Question

A financial services company runs a fleet of backend processing VMs in a private subnet with no external IP addresses. These VMs must call a third-party payment partner's REST API over the public internet. The partner requires that all inbound traffic originate from a small, fixed set of source IP addresses that the company must register on the partner's allowlist. The security team also needs to guarantee the egress source addresses do not change over time. How should you configure egress connectivity?

Accepted Answer

Deploy Cloud NAT configured with manually reserved static external IP addresses, and register those reserved IPs on the partner's allowlist.

Answer

Assign ephemeral external IP addresses to each VM and provide the partner with the current set of assigned IPs.

Answer

Deploy Cloud NAT with automatic NAT IP address allocation so Google Cloud scales the addresses as traffic grows, then register the allocated pool with the partner.

Answer

Route egress through a Secure Web Proxy instance and register the proxy's dynamically assigned IP with the partner.