3.3.2. Firewall Rules and Cloud NGFW Policies
💡 First Principle: Google Cloud VPC firewall rules are stateful, which means a firewall decision made about a connection's first packet automatically governs the rest of that connection's traffic in both directions — you're not writing separate rules for a request and its response.
Firewall rules are defined by direction (ingress or egress), action (allow or deny), and match criteria (source/destination, protocol, port), and because they're stateful, allowing an inbound connection on a port automatically permits the corresponding outbound response traffic without a separate egress rule. Cloud Next Generation Firewall (Cloud NGFW) extends this model with centrally-managed policies that can apply across many VPCs at once, rather than configuring firewall rules VPC-by-VPC. Tags (including secure tags, which are IAM-governed and can't be renamed by just anyone with compute access) and service accounts can be used as the match criteria in a rule instead of IP ranges — letting a rule apply to "any instance running this service account" regardless of that instance's actual IP address, which matters when instances are created and destroyed dynamically by autoscaling.
⚠️ Exam Trap: VPC firewall rules are stateless like access control lists in some other networking contexts — a common but incorrect assumption. Google Cloud VPC firewall rules are stateful: allowing an inbound connection automatically permits the corresponding outbound response traffic, so writing a matching manual outbound "allow" rule for the same connection is unnecessary and not how the exam expects you to reason about it.
Reflection Question: An autoscaled group of instances constantly creates and destroys VMs with different IP addresses. What firewall match criteria lets a rule consistently apply to this group without needing constant updates as IPs change?
