An enterprise is planning a large-scale migration of on-premises workloads and databases across multiple departments to Google Cloud. The migration strategy requires a secure, scalable network architecture that satisfies the following criteria: Centralized Administration: Network resources, routing policies, and security perimeters must be managed centrally by a core networking team, while individual application teams manage their own workloads in separate projects. Hybrid Connectivity Reuse: On-premises systems must connect over a high-bandwidth, redundant Cloud Interconnect connection without requiring each departmental project to provision its own dedicated physical links. Multi-Region Reachability: Workloads deployed across multiple Google Cloud regions must communicate dynamically with the on-premises environment, prioritizing local paths while maintaining reachability to all VPC subnets. Which network architecture should you design to meet these requirements?

Deploy a Shared VPC host project with dynamic routing set to global on the Cloud Router, attach departmental service projects, and provision Cloud Interconnect VLAN attachments in the Shared VPC host project.: What Shared VPC with Global Dynamic Routing Is Shared VPC allows an organization to connect resources from multiple service projects to a common, centrally managed Virtual Private Cloud (VPC) network. When combined with Cloud Interconnect and a Cloud Router configured for global dynamic routing, the Cloud Router uses External Border Gateway Protocol (eBGP) to advertise all subnets across all regions within the VPC to the on-premises network while dynamically learning on-premises routes. How It Meets the Requirements Centralized Administration: The host project centralizes the creation and governance of subnets, firewall rules, and routes under the network administrator team. Departmental teams are delegated permissions as Service Project Admins to deploy compute resources into specific shared subnets without managing network infrastructure. Hybrid Connectivity Reuse: Provisioning Cloud Interconnect with VLAN attachments in the Shared VPC host project enables all VM instances across all attached service projects to utilize the high-speed hybrid connection without replicating interconnect attachments in individual projects. Multi-Region Reachability: Configuring the Cloud Router with global dynamic routing advertises subnets from all Google Cloud regions to the on-premises network. It automatically computes a metric penalty (MED) for routes outside the local region to maintain traffic symmetry and prefer local interconnect paths. Key Advantages and Capabilities Operational Efficiency: Eliminates duplicate interconnect circuits, VPN gateways, and complex point-to-point routing topologies. Dynamic Route Propagation: BGP dynamically exchanges route prefixes without requiring manual static route updates when new subnets are added. Granular Access Control: Network User IAM roles can be granted at the individual subnet level to preserve team boundaries. Predictable Performance: Dedicated bandwidth via Cloud Interconnect provides consistent latency and high throughput for heavy data transfers. Why This Is Optimal This architecture is the recommended best practice for enterprise hybrid deployments in Google Cloud. It provides strict security and operational isolation between the network administration team and application teams while establishing a unified, high-performance routing fabric across multiple regions.