Documentation · Letting our agent through your CDN · Google Cloud Armor

Allowing our agent through Google Cloud Armor

On Google Cloud Armor, our agent is let through with one rule in the security policy on your load balancer: an advanced expression that matches our addresses on origin.ip and a user agent starting with our token, with the action allow, at a priority number lower than your WAF and bot rules.

What to match

User agent starts with OttomAgent/
Source address is one of those in https://ottom.io/agent/ips.json

Match both, never the user agent alone: anyone can send our user agent, but only we send it from those addresses. The current addresses are also listed on our agent page.

What you need

Permission to edit the Cloud Armor security policy attached to the backend service that serves your store.
The current addresses from https://ottom.io/agent/ips.json.

Setting it up

1. Add a rule to the security policy
In the console, go to Network Security, Cloud Armor policies, open your policy and add a rule. Choose Advanced mode.
2. Paste the expression
Use the expression below, with one inIpRange for each address in the file, joined with ||. Header names are lower case. Use origin.ip, which is the connecting address, not origin.user_ip, which is read from a header.
```
inIpRange(origin.ip, '203.0.113.10/32') && request.headers['user-agent'].startsWith('OttomAgent/')
```
3. Set the action and priority
Set the action to allow and a priority number lower than your preconfigured WAF rules and any bot management rule, such as 100. Cloud Armor evaluates the lowest number first and stops at the first match.
4. Save
Save the rule.

Checking it works

Run a scan of your store from your Ottom dashboard. When the rule works, the report has no bot protection finding and the agent reaches your products. In Cloud Logging, the load balancer’s request logs show our requests with your rule’s priority as the one that matched, and the outcome ACCEPT.

When a scan is still blocked

The expression is refused as too long
Cloud Armor allows five subexpressions in one expression, and each address and the user agent check counts as one. With more addresses than fit, add a second rule with the rest, at the next priority number.
203.0.113.10 is in the example
That is a documentation address, never one of ours. Replace it with each address in the file.

Good to know

An allow at this priority passes every lower priority rule, including the preconfigured WAF rules, for the requests it matches.

Google Cloud Armor documentation

Menus move. If a name here no longer matches your dashboard, these are the pages we checked this guide against:

Rules language reference

Questions

Why origin.ip and not origin.user_ip?

origin.user_ip comes from a header you configure, which a client can send itself. origin.ip is the address that connected, which only we can send from our addresses.

The same rule for other providers, and why it is safe: the CDN guides.