #   rule_set_type    = "OWASP"
  #   rule_set_version = "3.2"
  # }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

# Strong TLS configuration
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';
ssl_prefer_server_ciphers on;
 
# Security headers
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header X-XSS-Protection "1; mode=block" always;
 
# Hide server information
server_tokens off;
proxy_hide_header X-Powered-By;
 
# Request limits
client_max_body_size 10m;
client_body_timeout 30s;
client_header_timeout 30s;
 
# Rate limiting
limit_req_zone $binary_remote_addr zone=api_limit:10m rate=100r/s;
limit_conn_zone $binary_remote_addr zone=conn_limit:10m;
 
server {
    location /api/ {
        limit_req zone=api_limit burst=200 nodelay;
        limit_conn conn_limit 100;
        
        # Validate content type
        if ($content_type !~ "application/json") {
            return 415;
        }
    }
}