Here is a list of design choices that you could exercise to cope with security threats such as DDoS attacks:
- Use hardened bastion hosts such as load balancers (particularly HTTP(S) and SSL proxy load balancers).
- Make good use of the firewall rules in your VPC network. Ensure that incoming traffic from unknown sources, or on unknown ports, or protocols is not allowed through.
- Use managed services such as Dataflow and Cloud Functions wherever possible; these are serverless and so have smaller attack vectors.
- If your application lends itself to App Engine it has several security benefits over GCE or GKE, and it can also be used to autoscale up quickly, damping the impact of a DDOS attack.
- If you are using GCE VMs, consider the use of API rate limits to ensure that the number of requests to a given VM does not increase in an uncontrolled fashion.
- Use...