An enterprise organization implements a hub-and-spoke network architecture in Google Cloud. The architecture includes a centralized hub-vpc connected to an on-premises data center using Cloud Interconnect, and a separate spoke-vpc hosting application workloads. The two VPCs are interconnected using VPC Network Peering. The security and network engineering teams have established the following requirements: On-premises servers must be able to route traffic to the VM instances residing in spoke-vpc through hub-vpc. Cloud Router in hub-vpc must advertise the spoke-vpc address spaces to the on-premises Border Gateway Protocol (BGP) peers. Ingress firewall filtering in hub-vpc must restrict incoming traffic based on the identity of workloads running in spoke-vpc without using IP CIDR blocks or non-functional cross-peering constructs. Which combination of routing configurations and firewall controls should the organization implement?

Configure custom IP range route advertisements on the `hub-vpc` Cloud Router, enable custom route export in `hub-vpc` and custom route import in `spoke-vpc`, and enforce ingress filtering using IAM-governed secure Resource Manager Tags as sources in network firewall policies.: What the Solution Is This solution pairs VPC Network Peering custom route exchange and Cloud Router custom route advertisements with IAM-governed Resource Manager Tags to satisfy cross-VPC hybrid routing constraints and strict boundary micro-segmentation. How It Meets the Requirements Overcoming Non-Transitivity for Hybrid Routing: VPC Network Peering is inherently non-transitive and does not automatically advertise peered VPC subnets across Cloud Interconnect. Configuring custom IP range advertisements on the hub-vpc Cloud Router allows on-premises BGP routers to learn routes to spoke-vpc subnets. Route Exchange Governance: Enabling custom route export on the hub-vpc peering configuration and custom route import on the spoke-vpc peering configuration permits on-premises dynamic routes learned by Cloud Router in hub-vpc to be imported into spoke-vpc. Cross-Peering Identity Filtering: While legacy network tags and service accounts cannot be resolved across VPC peering boundaries for ingress rules, secure Resource Manager Tags attached to VM instances are recognized across peered VPC networks when defined as the source in network firewall policies. Key Advantages and Capabilities Scalable Hybrid Transit Routing: Avoids deploying intermediate proxy gateways by utilizing native Cloud Router BGP custom route advertisements. Secure Workload Attribution: Resource Manager Tags are centrally managed with IAM controls (roles/resourcemanager.tagUser), preventing unauthorized VM tagging by local project administrators. Dynamic Boundary Segmentation: Policies update automatically as tagged instances scale up or down across peered VPCs without manual firewall IP updates. Preservation of Administrative Separation: Peered networks retain autonomous management while adhering to organizational routing and security rules. Why This Is Optimal Native custom route exchange and custom BGP advertisements eliminate latency overhead and maintenance burdens associated with Network Virtual Appliances (NVAs), while secure Resource Manager Tags provide the only native mechanism in Google Cloud network firewall policies to identify source workloads across VPC peering boundaries.