Question

A financial services company runs analytics VMs in a private VPC subnet with no external IP addresses. Security policy requires that all outbound HTTPS traffic to the internet be inspected and allowed only to a specific list of approved SaaS domains, with TLS inspection and per-request logging. Currently the VMs use Cloud NAT for egress, but the team cannot enforce domain-based allowlists or inspect encrypted traffic. Which Google Cloud solution should they implement to meet these requirements?

Accepted Answer

Deploy Secure Web Proxy (SWP) with a policy that filters egress by URL/host, performs TLS inspection, and logs requests, routing VM traffic through the proxy.

Answer

Add egress firewall rules that deny all traffic except to the resolved IP ranges of the approved SaaS domains.

Answer

Enable Cloud Armor with a custom rule set that allowlists the approved domains on the egress path.

Answer

Configure Cloud NAT with a static outbound IP and enable VPC Flow Logs to record all egress connections.