Question

A financial services company runs application VMs in a VPC with no external IP addresses. Compliance requires that all outbound HTTPS traffic to the internet be inspected and restricted so that VMs can only reach an approved allowlist of external hostnames (for example, *.partner-bank.com and api.marketdata.io). The security team wants a fully managed Google Cloud service that enforces these URL/hostname policies with TLS inspection, rather than deploying and maintaining their own proxy fleet. Which approach should you implement?

Accepted Answer

Deploy Secure Web Proxy (SWP) with a gateway security policy referencing URL lists, and configure the VMs to send egress web traffic through the SWP endpoint.

Answer

Configure Cloud NAT with a specific set of static external IPs and rely on Cloud NAT logging to block unapproved destinations.

Answer

Create a Google Cloud Armor edge security policy with an allowlist of hostnames applied to the VPC egress path.

Answer

Deploy a self-managed third-party proxy appliance in a managed instance group and route egress through it with a custom default route.