Publish Secure Web Proxy as a Private Service Connect service

To centralize your Secure Web Proxy deployment across multiple VPC networks, you can make Secure Web Proxy available through a Private Service Connect service attachment.

Deploying Secure Web Proxy with Private Service Connect involves the following steps:

  1. Create a Secure Web Proxy policy and rules.
  2. Create a Secure Web Proxy instance that uses your policy.
  3. Create a service attachment to publish the Secure Web Proxy instance as a Private Service Connect service.
  4. Create a Private Service Connect consumer endpoint in each VPC network that needs to connect to Secure Web Proxy.
  5. Point your workload's outbound traffic to the centralized Secure Web Proxy instance within the region.
Secure Web Proxy deployment in the Private Service Connect service attachment mode.
Publishing Secure Web Proxy as a Private Service Connect service lets you centralize egress traffic management for workloads across multiple VPC networks. (click to enlarge).

Before you begin

Before completing the steps on this page, complete the initial setup steps.

Create and configure a Secure Web Proxy instance

This guide describes how to create a Secure Web Proxy policy and rules that match traffic by session.

For information about optionally configuring TLS inspection, see Enable TLS inspection.

For information about optionally configuring application-level matching, see Create and deploy a Secure Web Proxy instance.

Create a Secure Web Proxy policy

Console

  1. In the Google Cloud console, go to the SWP Policies page.

    Go to SWP Policies

  2. Click Create a policy.

  3. Enter a name for the policy that you want to create, such as myswppolicy.

  4. Enter a description of the policy.

  5. In the Regions list, select the region where you want to create the web proxy policy.

  6. Click Create.

Cloud Shell

  1. Create a policy.yaml file.

    description: basic Secure Web Proxy policy
name: projects/PROJECT_ID/locations/REGION/gatewaySecurityPolicies/policy1

    Replace the following:

    • PROJECT_ID: the project ID of your project
    • REGION: the region of the policy

  2. Create a Secure Web Proxy policy based on policy.yaml.

    gcloud network-security gateway-security-policies import policy1 \
    --source=policy.yaml \
    --location=REGION

Add Secure Web Proxy rules to your policy

Configure Secure Web Proxy rules to allow egress traffic from each workload.

This section shows how to create a rule to allow traffic from workloads that are identified by Resource Manager tag or service account. For information about matching traffic in other ways, see CEL matcher language reference.