A cloud engineer is deploying a custom VPC network named `prod-vpc` with multiple subnets across different regions. To secure an internal microservice running on Compute Engine instances within `subnet-backend`, the engineer needs to allow ingress TCP traffic on port 8080 specifically to these backend instances without exposing other instances in `prod-vpc`. Which configuration approach correctly achieves this selective access?
- Create an ingress firewall rule specifying target network tags assigned to the backend instances, with port 8080 allowed for the required source IP range.Answer
- BCreate an ingress firewall rule applying to all instances in the network and set its priority to 65535 so that lower-priority numerical values do not override it.
- CAttach an IAM policy at the project level granting the Editor role to the backend service account so that network ports are automatically filtered by role assignment.
- DApply a project-level IAM deny policy to all other VMs in `prod-vpc` to override network-level firewall rule evaluations for port 8080.
Answer
Create an ingress firewall rule specifying target network tags assigned to the backend instances, with port 8080 allowed for the required source IP range.
Specifying target network tags on an ingress firewall rule allows the rule to apply strictly to Compute Engine instances labeled with those network tags, isolating port 8080 access to the intended microservice workloads without affecting other VMs in the VPC.
Step-by-Step Solution
Key Concept
Target network tags in GCP firewall rules allow selective rule application to specific VM instances inside a VPC network.
Estimated Time:1m 30s