GCP Networking Overview

Networking in the GCP Campus Cloud is centrally managed. You cannot create VPC networks yourself — a deny policy blocks VPC creation for all users. Only the Cloud Team’s automation account can provision network resources.

Your project is automatically attached to the campus Shared VPC at provisioning, giving you outbound internet access via Cloud NAT immediately. For anything beyond that, open a ServiceNow ticket.

Current State

Org Policy Networking Constraints

The following constraints are enforced across all projects:

• No VPC creation — users cannot create VPC networks; only the Cloud Team’s automation can provision them.
• Custom-mode VPCs only — auto-mode VPCs (which create subnets in every region) are blocked by a custom constraint.
• No external IP addresses on VMs — VMs may not have public IPs. Outbound internet access is provided via Cloud NAT.
• Allowed regions: us-central1 (Iowa) and us-west1 (Oregon) only.
• VPC flow logs required — subnets without flow logs cannot be created.

Requesting Network Resources

Your project is automatically attached to the campus Shared VPC at provisioning and receives outbound internet access via Cloud NAT — no ticket is needed for basic connectivity.

For anything beyond standard outbound access (additional subnets, VPC peering, firewall rule changes), open a ServiceNow ticket (Cloud Services) with:

• Your GCP project ID
• What you need and why
• The region (us-central1 or us-west1)
• Any specific CIDR or peering requirements

Creating Compute Instances

When creating a VM in the Cloud Console, the Network interfaces section defaults to Networks in this project. Because your project has no local VPC (blocked by org policy), this view is always empty.

To place your VM on the campus Shared VPC, on the Networking tab:

1. Click Add a network interface (or Add a Dynamic Network Interface).
2. Click Networks shared with me.
3. Choose a subnet from the Shared subnetwork dropdown.
4. Click Done.

If Networks shared with me shows no subnets, your identity may not have Shared VPC access. See Adding Team Members to the Shared VPC below.

Adding Team Members to the Shared VPC

Your project and its default service accounts can use the campus Shared VPC right away — no request needed.

Shared VPC access for other people is granted through the project’s -owners@gcp.cloud.ucsb.edu and -editors@gcp.cloud.ucsb.edu Google Groups — anyone added to either group gets Shared VPC access automatically. No ServiceNow ticket is needed.

See Adding and Removing Users for how to manage group membership. Allow up to 30 minutes for access to propagate after adding someone.

Accessing Private VMs Without a Public IP

Since VMs cannot have external IPs, use Identity-Aware Proxy (IAP) for SSH and RDP access. IAP tunnels traffic securely without requiring a VPN or public IP.

See Google’s official guide: Using IAP for TCP forwarding

Network Tags for IAP Access

Your VM must have the correct network tag for IAP to reach it. Without these tags, no inbound traffic is allowed — not from the internet, not from IAP.

How to add a network tag — see Google’s guide for full instructions:

• Console: VM instance → Edit → Networking → Network tags field → Save.
• gcloud: gcloud compute instances add-tags INSTANCE --zone=ZONE --tags=allow-iap-ssh
• Terraform: Add tags = ["allow-iap-ssh"] to your google_compute_instance resource.

SSH Access

• Console SSH button: Open the VM in the Cloud Console and click SSH. This uses IAP automatically — no local software needed.
• gcloud: gcloud compute ssh VM_NAME --tunnel-through-iap

RDP Access

• IAP Desktop (recommended): Download IAP Desktop — a free Windows app that handles IAP tunneling and RDP in a single window. No gcloud installation required.
• gcloud tunnel: gcloud compute start-iap-tunnel VM_NAME 3389 --local-host-port=localhost:3389, then connect your RDP client to localhost:3389.

Required IAM Roles

To connect via IAP, users need:

• roles/iap.tunnelResourceAccessor — permission to create IAP tunnels
• roles/compute.osLogin (or roles/compute.osAdminLogin) — OS Login access to the VM

OS Login

OS Login is enforced by org policy across all GCP Campus Cloud projects. This means SSH access uses your Google identity — there are no project-wide SSH keys to manage, share, or rotate.

What this means for you:

• Console SSH just works. Click the SSH button in the Cloud Console; it handles OS Login automatically.
• gcloud SSH just works. gcloud compute ssh uses your Google identity by default.
• You cannot disable OS Login in project metadata. The org policy overrides any project-level setting.
• Traditional SSH keys (project metadata or instance metadata) are ignored when OS Login is enforced.

If your project has a specific need to disable OS Login (e.g. a Marketplace image that is incompatible), open a ServiceNow ticket and the Cloud Team will evaluate an exception.

Public-Facing Services

Public access is not allowed by default — even for serverless services. Two org policies work together to keep your services private: one requires authenticated (IAM-based) access to Cloud Run and Cloud Functions, and a separate one blocks granting access to allUsers. By default these services are reachable only by identities you authorize, not the open internet.

Public traffic is supported when a workload genuinely needs it — you just have to request it. There are two paths, depending on what you’re running.

Public Cloud Run or Cloud Functions (no load balancer)

If you need a serverless service to accept unauthenticated public traffic (a public website, an API, a webhook receiver), open a ServiceNow ticket. The Cloud Team relaxes both guardrails for that one project, after which you can publish the service on its built-in HTTPS URL. This is free — no additional infrastructure.

VM-based apps, or a WAF in front of a public app

For VM-based workloads that need a public-facing endpoint, or if you want a WAF and DDoS protection in front of a public Cloud Run service, open a ServiceNow ticket. The Cloud Team will provision an external Application Load Balancer with Cloud Armor (Google’s WAF and DDoS protection) on your behalf. You cannot create external load balancers yourself — they are blocked by org policy. This option carries a monthly cost for the load balancer and WAF, billed to your project.

Services That Work Without a VPC

Many GCP services do not require a VPC at all:

• Cloud Storage
• BigQuery
• Pub/Sub
• Cloud Functions
• Cloud Run
• Vertex AI

If your workload uses only managed services, you may not need to request network provisioning.