Question

A security engineer is building a global network firewall policy for a VPC. They create a rule at priority 1000 that allows TCP 443 ingress to instances whose target is the service account 'web-sa@project.iam.gserviceaccount.com'. Separately, another engineer creates a rule at priority 900 that denies all ingress to instances with the secure tag 'quarantine'. An instance is running with the service account 'web-sa' AND has the secure tag 'quarantine' applied. Incoming HTTPS traffic to this instance is being dropped. What is the correct explanation?

Accepted Answer

The deny rule at priority 900 is evaluated before the allow rule at priority 1000, so the quarantine deny takes effect and traffic is dropped.

Answer

Rules targeting service accounts always take precedence over rules targeting secure tags regardless of priority, so the allow rule should win and traffic should pass.

Answer

You cannot mix service-account-targeted rules and secure-tag-targeted rules in the same network firewall policy, so the policy is invalid and all traffic is dropped.

Answer

The implied allow-ingress rule overrides both explicit rules, so the drop must be caused by a missing route rather than firewall configuration.