You have deployed several instances on Compute Engine.
As a security requirement, instances cannot have a public IP address.
There is no VPN connection between Google Cloud and your office, and you need to connect via SSH into a specific machine without violating the security requirements.
What should you do?
Click on the arrows to vote for the correct answer
A. B. C. D.D.
https://cloud.google.com/solutions/connecting-securelyThe correct answer is C. Configure Identity-Aware Proxy (IAP) for the instance and ensure that you have the role of IAP-secured Tunnel User. Use the gcloud command line tool to SSH into the instance.
Explanation: In this scenario, the requirement is to connect to a specific machine in Compute Engine without violating the security requirements that prohibit the use of a public IP address.
Option A is incorrect because Cloud NAT is used to provide outbound internet connectivity to instances that do not have an external IP address. It doesn't provide access to instances from the internet.
Option B is incorrect because TCP Proxy Load Balancing is used to distribute traffic across multiple instances, and it doesn't provide access to instances from the internet.
Option D is incorrect because it involves creating a bastion host, which is an additional instance that provides secure access to other instances in the network. This solution adds unnecessary complexity and cost to the infrastructure.
Option C is the correct solution because Identity-Aware Proxy (IAP) provides secure access to Compute Engine instances without requiring a public IP address or a VPN connection. With IAP, users can connect to instances via a secure tunnel, using their Google Cloud credentials. To use IAP, you need to ensure that the instance is configured for IAP and that you have the role of IAP-secured Tunnel User.
To connect to the instance using IAP, you can use the gcloud command-line tool with the following command:
cssgcloud compute ssh INSTANCE_NAME --tunnel-through-iap This command initiates an SSH connection to the instance via a secure tunnel created by IAP. You can replace INSTANCE_NAME with the name of the instance you want to connect to.
Overall, IAP provides a secure and easy-to-use solution for accessing Compute Engine instances without violating security requirements.