Professional Cloud Security Engineer

Architect Hierarchical Firewall Policies and Granular VPC Filtering Rules

Centralized Firewall Hierarchy and Micro-segmentation

Hierarchical firewall policies enforce foundational security controls at the organization and folder levels, ensuring mandatory rules apply consistently before any VPC-level rules run. Within individual VPC networks, security teams implement micro-segmentation to restrict lateral movement between workloads without relying strictly on static IP address schemes. Security policies bind to workloads using service accounts, network tags, or secure tags, allowing access controls to follow compute instances dynamically across their lifecycle. Using identity-based controls like service accounts prevents unauthorized instances from inheriting permissive access simply by occupying an existing IP subnet.

Network Observability and Logging

Verifying boundary enforcement requires comprehensive metadata capture through firewall rule logging and VPC Flow Logs. Firewall rule logging captures metadata for specific allow or deny rules, allowing security administrators to verify that traffic-blocking rules function as expected and to measure connection impact. VPC Flow Logs sample network flows to and from compute instances and container nodes, creating an audit trail of internal and external network communications. Combining firewall logs with flow logs provides the deep operational visibility necessary for rapid intrusion analysis, forensic auditing, and regulatory compliance validation.

Segmentation Topologies and Deep Inspection

Selecting the right boundary design depends on the required inspection depth and the operational boundary between environments:

• Separate Shared VPC networks isolate distinct environments like development and production, centralizing route and policy administration while completely separating data planes.
• Hub-and-spoke architectures route multi-VPC traffic through centralized network virtual appliances (NVAs) when workloads require advanced Layer 7 inspection and deep packet analysis.
• Direct VPC peering connects environments without intermediaries, though organizations should avoid connecting distinct trust environments over peering to prevent accidental data mixing and quota exhaustion.

Evaluate VPC Network Peering Security Properties and Route Governance

Non-Transitivity and Boundary Constraints

VPC Network Peering connects two VPC networks using internal IP routing, but it strictly enforces non-transitive routing behavior. If VPC A peers with VPC B, and VPC B peers with VPC C, traffic from VPC A cannot traverse through VPC B to reach VPC C. This boundary prevents lateral network hops across untrusted intermediate networks and requires explicit, direct peering links between any two networks that need to communicate. Because routes alone do not provide security filtering, firewalls in both peered networks must explicitly evaluate and permit authorized ingress and egress traffic.

Route Export and Import Governance

Traffic across a peering connection depends on granular route export and route import configurations applied on both sides of the link. Each VPC network administrator determines whether to export custom subnet or static routes to the peer and whether to import routes advertised by the peer network. Properly configuring these controls prevents routing table conflicts, hides sensitive internal subnets from peer visibility, and enforces a least-privilege routing topology. If both networks advertise overlapping IP ranges, the peering connection will fail to establish, protecting existing routing tables from accidental route hijacking.

Policy-Driven Interconnect Governance

Organizations control cross-network connectivity using organizational policies and boundary controls:

• Organizational policy constraints, such as the restriction on VPC peering, centrally control which projects can establish peering relationships to prevent shadow network bridges.
• VPC Service Controls establish data perimeters around managed resources, blocking data exfiltration even if an unauthorized peering link is established at the network layer.
• Hierarchical firewall rules maintain top-level security boundaries by overriding local VPC allow rules, preventing peered networks from accessing restricted management interfaces.

Implement Secure Shared VPC Topologies and Administrative Role Separation

Host and Service Project Segregation

A Shared VPC architecture centralizes core networking assets within a designated host project while enabling application teams to deploy workloads into linked service projects. This separation creates a strict security boundary by preventing service project developers from modifying subnets, altering routes, or tampering with firewall rules. Centralized network engineers control shared infrastructure like VPN gateways and interconnects within the host project, ensuring consistent enterprise egress policies. Isolating production and non-production environments into completely distinct Shared VPC host networks prevents lateral network compromise between environments.

Administrative Role Separation and Least Privilege

Enforcing administrative role separation requires assigning specific Identity and Access Management (IAM) roles across host and service projects:

• Shared VPC Admin: Operates in the host project to associate service projects with the host network and delegate subnet access.
• Compute Network Admin: Manages centralized network infrastructure, including routing tables, Cloud NAT gateways, and firewall policies in the host project.
• Service Project Admin: Manages compute resources, disks, and workloads within a service project without permissions to modify the underlying network architecture.

Subnet-Level Access and Security Perimeters

To enforce least privilege within the shared network, administrators grant the Compute Network User role (roles/compute.networkUser) on specific, individual subnets rather than across the entire host project. This configuration restricts service project teams to pre-approved network tiers, such as distinct workload subnets, while blocking access to sensitive management subnets. For end-to-end data protection, security teams must configure VPC Service Controls to encompass both the host project and all linked service projects within the same perimeter. Placing all participating projects inside the perimeter preserves internal Shared VPC communication while blocking data exfiltration to external projects.