I have am following the architecture described in the google documentation: https://cloud.google.com/vpc/docs/shared-vpc#hybrid_cloud_scenario

This hybrid cloud scenario enables me to have core services accessible within our on-site private network connected via VPN. The services (each of my teams) have their individual projects and use a shared subnet which I have provisioned and shared with that particular project.

The problem I have is how do I govern firewall rules? The projects themselves can't grant firewall rules but lets say I enable a firewall rule that assigns to the tag "public-ssh" which allows port 22 from Anyone in that project can then make a network tag on their infrastructure and inherit this rule.

How do I deny the project teams from adding firewall rules via network tags, but still allow them to create infrastructure?


In this case, IAM roles are what you need.

Specifically, you want to deny the project team users the roles/compute.securityAdmin role.

  • Hello, thanks for taking the time to answer my question but this doesn't provide me with a solution. The role you have suggested does the following: "Permissions to create, modify, and delete firewall rules and SSL certificates" I however already have IAM setup in a way in which project teams can't create firewall rules but it's about how I can restrict them from making network tags that apply existing firewall rules to infrastructure they create. – Adam Pitt Mar 28 '18 at 12:26
  • @AdamPitt So you want them to be able to make instances, but not assign any firewall tags to those instances? If you must distrust them to that degree, they have no business having access to your project. Instead, create a separate project for them, and VPC Peering as appropriate (with firewall rules on your end as you deem fit). – Alex Mar 28 '18 at 14:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy