Question

A retail company uses a Shared VPC where the network team owns the host project and application teams deploy Compute Engine instances into attached service projects. The security team wants application teams to be able to target their own VM instances with firewall rules WITHOUT granting them the ability to create or modify firewall rules directly, and without relying on network tags that any instance owner could freely apply. Which approach best meets these requirements?

Accepted Answer

Have the network team define firewall rules in the host project that reference secure tags (tag-based firewalling) bound to specific resources, and grant application teams only the Tag User permission on the relevant tag values.

Answer

Grant application teams the Compute Network Admin role on the host project so they can manage firewall rules scoped to their instances.

Answer

Instruct application teams to apply network tags to their VMs and create matching firewall rules in each service project.

Answer

Grant application teams the Compute Security Admin role on the Shared VPC host project and rely on network tags for targeting.