A software-as-a-service (SaaS) provider is building a multi-tenant application on Google Cloud. They need to isolate customer data and resources securely, ensuring that one customer's environment cannot accidentally or maliciously access another's. While IAM provides access control, they require an additional layer of isolation at the network and resource level to create strong logical boundaries between tenants. Which Google Cloud feature is specifically designed to isolate resources and networks for multi-tenant architectures?
- AProjects and Folders
- BVPC Service Controls
- CShared VPC
- DVPC Network Peering
Show answer & explanationAnswer & explanation
Correct answer: A. Projects and Folders
Google Cloud Projects and Folders provide the fundamental hierarchical structure for organizing resources and enforcing isolation. Each project acts as a strong security boundary, isolating resources, networks, and billing. For multi-tenant applications, allocating a separate project (or a set of projects under a folder) per tenant provides the necessary isolation at the network, resource, and IAM level, which is a common and recommended practice for multi-tenancy.
Why the other options are wrong
- B. VPC Service Controls establishes perimeters to prevent data exfiltration *within* an organization but is not the primary mechanism for isolating separate tenants from each other at the resource level; it complements project-level isolation.
- C. Shared VPC allows multiple projects to share a *common* VPC network, which is the opposite of providing strong network isolation between tenants.
- D. VPC Network Peering connects two *separate* VPC networks, which can be part of a multi-tenant design, but it's not the primary isolation mechanism itself.
Google Cloud Resource Hierarchy (Projects/Folders)
The hierarchical structure of Google Cloud resources (Organization > Folders > Projects > Resources) that provides the fundamental isolation boundaries for billing, IAM, and resource management.
- Projects are the basic unit of resource management and billing.
- Projects provide strong isolation boundaries for network and IAM.
- Folders group projects for policy inheritance and management.
Memory trick: Projects & Folders: Cloud's Apartment Building.