Shared Vpc Host Service Project Iam Subnet Allocation

What this solution is

This architecture establishes a Shared VPC design where a single central host project manages underlying network topology and routing, while separate service projects host workloads managed by decentralized application teams. Subnet-level IAM access binding provides granular network segregation across service projects.

How it meets the requirements

• Centralized Network Administration: Granting roles/compute.networkAdmin exclusively to the central team on the host project (net-host-prod) guarantees that only network engineers can modify network routes, subnets, and global configurations.
• Subnet Isolation and Least Privilege: Applying the Compute Network User (roles/compute.networkUser) role directly to individual subnets (team-a-subnet and team-b-subnet) ensures that each team can only attach network interfaces to their authorized IP range. Team A cannot provision resources into Team B's subnet.
• Workload and MIG Provisioning: Granting roles/compute.instanceAdmin.v1 inside the respective service projects allows developers to manage virtual machines and templates. Binding roles/compute.networkUser on the subnet to the service project's Google APIs service account (SERVICE_PROJECT_NUM@cloudservices.gserviceaccount.com) is a mandatory requirement for automated instance provisioning in Managed Instance Groups (MIGs).

Key advantages and capabilities

• Prevents Configuration Drift: Centralized VPC governance prevents individual application teams from altering network topologies or IP allocations.
• Enforces Security Boundaries: Eliminates unauthorized cross-tenant subnet usage without requiring complex firewall rules.
• Automates Scaling Securely: Grants service robots the exact permissions needed to provision instances during autoscaling events.
• Accurate Cost Attribution: Resource and egress billing remains attributed to the service project where instances reside.

Why this is optimal

Subnet-level IAM role delegation is the Google-recommended best practice for multi-tenant and multi-environment Shared VPC deployments. It separates administrative duties while strictly constraining resource placement across service projects.