Question

Your organization is designing its resource hierarchy on Google Cloud. The networking team must centrally own and manage all VPC networks, subnets, firewall rules, and IP address ranges. Multiple application teams, each working in their own projects, need to deploy Compute Engine instances into these shared networks without being able to modify the network configuration. You want to follow Google-recommended practices while giving application teams the least privilege necessary to launch workloads. What should you do?

Accepted Answer

Configure a Shared VPC by designating the networking team's project as the host project and attaching each application project as a service project, then grant application teams the Compute Network User role on the specific shared subnets.

Answer

Grant each application team the Compute Network Admin role on the networking team's project so they can attach their instances to the shared networks.

Answer

Use VPC Network Peering between each application project's VPC and the networking team's VPC, and grant application teams Owner on their own projects.

Answer

Create the VPC in each application project and use organization policies to prevent the application teams from editing firewall rules.