Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Shared Vpc Hierarchical Firewall Policy Inheritance

Section: Security controls (e.g., auditing, VPC Service Controls, context aware access, organization policy, and hierarchical firewall policy)

An enterprise organizes its Google Cloud resource hierarchy into distinct folders for network infrastructure and business workloads. The Shared VPC host project resides in the Core-Networking folder, while multiple service projects containing Compute Engine virtual machines (VMs) reside in the App-Workloads folder.

The central security team applies a hierarchical firewall policy to the Core-Networking folder that denies ingress TCP traffic on port 22. To allow remote access, a development team attaches another hierarchical firewall policy directly to the App-Workloads folder with a high-priority rule allowing ingress TCP traffic on port 22. However, SSH traffic to the VMs connected to the Shared VPC subnets remains blocked.

Why is the ingress traffic on TCP port 22 still blocked on these VM instances?

The hierarchical firewall policy applied to the App-Workloads folder requires an Organization Policy override to take effect on Compute Engine instances.

Hierarchical firewall policies assigned at a parent folder level permanently override all rules defined on any child folders regardless of priority.

Service project VM instances only evaluate local VPC firewall rules and ignore all organization or folder-level hierarchical firewall policies.

In a Shared VPC deployment, VM network interfaces are governed by the hierarchical firewall policies of the host project hierarchy rather than the service project hierarchy.

Professional Cloud Architect

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Shared Vpc Hierarchical Firewall Policy Inheritance

Section: Security controls (e.g., auditing, VPC Service Controls, context aware access, organization policy, and hierarchical firewall policy)

Why is the ingress traffic on TCP port 22 still blocked on these VM instances?

The hierarchical firewall policy applied to the App-Workloads folder requires an Organization Policy override to take effect on Compute Engine instances.

Hierarchical firewall policies assigned at a parent folder level permanently override all rules defined on any child folders regardless of priority.

Service project VM instances only evaluate local VPC firewall rules and ignore all organization or folder-level hierarchical firewall policies.

In a Shared VPC deployment, VM network interfaces are governed by the hierarchical firewall policies of the host project hierarchy rather than the service project hierarchy.

Explanations

What Shared VPC Policy Evaluation Is

In Google Cloud networking, hierarchical firewall policies allow organizations to define and enforce consistent firewall rules across resource hierarchy nodes such as organizations and folders. When resources utilize Shared VPC, network interfaces attached to shared subnets reside logically within the shared network hosted by the host project.

How It Meets the Scenario Requirements

Host Project Governance: In Shared VPC architectures, a VM network interface connected to a host project network is strictly governed by the hierarchical firewall policy rules associated with the host project's resource hierarchy (the Core-Networking folder).
Bypassing Service Project Hierarchy: Even though the VM instances physically reside in service projects inside the App-Workloads folder, the network interfaces inherit policies from the ancestry of the VPC network they attach to, completely ignoring the hierarchical firewall policies applied to the App-Workloads folder.

Key Advantages and Capabilities

Centralized Security Enforcement: Prevents service project administrators or folder admins from inadvertently weakening or bypassing enterprise perimeter security.
Consistent Network Perimeter: Guarantees that network security rules travel with the VPC network boundary rather than fragmented departmental folders.
Clear Separation of Duties: Grants network and security administrators total control over traffic flow into shared infrastructure.
Hierarchical Predictability: Enforces deterministic rule evaluation across complex multi-tenant environments.

Why This Is Optimal

This model preserves strict centralized security boundaries across enterprise cloud deployments. It prevents decentralized teams in child folders from opening security holes on corporate shared networks, ensuring compliance across all connected workloads.

View source documentation

Professional Cloud Architect

Shared Vpc Hierarchical Firewall Policy Inheritance

Professional Cloud Architect

Shared Vpc Hierarchical Firewall Policy Inheritance

What Shared VPC Policy Evaluation Is

How It Meets the Scenario Requirements

Key Advantages and Capabilities

Why This Is Optimal

Related questions