Question

A security engineer manages a global network firewall policy in a Shared VPC host project. Application VMs in multiple service projects need a rule that allows TCP 8443 traffic only between VMs that share a common workload identity, regardless of their IP addresses, which change frequently due to autoscaling. The engineer wants the rule to remain valid even if VMs are recreated with new IPs, and to work across the VPC network. Which approach should the engineer use to define the source and target in the network firewall policy rule?

Accepted Answer

Use secure tags (resource manager tags bound to the VM instances) as both the source and target in the firewall policy rule.

Answer

Use network tags on the VM instances as both the source and target in the firewall policy rule.

Answer

Create named IP lists in Cloud Armor referencing the VM IPs and reference them in the firewall policy rule.

Answer

Use service accounts as the source and a CIDR range covering the subnet as the target in the firewall policy rule.