A cloud engineer is setting up a new custom-mode VPC subnet in the `us-central1` region named `backend-subnet` for internal application instances. The workload has two strict operational requirements:
1. Virtual machines in `backend-subnet` must be able to securely reach Google Cloud APIs and services without having external IPv4 addresses assigned.
2. Ingress traffic on TCP port 8080 must be restricted specifically to instances running under the service account `[email protected]`.
Which TWO configuration steps must the engineer perform when deploying the subnet and firewall rules to fulfill these requirements?
- Enable Private Google Access on the `backend-subnet` configuration.Cevap
- Create an ingress firewall rule on the VPC network specifying `--target-service-accounts=app-backend@project-id.iam.gserviceaccount.com` and allowing TCP port 8080.Cevap
- CSet the custom ingress firewall rule priority to a high numeric value such as 60000 so that it takes precedence over default network rules.
- DGrant the primitive `roles/Owner` role to the target service account at the project root to automatically grant all network firewall permissions.
Cevap
The cloud engineer must enable Private Google Access on the backend subnet and create an ingress firewall rule specifying the target service account with TCP port 8080 allowed.
Enabling Private Google Access allows instances without external IP addresses to reach Google API endpoints internally. Additionally, using target service accounts in an ingress firewall rule enforces network access controls based on instance service account identity rather than IP addresses or broad network tags.
Adım Adım Çözüm
Anahtar Kavram
Private Google Access configuration and target service account firewall rule filtering in GCP VPC networks.