A Cloud Operations engineer needs to configure outbound internet connectivity and secure access to Google APIs for virtual machine instances in a custom VPC subnet named `prod-subnet` (located in `us-central1`). None of the VM instances have external IP addresses assigned. Which TWO actions or `gcloud` commands should the engineer execute to fulfill these requirements?
- Enable Private Google Access on the subnet using `gcloud compute networks subnets update prod-subnet --region=us-central1 --enable-private-ip-google-access`.Cevap
- Create a Cloud NAT gateway on a Cloud Router in `us-central1` using `gcloud compute routers nats create` to handle egress traffic for instances without external IPs.Cevap
- CExecute `gcloud compute firewall-rules create allow-egress --direction=EGRESS --priority=65535 --action=ALLOW` to enable Network Address Translation.
- DRun `gcloud compute instances add-access-config` on each instance to attach an ephemeral external IP address required for Cloud NAT to route packets.
Cevap
Enable Private Google Access on the subnet via the gcloud subnets update command, and create a Cloud NAT configuration on a Cloud Router using gcloud compute routers nats create.
To allow private Compute Engine instances without external IP addresses to reach Google APIs and external internet destinations, two complementary GCP networking features must be configured. First, enabling Private Google Access on the subnet allows VMs with only internal IP addresses to send traffic to Google API endpoints. Second, creating a Cloud NAT gateway on a Cloud Router in the same region provides NAT translation for outbound internet connections without exposing the instances to incoming internet requests.
Adım Adım Çözüm
Anahtar Kavram
Configuring Cloud NAT and Private Google Access for private VPC subnets