Question

A retail company exposes a public web application behind a global external Application Load Balancer. The security team must ensure that only traffic originating from the corporate offices' well-known egress IP ranges can reach the application, while all other public traffic is blocked at the network edge before hitting the backends. The list of corporate IP ranges is large and changes periodically as new offices open. Which approach best meets these requirements while minimizing maintenance overhead?

Accepted Answer

Attach a Cloud Armor security policy to the load balancer backend service with a default rule that denies traffic and a higher-priority allow rule that matches the corporate ranges using an address group referenced in the rule expression.

Answer

Create VPC ingress firewall rules on the backend instances that allow the corporate source ranges and deny 0.0.0.0/0, relying on the firewall to filter external client traffic.

Answer

Configure the load balancer's frontend forwarding rule to accept connections only from the corporate CIDR ranges specified directly in the forwarding rule configuration.

Answer

Enable Cloud NAT with a restricted set of external IPs and route all inbound application traffic through it so only corporate ranges are translated.