Secure communications and establish boundary protection
Secure communications and establish boundary protection
This domain tests network and boundary design: VPC firewall enforcement, edge protection, private connectivity to Google APIs, and service perimeters that limit data exfiltration.
Core rules
- VPC firewalls are stateful, distributed, and applied by priority (lower number wins). Rules target tags or service accounts and can filter ingress and egress. Every VPC has implied deny ingress and allow egress; do not rely on them for production. Hierarchical firewall policies attach at organization or folder and are evaluated before VPC rules; global network firewall policies apply to all VPCs in scope.
- Cloud Armor protects external Application Load Balancers (and some proxy Network Load Balancers) with WAF rules, rate limits, geo/IP filters, and bot management. It is not a VPC firewall and does not filter east-west traffic inside a VPC.
- Private access: Private Google Access lets VM/private-node traffic reach Google APIs without external IPs. Private Service Connect creates private endpoints for producer services. Cloud NAT provides egress for private instances. Shared VPC centralizes network administration while service projects consume subnets.
- VPC Service Controls build a service perimeter around projects and services, restricting data movement across the boundary. Access levels define trusted contexts; ingress/egress rules allow specific identities or services. Dry-run mode logs violations before enforcement.
Worked example
A private GKE workload must call Cloud Storage, and the subnet has no default route. The engineer first checks whether Private Google Access is enabled on the subnet; if the API is supported, that is enough, with egress firewall allowing the Google API VIP ranges. If the requirement is a private endpoint for a third-party service, use Private Service Connect. The reasoning is to avoid public IPs and avoid opening broad internet egress; verify with Connectivity Tests and VPC Flow Logs.
Traps
Confusing Cloud Armor with firewall rules; assuming VPC Service Controls replaces IAM; forgetting that firewall rules are stateful; attaching a hierarchical policy with a priority that unintentionally shadows lower rules; and using Private Service Connect when Private Google Access already covers the API.