Question

Your company runs a fleet of Compute Engine VMs without external IP addresses in a subnet that uses Cloud NAT for internet egress. A SaaS partner requires that all outbound requests to their API originate from a small, fixed set of source IP addresses that you must provide to them for allowlisting. Currently the Cloud NAT gateway is configured with automatic NAT IP address allocation. What should you do to meet the partner's requirement while continuing to allow egress?

Accepted Answer

Reconfigure the Cloud NAT gateway to use manual NAT IP address allocation with reserved static external IP addresses, then share those addresses with the partner.

Answer

Assign ephemeral external IP addresses directly to each VM and remove the Cloud NAT gateway so traffic egresses with predictable addresses.

Answer

Keep automatic NAT IP allocation and enable Dynamic Port Allocation so the same IP addresses are always reused for the partner's traffic.

Answer

Create an egress VPC firewall rule that rewrites the source IP of outbound packets to a fixed address before they leave the gateway.