View all study notes here

---

Network Security

Cloud NAT (Network Address Translation)

• Fully managed, software defined distributed service that grants VMs with only internal IP addresses the ability to establish outbound connections to the internet.
  • e.g. to fetch OS updates, patches or third party API data
• Blocks unsolicited inbound connections from internet.
  • Outside back actors cannot initiate connections to VMs.
• Every external connection requires an allocated NAT port.
  • Cloud NAT Port Exhaustion
    • e.g thousands of GKE container pods or Compute VMs simultaneously spinning up to poll an external API endpoint, but connection timeouts start occurring at massive scale.
    • Change the Cloud NAT configuration to increase the minimum ports allocated per VM instance or configure dynamic port allocation.

Firewall Policies vs VPC Firewall Rules

• VPC Firewall Rules (legacy)
  • Rules applied directly at the single VPC level using target tags.
• Hierarchical Firewall Policies
  • Allows security admins to create broad, organization wide firewall rule sets and attach them at Organization or Folder level.
  • Evaluated before any lower level VPC or project firewall rules, ensuring enterprise security mandates cannot be overridden by individual project developers.

Network Firewall (Cloud NGFW)

Key Features

• Distributed Firewall Service
  • Applies firewall rules to VM instances, VM based resources, and supported LB in a VPC network to allow traffic, deny traffic, or send traffic to inspection.
• Global and Regional Network Firewall Policies
  • Group firewall rules into policy objects that can be applied consistently across multiple VPC networks, globally or within a specific region.
• Hierarchical Firewall Policies
  • Group rules into policy objects that can be applied at a Organization or Folder level.
    1. Organization <– Hierarchical Policies Evaluated First
    2. Folder <– Hierarchical Policies
    3. Project <– Global Network Firewall Policies
    4. VPC/Region <– Regional Network Firewall Policies
    5. Traditional Rules <– Legacy VPC Firewall Rules (Lowest priority)
• Multi Layer Security
  • At Layer 3, 4 and 7; create firewall rules that control traffic at network and application layer.
• Granular Control and Micro-segmentation
  • Divide network into small, distinct zones to create a zero trust framework for workloads.
  • Use secure tags to enable micro-segmentation and apply granular, identity based security rules to filter internal and external traffic.

Tiers

1. Essentials (free)
   • Applies controls at Layer 3 and Layer 4 (IP ranges, ports, protocols).
   • Supports traditional VPC firewall rules, network firewall policies, and secure tags.
2. Standard
   • Adds Fully Qualified Domain Name (FQDN) objects (filtering traffic based on domain names (e.g. api.github.com) instead of changing IPs)
   • Adds Threat Intelligence (Google-curated lists of known malicious IPs, Tor exit nodes, etc., to automatically block them).
3. Enterprise
   • Adds advanced Layer 7 application layer inspection, such as URL filtering and intrusion detection and prevention.
   • Intrusion Detection and Prevention Service (IDPS)
     • Inspects packet payloads to block network-based threats/vulnerabilities.
   • TLS Inspection
     • Decrypts encrypted traffic to scan for threats.

Requirement / Scenario	Primary Network Tool	Why? (Exam Logic)
Mitigate SQL Injection / XSS / Bad Bots	Cloud Armor	It is a Web Application Firewall (WAF) that integrates directly with External Application LBs.
VMs need patches but must block inbound internet	Cloud NAT	Outbound-only NAT gateway mapped to subnets containing private-IP-only VMs.
Isolate Google APIs to corporate-only access	VPC Service Controls	Creates a security perimeter around services like BigQuery/GCS to prevent malicious data exfiltration.
Map third-party SaaS into VPC securely	Private Service Connect	Exposes the endpoint via a private IP inside your consumer VPC without traditional peering.

---

Key Terms

• HA VPN
  • High availability Cloud VPN
  • Utilize an active-active dual-tunnel setup across different zones to guarantee 99.99% uptime SLA.
• VPC-SC (context)
  • VPC Service Controls.
  • IAM boundary that restricts cross-project networking endpoints to block data exfiltration.
• Cloud NAT
  • Cloud Network Address Translation.
  • Allows VMs without public IPs to securely initiate outbound connections to internet (e.g. for system patches).
• Shared VPC Host Project
  • The centralized project containing master VPC network configurations shared out to secondary service projects.
• Anycast IP
  • A single IP address shared by multiple physical locations globally, used by Google Cloud external load balancers to route users to nearest healthy point.