Folder Policy Blocking a Legitimate Deployment
An organization enforces an organization policy that disables external IP addresses on Compute Engine instances at the organization node. A new data-science team in the research folder needs to run a batch job that pulls data from a third-party API over the internet. Their VPC has no Cloud NAT and no egress path other than external IPs. They have a 2-day deadline. The security team will not relax the org-level policy. A teammate suggests moving the project out of the organization to bypass the policy.
1. What is the correct way to give the workload internet egress without violating policy?
Read the worked answer
Provide egress through Cloud NAT attached to a Cloud Router in the team's VPC, so instances have no external IP but can still reach the third-party API.
Steps:
- Create a Cloud Router and Cloud NAT in the region of the subnet.
- Ensure the subnet has no external IPs (consistent with the org policy).
- Allow egress firewall rules to the internet as needed.
- If the API requires allowlisting, reserve a static NAT IP.
This satisfies the policy (no external IPs on instances) while restoring outbound connectivity. It is the standard, supported pattern and can be done well within 2 days.
Reject the suggestion to move the project out of the organization: it breaks central governance, logging, and billing controls, and is exactly the kind of bypass the exam tests against.
2. If the team also needs to serve inbound traffic later, how would your design change?
Read the worked answer
For inbound traffic, front the workload with a load balancer rather than assigning external IPs:
- An external HTTP(S) load balancer or external TCP/UDP load balancer terminates public traffic and forwards to backends with only internal IPs.
- Backends remain private, so the org policy is still honored.
- Health checks require a firewall rule allowing the Google health-check ranges to the backend ports.
If the traffic is internal-only, use an internal load balancer instead.
Key judgment: the org policy forbids external IPs on instances, not public exposure through managed front ends. The design should route public ingress through a load balancer and public egress through Cloud NAT, keeping instances private in both directions.