Question

A financial services company hosts a customer-facing web application in Google Cloud. Security requires that all inbound connections from the internet must terminate on a managed edge service that provides DDoS protection, TLS offload, and Layer 7 WAF filtering before traffic reaches backend VM instances. The backend instances must not have public IP addresses. Which connectivity and security design for inbound traffic best meets these requirements?

Accepted Answer

Deploy a Global External HTTP(S) Load Balancer with Cloud Armor policies attached, keep backend instances with private IPs only, and allow ingress from the load balancer proxy ranges via VPC firewall rules

Answer

Assign external IP addresses to each backend instance and apply hierarchical firewall policies to filter inbound HTTP traffic directly at each VM

Answer

Use Cloud NAT to publish the backend instances to the internet and rely on VPC ingress firewall rules for Layer 7 filtering

Answer

Configure a Network (Layer 4) Load Balancer with target pools and enable Identity-Aware Proxy on the backend instances for DDoS mitigation