You have an application where the frontend is deployed on a managed instance group in subnet A and the data layer is stored on a mysql Compute Engine virtual machine (VM) in subnet B on the same…

Question

Options

• AConfigure an ingress firewall rule that allows communication from the src IP range of subnet A to
• BConfigure an ingress firewall rule that allows communication from the frontend's unique service
• CConfigure a network tag "fe-tag" to be applied to all instances in subnet A and a network tag
• DConfigure a network tag "fe-tag" to be applied to all instances in subnet A and a network tag

• A
  5% (2)
• B
  82% (36)
• C
  11% (5)
• D
  2% (1)

Explanation

Using the frontend instances' unique service account as the firewall rule source is the most precise and secure method. A service account is attached to specific instances - in this case, only the frontend VMs - so the ingress rule on the MySQL instance allows traffic on port 3306 only from those exact instances. Using a subnet IP range (A) would allow all VMs in subnet A to access the MySQL port, not just the frontend. Network tags applied to all instances in subnet A (C and D) have the same problem - other VMs in subnet A that share the tag would also gain access. Service-account-based firewall rules follow the principle of least privilege most precisely.

No community discussion yet for this question.