Question

A financial services company runs Compute Engine VMs with no external IP addresses in a private subnet. The security team requires two things for internet egress: (1) all outbound HTTP/HTTPS traffic must be restricted to an approved list of FQDNs (e.g., only *.partnerbank.com and api.provider.net), and (2) any non-HTTP(S) egress that is still permitted must be source-NATed through a predictable set of static IP addresses so partners can allowlist them. What should you deploy to meet BOTH requirements with the least operational overhead?

Accepted Answer

Deploy Secure Web Proxy with a URL/FQDN allowlist policy for HTTP/HTTPS egress, and configure Cloud NAT with manually assigned static external IP addresses for the remaining permitted egress traffic.

Answer

Configure Cloud NAT with automatic IP allocation and add hierarchical firewall rules that match destination FQDNs to filter HTTP/HTTPS egress.

Answer

Deploy a self-managed NGINX proxy appliance with IP forwarding as the only egress path and rely on Cloud Armor named IP lists to restrict destinations.

Answer

Use VPC Service Controls perimeters to restrict egress to approved FQDNs and enable Private Google Access so VMs reach the internet through Google's front end.