Question

A financial services company runs application VMs in a private subnet (no external IPs) that must reach a specific list of approved SaaS HTTPS endpoints on the internet. Security requires that egress be filtered by fully-qualified domain name (not just IP), that TLS sessions be intercepted and inspected against the allowlist, and that all egress decisions be centrally logged. The team already uses Cloud NAT for other workloads. Which approach meets these requirements?

Accepted Answer

Deploy Secure Web Proxy (SWP) with a TLS inspection policy and URL/host-based security policy rules, and route the VMs' egress web traffic through the SWP endpoint.

Answer

Configure Cloud NAT with a manual static IP and add VPC firewall egress rules that allow only the approved destination FQDNs.

Answer

Create a Cloud Armor security policy with preconfigured WAF rules and attach it to the VMs to filter outbound HTTPS by hostname.

Answer

Enable Private Google Access on the subnet and use hierarchical firewall policies to allow egress only to the approved SaaS domain names.