Question

A financial services company runs sensitive workloads on Compute Engine VMs in a single VPC. The security team wants to ensure that, by default, no VM can initiate outbound connections to the internet or other networks, and that only explicitly approved destinations (a set of partner IP ranges over TCP 443) are reachable. The default VPC egress behavior must be overridden without deleting any implied rules. What is the recommended way to configure this?

Accepted Answer

Create a high-priority egress 'deny' firewall rule for destination 0.0.0.0/0 and a higher-priority egress 'allow' rule scoped to the approved partner ranges on TCP 443.

Answer

Delete the implied allow-egress rule and create a single egress 'allow' rule for the partner ranges on TCP 443.

Answer

Create an ingress 'deny' rule for 0.0.0.0/0 and an ingress 'allow' rule for the partner ranges on TCP 443.

Answer

Enable VPC Service Controls to block all egress and add the partner ranges to an egress access level.