An enterprise organization requires centralized control over network firewall rules across all Google Cloud projects. The security team must enforce a global policy that denies all incoming SSH traffic on TCP port 22 to virtual machines across all projects. Project-level network administrators must still be able to manage application-specific firewall rules for their own workloads without the ability to override or bypass the organization's SSH restriction. Which architectural solution should the cloud architect recommend?
- Create a hierarchical firewall policy at the organization level with a rule that denies ingress traffic on TCP port 22, and attach it to the organization node.Cevap
- BConfigure a VPC Service Controls perimeter encompassing all projects, and define an ingress rule blocking TCP port 22 network connections.
- CConnect all spoke VPC networks to a central hub VPC using VPC Network Peering, and define the port 22 deny rule strictly within the hub VPC.
- DAssign project network administrators the primitive Owner role (roles/owner) on their respective projects while relying on project-level default VPC firewall rules.
Cevap
The correct architecture is to create a hierarchical firewall policy at the organization level with a rule that denies ingress traffic on TCP port 22, attached to the organization node.
Hierarchical firewall policies allow organization administrators to define rules that are evaluated before any project-level firewall rules. By creating a deny rule for TCP port 22 at the organization level, the policy is enforced across all current and future projects under that node, ensuring project-level administrators cannot override the restriction.
Adım Adım Çözüm
Anahtar Kavram
Hierarchical Firewall Policies