A global logistics company manages dozens of Google Cloud projects across multiple departments within a single organization hierarchy. The security team must enforce mandatory baseline ingress firewall rules—such as blocking port 22 from the public internet—across all current and future projects. The design must prevent project-level administrators from overriding or deleting these baseline security rules, while still allowing central security administrators to delegate fine-grained access control using granular service tags. Which network security architecture should the cloud architect recommend to meet these requirements?
- Implement Hierarchical Firewall Policies enforced at the organization or folder level, and utilize Secure Tags to target specific instance workloads.Cevap
- BConfigure VPC Network Peering across all project VPC networks to inherit a centralized set of VPC firewall rules configured in a hub project.
- CAssign the primitive Owner IAM role to the central security team across all projects so they can manually manage local project VPC firewall rules.
- DDefine VPC Service Controls perimeters around each project to block all inbound network traffic at the IP layer.
Cevap
Implement Hierarchical Firewall Policies enforced at the organization or folder level, and utilize Secure Tags to target specific instance workloads.
Hierarchical Firewall Policies enable organizational security teams to attach immutable firewall rules at the organization or folder node level. Because these rules are evaluated prior to any VPC-level rules, project administrators cannot override them. Integrating Secure Tags allows central teams to securely delegate tag management and apply rules dynamically to specific instance workloads.
Adım Adım Çözüm
Anahtar Kavram
Hierarchical Firewall Policies and Secure Tags for organization-wide security governance