What's changed: Created Professional Cloud Architect Chapter 3 (Domain 2 "Manage and provision" part 1: IaC = Terraform/Infrastructure Manager, state/modules, CI/CD/PR, avoid clickops, Config Connector; networking = VPC/subnets/firewall, Shared VPC, load balancer types, Cloud NAT, Private Google Access, VPC Service Controls).
3.2Configuring networking (VPC, load balancers, connectivity)
Understand designing VPCs/subnets/firewall rules, centralized management via Shared VPC, Cloud Load Balancing types (global/regional, L7/L4), outbound via Cloud NAT, and secure connectivity via Private Google Access and VPC Service Controls.
The network that securely connects workloads is the backbone of the architecture. Configure VPC design, traffic distribution, and ingress/egress to match requirements.
3.2.1VPC and Shared VPC
A VPC is a global virtual network with per-region subnets (IP ranges) and firewall rules controlling traffic. To centrally manage one network across multiple projects, use Shared VPC (a host project owns the network; service projects use it). Map "centrally manage networks across projects = Shared VPC" and "directly connect two VPCs = VPC peering."
3.2.2Load balancers and secure ingress/egress
Choose Cloud Load Balancing by use: global external HTTP(S) = global external Application LB (L7, routes users to nearest), internal microservices = internal LB, TCP/UDP = Network LB (L4). Outbound from VMs without external IPs = Cloud NAT. Reach Google APIs privately = Private Google Access; protect sensitive services from data exfiltration = VPC Service Controls perimeters. Map "global L7 delivery = external Application LB," "egress without external IP = Cloud NAT," and "anti-exfiltration = VPC Service Controls."
Common: requirement → architecture. E.g., "centralized network across projects" = Shared VPC; "low-latency HTTP(S) to global users" = global external Application LB; "VMs without external IPs reach the internet" = Cloud NAT; "perimeter to prevent exfiltration to BigQuery, etc." = VPC Service Controls; "private reach to Google APIs from VMs" = Private Google Access.
Watch the mix-ups: (1) Shared VPC (central management) and VPC peering (direct VPC-to-VPC) differ. (2) Firewall rules are traffic control, separate from IAM. (3) VPC Service Controls (anti-exfiltration perimeter) is a layer separate from IAM grants.
Cloud CDN works with the external HTTP(S) load balancer to cache static/dynamic content at Google edges, reducing latency and serving cost; control access with cache keys, TTLs, and signed URLs.
3.2.3Section summary
- VPC = global virtual network, subnets, firewall; central management via Shared VPC
- Choose LB by use: global external Application (L7)/internal/Network (L4); egress via Cloud NAT
- Private Google Access for private reach; VPC Service Controls for anti-exfiltration
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. To centrally manage one network across multiple projects, which best fits?
Q2. To deliver an HTTP(S) app to global users at low latency, which load balancer best fits?
Q3. To enable outbound internet access from VMs without external IPs, what do you use?
Q4. To prevent improper data exfiltration to BigQuery, etc. via a perimeter, what do you use?
Q5. Which correctly contrasts Shared VPC and VPC peering?
Q6. To reach Google APIs (e.g., Cloud Storage) privately from VMs without external IPs, what do you use?