An organization has multiple projects under an organization node. They need to enforce a security policy that denies all inbound SSH traffic (tcp:22) to all VMs across all projects, but must allow certain projects to override this. Which approach should be used?
Trap 1: Use VPC Service Controls to create a service perimeter that blocks…
VPC Service Controls is for data exfiltration, not for firewall rules.
Trap 2: Create a hierarchical firewall policy at the organization level…
Hierarchical firewall policies target VMs via tags or service accounts, not projects. Also, a lower-priority allow rule would apply to all matching VMs, not just specific projects.
Trap 3: Create a hierarchical firewall policy at the organization level…
Hierarchical deny rules cannot be overridden by VPC-level allow rules.
- A
Use VPC Service Controls to create a service perimeter that blocks SSH traffic to all projects.
Why wrong: VPC Service Controls is for data exfiltration, not for firewall rules.
- B
Create a hierarchical firewall policy at the organization level with a rule that allows SSH for specific projects (using target service accounts or tags) at priority 1000, and a deny rule for all SSH at priority 2000.
Why wrong: Hierarchical firewall policies target VMs via tags or service accounts, not projects. Also, a lower-priority allow rule would apply to all matching VMs, not just specific projects.
- C
Create a network firewall policy for each VPC with a deny rule for SSH. Use service accounts for exceptions.
This allows per-VPC firewall policies with deny rules and service accounts for exceptions, enabling project-specific overrides.
- D
Create a hierarchical firewall policy at the organization level denying SSH (tcp:22). Then create a network firewall policy at each VPC allowing SSH for exempted projects.
Why wrong: Hierarchical deny rules cannot be overridden by VPC-level allow rules.