Cloud Armor - multiple rate limiters in a single Security Policy

[sokol8]

Hi everyone,

I would like to have several rate limiters that would operate on different time-horizons.

For example:

1) RateLimiter1 will allow a user (ip-address + path pair) make max 10 requests per minute and ban the user for an hour in case of threshold violation.

2) RateLimiter2 will allow a user (ip-address + path pair) make max 100 requests per 24 hours and ban the user for an hour in case of threshold violation.

I can add multiple Rate Limiters to Cloud Armor but it looks like I cannot make them work properly together.

Rate Limiter 1 will either DENY request or ALLOW request to pass through.

When RateLimiter1 make decision to ALLOW request to pass through, the request will never reach RateLimiter2 for evaluation.

My main question is: is it even possible to make Cloud Armor Rate Limiters work like that? Are other non-Google WAFs allow anything like that?

Thanks!