GCP Cloud Armor preconfigured WAF rule 8 kb inspection limit

Problem with POST requests that exceed 8 kB

https://cloud.google.com/armor/docs/troubleshooting#post-body

When a preconfigured WAF rule is evaluated in a Google Cloud Armor security policy, up to 8 KB of the POST body is inspected for signature matches against the WAF rules.

https://cloud.google.com/armor/docs/security-policy-overview#post-body

The inspection is limited to the first 8 KB of the POST body, which gets decoded like URL query parameters. The remainder of the POST body might contain malicious code, which your application might accept.

Reason for this arbitrary 8 kB limit by Google

This approach provides you with low latency layer 7 inspection and protection, while maintaining availability for other Google customers.

Mitigation by Google

You can mitigate the risk from larger POST requests by creating a rule in your security policies to make sure that no uninspected content reaches your backends. Create a rule to deny traffic that exceeds 8 KB (8192 bytes) in POST body size. The following code sample shows how to create this rule: