Assigned
Status Update
No update yet.
Comments
ch...@google.com
ch...@google.com
I would like to add on to this
It would be great to have tags be applied at the VPC subnet level as stated. I have two major reasons as to why this would be an excellent addition.
1. When using a Shared VPC design, one of the key sellers is that admins can maintain rules and networking all from the Host project. The flaw with no subnet tags is that users in service must create their own tags. This causes an issue at point 2..
2) Using network tags in firewall rules is the best way to make granular rules. However if a user can control the network tags from their service project that causes an issue with consistency amongst the org. Having subnet level tags can enforce that I continue to use the network tag option in firewall rules as the target and network admins maintain that control and consistency. Also if I have many subnetworks in a VPCs i can have a firewall rule for a specific subnet instead of instance tags which is a problem when service account users have that control.
It would be great to have tags be applied at the VPC subnet level as stated. I have two major reasons as to why this would be an excellent addition.
1. When using a Shared VPC design, one of the key sellers is that admins can maintain rules and networking all from the Host project. The flaw with no subnet tags is that users in service must create their own tags. This causes an issue at point 2..
2) Using network tags in firewall rules is the best way to make granular rules. However if a user can control the network tags from their service project that causes an issue with consistency amongst the org. Having subnet level tags can enforce that I continue to use the network tag option in firewall rules as the target and network admins maintain that control and consistency. Also if I have many subnetworks in a VPCs i can have a firewall rule for a specific subnet instead of instance tags which is a problem when service account users have that control.
Description
This will create a feature request which anybody can view and comment on.
Please describe your requested enhancement. Good feature requests will solve common problems or enable new use cases.
What you would like to accomplish:
Enabling Cloud Firewall Plus functionality without an organization resource. Alternatively, enable Cloud Firewall Plus to be used without granting strong permissions on organizational resources. By doing so, we would like to increase users who can use Cloud Firewall Plus.
How this might work:
IPS resources of Cloud Firewall Plus can also be created at the project level. The IPS resources mentioned here are Security Profile, Security Profile Group, and Firewall endpoint.
If applicable, reasons why alternative solutions are not sufficient:
Currently, these resources can only be created at the organization level.
Other information (workarounds you have tried, documentation consulted, etc):
Documentation for Cloud Firewall Plus is below: