Question

A financial services company runs workloads across 40 projects in three folders (prod, staging, dev) under a single organization. The security team must enforce a non-overridable rule that blocks all inbound RDP (TCP 3389) from the public internet across every current and future project, while still allowing individual project owners to define their own application-specific firewall rules for other ports. What is the most effective way to implement this?

Accepted Answer

Create a hierarchical firewall policy at the organization level with a deny rule for TCP 3389 from 0.0.0.0/0 and action 'goto_next' disabled, then associate it with the organization node.

Answer

Add a high-priority deny VPC firewall rule for TCP 3389 in each project's VPC and use an organization policy to prevent project owners from editing it.

Answer

Configure a Cloud Armor security policy that denies TCP 3389 and attach it to the external load balancer in every project.

Answer

Create a firewall rule in the Shared VPC host project denying TCP 3389 so that all service projects inherit the block.