The Missing Links: Network Tiers, Shared VPC IAM & Cloud IDS

Every certification exam has topics that feel “minor” until you encounter three questions about them in a row. These are the concepts that sit between the major pillars—not important enough for their own dedicated section in the study guide, but tested frequently enough that ignoring them is a gamble. Network Service Tiers, Shared VPC IAM roles, and Cloud IDS are exactly that kind of topic. These are the missing links that complete your understanding.

Network Service Tiers: Premium vs. Standard

Google Cloud is the only major cloud provider that lets you choose the quality of your network path. Every outbound packet from your Google Cloud resources can travel on one of two tiers.

Premium Tier (Default)
  1. Traffic enters and exits Google’s network at the PoP closest to the user.
  2. The packet rides Google’s private backbone for as long as possible (“Hot Potato” routing—Google holds the packet as long as it can).
  3. Result: Lower latency, higher reliability, global load balancing with Anycast.
  4. Cost: Higher.
Standard Tier
  1. Traffic enters and exits Google’s network at the PoP closest to the Google Cloud region where your VM lives.
  2. The packet rides the public internet for the majority of its journey (“Cold Potato” routing—Google hands the packet off as quickly as possible).
  3. Result: Higher latency, no global Anycast, regional load balancing only.
  4. Cost: Lower.

The exam decision shortcut: If the requirement mentions “global load balancing” or “Anycast IP,” Premium Tier is mandatory. If it mentions “cost optimization” and the application is region-specific, Standard Tier is acceptable.

Shared VPC IAM: The Permission Model

Shared VPC is the enterprise standard for multi-team networking in Google Cloud. But the IAM model is complex, and the exam tests it specifically.

The Roles
  1. Shared VPC Admin (compute.xpnAdmin): The person who can designate a Host Project and attach Service Projects. This is a high-privilege role, typically held only by the network team lead.
  2. Network User (compute.networkUser): Grants a user or service account permission to use subnets in the Host Project. Without this, a developer in a Service Project cannot create VMs in the shared subnets.
  3. Network Admin (compute.networkAdmin): Can create and manage firewall rules, routes, and subnets in the Host Project.
  4. Security Admin (compute.securityAdmin): Can create and manage firewall rules only—not routes or subnets. This is the “security team” role.
  5. Host Service Agent User (compute.hostServiceAgentUser): Required for managed services (like GKE or Dataflow) in a Service Project to create resources in the Host Project’s network.

If the exam says “a GKE cluster in a Service Project cannot create nodes in the Shared VPC,” the answer is missing compute.networkUser on the GKE service account for the specific subnet, or missing compute.hostServiceAgentUser at the project level.

Cloud IDS: Passive Intrusion Detection

Cloud IDS is a managed intrusion detection service powered by Palo Alto Networks’ threat intelligence. Unlike Cloud NGFW (which is inline and blocking), Cloud IDS is passive—it mirrors traffic, analyzes it, and alerts you to threats without blocking anything.

Architecture
  1. IDS Endpoint: A regional resource deployed in a specific zone. It receives mirrored traffic.
  2. Packet Mirroring Policy: Configures which VMs or subnets have their traffic mirrored to the IDS endpoint.
  3. Alerts: Logged to Cloud Logging and visible in the Security Command Center.
Use Case

You want visibility into attacks without risking false-positive blocks on legitimate traffic. Cloud IDS sees everything—malware, command-and-control traffic, lateral movement—and reports it. You decide what to block, using the intelligence to update your firewall rules or Cloud Armor policies.

Putting it Together: A Pro-Engineer View

Imagine you are designing the network for a government agency. Cost is important but security is paramount. You deploy Premium Tier for your citizen-facing portal (global Anycast is required) but Standard Tier for your internal analytics pipeline (region-specific, cost-sensitive). Your Shared VPC has strict IAM: only two people hold xpnAdmin, the network team has networkAdmin, and the security team has securityAdmin. Developers in service projects have networkUser scoped to specific subnets—they cannot create resources in the production subnet. Cloud IDS mirrors traffic from all production subnets, feeding threat intelligence to your SOC team in real time. Every layer, every role, every tier—deliberately chosen, not defaulted.

Related Posts