Question

Your security team manages VPC firewall rules for a large production environment. Currently, ingress rules use network tags to identify which VMs may receive traffic on port 8080. Developers with the Compute Instance Admin role can freely add and remove network tags on their own VMs, which the security team considers a compliance risk because it lets developers grant themselves access covered by firewall rules. The security team wants firewall targeting that developers cannot self-assign without a privileged IAM permission. What should you do?

Accepted Answer

Recreate the firewall rules to target service accounts instead of network tags, and restrict who can assign service accounts to instances using the iam.serviceAccounts.actAs permission.

Answer

Move the firewall rules into a hierarchical firewall policy at the organization level so developers can no longer modify them.

Answer

Add a deny-all egress rule with higher priority so tagged VMs cannot initiate connections, forcing developers to request changes.

Answer

Enable VPC Flow Logs on the subnet and audit tag changes after the fact using Cloud Logging alerts.