Question

Your security team requires that a set of Compute Engine instances in the 'restricted-vpc' custom-mode VPC have absolutely no direct path to the public internet, while still allowing them to reach Google APIs privately. Currently the VPC has the default 0.0.0.0/0 route pointing to the default internet gateway. The instances have no external IP addresses. What is the most effective way to guarantee these instances cannot egress to the internet through the default gateway while preserving private access to Google APIs?

Accepted Answer

Delete the default 0.0.0.0/0 route to the default internet gateway, enable Private Google Access on the relevant subnets, and add a route for restricted.googleapis.com via the default internet gateway.

Answer

Keep the default route but attach a network tag to the instances and create a deny-all egress firewall rule that blocks 0.0.0.0/0 for that tag.

Answer

Remove the external IP addresses from the instances and rely on the absence of Cloud NAT to prevent internet egress.

Answer

Lower the priority of the default internet gateway route to 65535 so that Private Google Access routes are always preferred.