Question

A financial services company has a Google Cloud organization with dozens of projects managed by different teams. The security team must guarantee that no Compute Engine VM instance in any current or future project can be assigned an external IP address, without relying on individual project owners to configure their own settings. Which approach best enforces this requirement?

Accepted Answer

Apply the 'constraints/compute.vmExternalIpAccess' organization policy constraint at the organization node with an empty allowed list.

Answer

Create a hierarchical firewall policy at the organization level that denies all egress to the internet.

Answer

Grant each project owner the Security Admin role and provide documentation instructing them to remove external IPs from all VMs.

Answer

Enable VPC Service Controls around every project to block traffic to and from external IP addresses.