Question

A financial services company uses a Google Cloud organization with three folders: 'prod', 'dev', and 'shared-services'. The central security team must enforce a non-overridable rule that blocks all inbound RDP (TCP 3389) traffic to every VPC in the organization, while allowing individual project teams to still define their own additional allow/deny rules for other ports. The security team also wants a separate rule in the 'dev' folder that permits SSH (TCP 22) from the corporate CIDR range, but this rule should be evaluatable by lower-level project rules if they choose to override. Which design meets these requirements?

Accepted Answer

Create an organization-level hierarchical firewall policy with a 'deny' rule for TCP 3389 using the 'goto_next' action disabled, and a folder-level hierarchical firewall policy on 'dev' with a rule for TCP 22 that uses the 'goto_next' action so evaluation is delegated to (and thus overridable by) lower-level policies.

Answer

Create VPC firewall rules in every project to deny TCP 3389 and rely on project owners to keep them in sync; add an allow rule for TCP 22 in each 'dev' project.

Answer

Create an organization-level hierarchical firewall policy with an 'allow' rule for TCP 3389 and a folder-level policy on 'dev' that denies TCP 22, both using 'goto_next' so projects can override them.

Answer

Create a single VPC-level firewall policy in the Shared VPC host project that denies TCP 3389 for all attached service projects and allows TCP 22 in the 'dev' subnet ranges.