A multinational enterprise operates a multi-project Google Cloud organization hosting PCI-DSS regulated payment microservices across hundreds of Virtual Private Cloud (VPC) networks. Central security governance mandates that all Compute Engine workloads must be protected by mandatory threat-blocking firewall policies defined at the organization level. The security design must satisfy three strict constraints:
1. Firewall rules must evaluate dynamically based on fine-grained resource identity tags rather than network IP ranges or service accounts.
2. Individual project administrators must be permitted to append project-specific ingress rules without the ability to override or bypass central organization security guardrails.
3. The design must prohibit transitive network exposure across project boundaries while keeping operational overhead minimal.
Which architectural design meets these requirements?
- Apply Hierarchical Firewall Policies at the Organization level using Secure Tags bound to resource instances, and utilize rule evaluation order with delegated rule priority ranges to permit project-level custom firewall rules below organizational rules.Answer
- BConfigure fine-grained Identity and Access Management (IAM) conditional policies on all Compute Engine instances and VPC networks, relying on IAM permissions alone to enforce perimeter boundaries and prevent data exfiltration across projects.
- CEstablish a hub-and-spoke topology using transitive VPC Network Peering from all project VPCs to a central inspection VPC, relying on hub VPC firewall rules with network target tags to enforce global policy across spokes.
- DGrant the primitive Editor role to central security service accounts across all GCP projects, allowing automated scripts to dynamically update local VPC network firewall rules using standard network target tags upon instance deployment.