Question

Your organization uses a Shared VPC host project managed by the central networking team. Application teams operate in service projects and repeatedly file tickets asking networking to create firewall rules for their specific workloads. The networking team wants to delegate firewall rule management for one particular subnet's workloads to an application team, while retaining control over the overall VPC, subnets, and routing. What is the most appropriate way to achieve this?

Accepted Answer

Grant the application team the compute.securityAdmin role at the host project level, but limit exposure by using an IAM condition or by having them manage rules scoped through network tags they own.

Answer

Grant the application team the compute.securityAdmin role on the host project so they can manage all firewall rules and SSL policies.

Answer

Create firewall rules that target the application team's service accounts, then grant the team the Network Admin role on the host project.

Answer

Migrate the application team's workloads out of the Shared VPC into a standalone VPC in the service project so they can manage their own firewall rules.