This document describes how to configure service rate limiting policies for Secure Web Proxy to protect your systems from traffic overloads and manage the costs of outbound web traffic.
Before you begin
Review the Secure Web Proxy overview and Service rate limiting policies overview pages.
-
- Network Security API (
networksecurity.googleapis.com) - Network Services API (
networkservices.googleapis.com)
To enable the APIs, run the following command:
gcloud services enable \ networksecurity.googleapis.com \ networkservices.googleapis.com - Network Security API (
Make sure that your user account has the required administrative roles and permissions to configure Secure Web Proxy resources.
A Secure Web Proxy instance must be active before you can create a policy. For more information, see Deploy a Secure Web Proxy instance.
Optional: To create a rate limiting policy based on client certificate identities (such as
CLIENT_CERT_COMMON_NAME), make sure that you configure frontend mutual TLS (mTLS).
Set up a service rate limiting policy
To create a service rate limiting policy, define your configuration in a YAML file and then import that file into Secure Web Proxy.
Create the
my-rate-limit-policy.yamlfile, and then specify the policy parameters.The following example limits the number of requests sent to a large language model (LLM) provider (
foo.com) to 100 requests per minute for each agent on a Secure Web Proxy gateway for outbound traffic. Each agent is identified by the common name in its client certificate.name: "projects/ PROJECT_ID /locations/ LOCATION /rateLimitPolicies/test-policy" description: "Simple agent for LLM rate limiting." httpRules: # Match on the provider host name. - to: destination: hosts: - exact: "foo.com" # default RPM bucket rateLimitActions: - rateLimitBucket: "rl_default_rpm_limit" rateLimitBuckets: - name: "rl_default_rpm_limit" # Identify client by its client cert name keys: - keyType: PRINCIPAL principalType: CLIENT_CERT_COMMON_NAME defaultLimit: countLimit: count: 100 interval: 1 intervalUnit: MINUTES targets: - resource: "projects/ PROJECT_ID /locations/ LOCATION /gateways/ GATEWAY_NAME "Replace the following:
PROJECT_ID: ID of your Google Cloud projectLOCATION: region of your Secure Web Proxy instance; for example,us-central1GATEWAY_NAME: name of your Secure Web Proxy gateway instance
Import the rate limit policy YAML file by using the following command:
gcloud alpha network-security rate-limit-policies import test-policy \ --source=my-rate-limit-policy.yaml \ --location=LOCATION
Replace
LOCATIONwith the region of your Secure Web Proxy instance.