An infrastructure team wants to block all incoming SSH traffic (TCP port 22) to Compute Engine instances across a Virtual Private Cloud (VPC) network, while allowing SSH access strictly to instances assigned the network tag `bastion-host`. The team configures a VPC firewall rule with a priority of 1000 that denies ingress TCP port 22 for all instances in the network. Which configuration for a second firewall rule will successfully permit SSH traffic to only the tagged instances?
- Create an ALLOW ingress rule for TCP port 22 targeting the network tag `bastion-host` with a priority of 500.Answer
- BCreate an ALLOW ingress rule for TCP port 22 targeting the network tag `bastion-host` with a priority of 2000.
- CCreate an ALLOW egress rule for TCP port 22 targeting the network tag `bastion-host` with a priority of 500.
- DGrant the primitive Owner role to the instance service account so that incoming traffic bypasses network firewall rules.
Answer
Create an ALLOW ingress rule for TCP port 22 targeting the network tag 'bastion-host' with a priority of 500.
In Google Cloud VPC firewall evaluation, rules are processed according to numerical priority, where lower integer values take precedence. An ALLOW ingress rule set to priority 500 targeting instances with the 'bastion-host' tag will be evaluated before the broad DENY ingress rule set at priority 1000, allowing SSH access to the intended targets while blocking all others.
Step-by-Step Solution
Key Concept
VPC Firewall Rule Priority and Target Tag Evaluation
Estimated Time:1m 30s