Question

A financial services company runs all production workloads in a single GCP folder called 'prod'. A recent audit found that several Compute Engine VMs were created with external IP addresses, violating the company's policy that production instances must only be reachable through internal networking and Cloud NAT. The security team wants to prevent any future VM in the 'prod' folder from being assigned an external IP, while allowing developers in a separate 'sandbox' folder to continue using external IPs for testing. What is the most effective way to enforce this?

Accepted Answer

Apply the 'constraints/compute.vmExternalIpAccess' list constraint at the 'prod' folder with an empty allowed values list to deny all external IPs, and leave the 'sandbox' folder unaffected.

Answer

Create a custom IAM role without the compute.instances.create permission and assign it to all developers in the 'prod' folder.

Answer

Apply the 'constraints/compute.vmExternalIpAccess' constraint at the organization node with 'Deny All' so it is inherited everywhere.

Answer

Configure a VPC firewall rule in the 'prod' projects to block all ingress traffic from external IP ranges.