<mxfile host="thecodeclouds.com" agent="hand-built" version="24.0.0" type="device">
<diagram id="flows" name="LLD 3: traffic flows and security controls"><mxGraphModel dx="1400" dy="900" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="1500" pageHeight="960" math="0" shadow="0"><root><mxCell id="0"/><mxCell id="1" parent="0"/><mxCell id="c1" value="Low-level design 3: five traffic flows through the hub, and the control that guards each one" style="text;html=1;whiteSpace=wrap;align=left;verticalAlign=top;fontSize=17;fontColor=#232F3E;fontStyle=1;spacing=0;" vertex="1" parent="1"><mxGeometry x="20" y="16" width="1460" height="23" as="geometry"/></mxCell>
<mxCell id="users" value="&lt;b&gt;Internet users&lt;/b&gt;" style="sketch=0;points=[];outlineConnect=0;fontColor=#232F3E;fillColor=#232F3E;strokeColor=#ffffff;dashed=0;html=1;fontSize=12;fontStyle=0;aspect=fixed;shape=mxgraph.aws4.resourceIcon;resIcon=mxgraph.aws4.users;labelPosition=center;verticalLabelPosition=bottom;align=center;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="80" y="147" width="52" height="52" as="geometry"/></mxCell>
<mxCell id="inet" value='&lt;b&gt;Internet&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#545B64"&gt;OS repos, SaaS APIs&lt;/font&gt;' style="rounded=1;arcSize=8;html=1;whiteSpace=wrap;strokeColor=#9AA0A6;fillColor=#FFFFFF;dashed=0;fontSize=12;fontStyle=0;fontColor=#3C4043;align=left;verticalAlign=top;spacingLeft=8;" vertex="1" parent="1"><mxGeometry x="960" y="143" width="200" height="60" as="geometry"/></mxCell>
<mxCell id="c3" value="&lt;b&gt;Prod Shared VPC  ·  edge spoke  ·  net-prod  ·  10.32.0.0/14&lt;/b&gt;" style="rounded=1;absoluteArcSize=1;arcSize=6;html=1;whiteSpace=wrap;strokeColor=#4285F4;fillColor=#F1F6FE;strokeWidth=1;dashed=0;fontSize=12;fontStyle=0;fontColor=#3C4043;align=left;verticalAlign=top;spacingLeft=34;spacingTop=-2;" vertex="1" parent="1"><mxGeometry x="270" y="60" width="640" height="560" as="geometry"/></mxCell>
<mxCell id="c4" value="" style="sketch=0;html=1;aspect=fixed;strokeColor=none;fillColor=#5184F3;shape=mxgraph.gcp2.virtual_private_cloud;" vertex="1" parent="1"><mxGeometry x="278" y="65" width="22" height="20" as="geometry"/></mxCell>
<mxCell id="armor" value='&lt;b&gt;Cloud Armor&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#5F6368"&gt;WAF + rate limits&lt;/font&gt;' style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.cloud_armor;labelPosition=center;verticalLabelPosition=bottom;align=center;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="300" y="150" width="52" height="46.07" as="geometry"/></mxCell>
<mxCell id="alb" value='&lt;b&gt;Global external ALB&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#5F6368"&gt;anycast IP, TLS&lt;/font&gt;' style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.cloud_load_balancing;labelPosition=center;verticalLabelPosition=bottom;align=center;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="470" y="150" width="52" height="46.07" as="geometry"/></mxCell>
<mxCell id="nat" value='&lt;b&gt;Cloud NAT&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#5F6368"&gt;static egress IPs&lt;/font&gt;' style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.cloud_nat;labelPosition=center;verticalLabelPosition=top;align=center;verticalAlign=bottom;" vertex="1" parent="1"><mxGeometry x="820" y="160" width="52" height="46.07" as="geometry"/></mxCell>
<mxCell id="gke" value='&lt;b&gt;GKE payments&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#5F6368"&gt;pods 100.64.0.0/14&lt;/font&gt;' style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.container_engine;labelPosition=left;verticalLabelPosition=middle;align=right;verticalAlign=middle;spacingRight=4;" vertex="1" parent="1"><mxGeometry x="650" y="290" width="52" height="46.07" as="geometry"/></mxCell>
<mxCell id="ilb" value='&lt;b&gt;Internal ALB&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#5F6368"&gt;10.32.32.10&lt;/font&gt;' style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.cloud_load_balancing;labelPosition=left;verticalLabelPosition=middle;align=right;verticalAlign=middle;spacingRight=4;" vertex="1" parent="1"><mxGeometry x="470" y="420" width="52" height="46.07" as="geometry"/></mxCell>
<mxCell id="psc" value='&lt;b&gt;PSC endpoint&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#5F6368"&gt;10.32.50.5&lt;/font&gt;' style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.gateway;labelPosition=center;verticalLabelPosition=bottom;align=center;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="820" y="420" width="44" height="44" as="geometry"/></mxCell>
<mxCell id="pdns" value='&lt;b&gt;Cloud DNS (prod)&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#5F6368"&gt;peering zone to&lt;br&gt;shared services&lt;/font&gt;' style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.cloud_dns;labelPosition=right;verticalLabelPosition=middle;align=left;verticalAlign=middle;spacingLeft=4;" vertex="1" parent="1"><mxGeometry x="663" y="500" width="52" height="46.07" as="geometry"/></mxCell>
<mxCell id="c5" value="Network firewall policy:&lt;br&gt;secure tags, deny by default&lt;br&gt;VPC flow logs on every subnet" style="text;html=1;whiteSpace=wrap;align=left;verticalAlign=top;fontSize=11;fontColor=#3C4043;fontStyle=0;spacing=0;" vertex="1" parent="1"><mxGeometry x="290" y="550" width="190" height="47" as="geometry"/></mxCell>
<mxCell id="c6" value="&lt;b&gt;Data project (producer)&lt;/b&gt;" style="rounded=1;absoluteArcSize=1;arcSize=6;html=1;whiteSpace=wrap;strokeColor=#9AA0A6;fillColor=#F8F9FA;strokeWidth=1;dashed=0;fontSize=12;fontStyle=0;fontColor=#3C4043;align=left;verticalAlign=top;spacingLeft=8;spacingTop=-2;" vertex="1" parent="1"><mxGeometry x="960" y="380" width="220" height="200" as="geometry"/></mxCell>
<mxCell id="sql" value='&lt;b&gt;Cloud SQL&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#5F6368"&gt;service attachment&lt;/font&gt;' style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.cloud_sql;labelPosition=center;verticalLabelPosition=bottom;align=center;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="1040" y="419" width="52" height="46.07" as="geometry"/></mxCell>
<mxCell id="hub" value="&lt;b&gt;NCC hub&lt;/b&gt;" style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.cloud_network;labelPosition=right;verticalLabelPosition=middle;align=left;verticalAlign=middle;spacingLeft=4;" vertex="1" parent="1"><mxGeometry x="478" y="634" width="36" height="31.89" as="geometry"/></mxCell>
<mxCell id="c7" value="&lt;b&gt;On-premises&lt;/b&gt;" style="points=[];outlineConnect=0;gradientColor=none;html=1;whiteSpace=wrap;fontSize=12;fontStyle=0;container=0;pointerEvents=0;collapsible=0;recursiveResize=0;shape=mxgraph.aws4.group;grIcon=mxgraph.aws4.group_corporate_data_center;strokeColor=#7D8998;fillColor=#F7F8FA;verticalAlign=top;align=left;spacingLeft=30;fontColor=#5A6C86;dashed=0;" vertex="1" parent="1"><mxGeometry x="20" y="680" width="220" height="260" as="geometry"/></mxCell>
<mxCell id="rtr" value="&lt;b&gt;Edge routers&lt;/b&gt;" style="sketch=0;points=[];outlineConnect=0;fontColor=#232F3E;fillColor=#5A6C86;strokeColor=#ffffff;dashed=0;html=1;fontSize=12;fontStyle=0;aspect=fixed;shape=mxgraph.aws4.resourceIcon;resIcon=mxgraph.aws4.router;labelPosition=center;verticalLabelPosition=bottom;align=center;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="98" y="751" width="44" height="44" as="geometry"/></mxCell>
<mxCell id="odns" value="&lt;b&gt;On-prem DNS 10.0.0.53&lt;/b&gt;" style="sketch=0;points=[];outlineConnect=0;fontColor=#232F3E;fillColor=#5A6C86;strokeColor=#ffffff;dashed=0;html=1;fontSize=12;fontStyle=0;aspect=fixed;shape=mxgraph.aws4.resourceIcon;resIcon=mxgraph.aws4.traditional_server;labelPosition=center;verticalLabelPosition=bottom;align=center;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="98" y="860" width="44" height="44" as="geometry"/></mxCell>
<mxCell id="c8" value="&lt;b&gt;Routing VPC  ·  center&lt;/b&gt;" style="rounded=1;absoluteArcSize=1;arcSize=6;html=1;whiteSpace=wrap;strokeColor=#4285F4;fillColor=#F1F6FE;strokeWidth=1;dashed=0;fontSize=12;fontStyle=0;fontColor=#3C4043;align=left;verticalAlign=top;spacingLeft=34;spacingTop=-2;" vertex="1" parent="1"><mxGeometry x="270" y="680" width="310" height="260" as="geometry"/></mxCell>
<mxCell id="c9" value="" style="sketch=0;html=1;aspect=fixed;strokeColor=none;fillColor=#5184F3;shape=mxgraph.gcp2.virtual_private_cloud;" vertex="1" parent="1"><mxGeometry x="278" y="685" width="22" height="20" as="geometry"/></mxCell>
<mxCell id="ic" value='&lt;b&gt;VLAN&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#5F6368"&gt;attachments&lt;/font&gt;' style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.dedicated_interconnect;labelPosition=center;verticalLabelPosition=bottom;align=center;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="320" y="750" width="52" height="46.07" as="geometry"/></mxCell>
<mxCell id="cr" value="&lt;b&gt;Cloud Router&lt;/b&gt;" style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.cloud_router;labelPosition=center;verticalLabelPosition=bottom;align=center;verticalAlign=top;" vertex="1" parent="1"><mxGeometry x="470" y="750" width="52" height="46.07" as="geometry"/></mxCell>
<mxCell id="c10" value="&lt;b&gt;Shared services VPC  ·  center&lt;/b&gt;" style="rounded=1;absoluteArcSize=1;arcSize=6;html=1;whiteSpace=wrap;strokeColor=#4285F4;fillColor=#F1F6FE;strokeWidth=1;dashed=0;fontSize=12;fontStyle=0;fontColor=#3C4043;align=left;verticalAlign=top;spacingLeft=34;spacingTop=-2;" vertex="1" parent="1"><mxGeometry x="600" y="680" width="310" height="260" as="geometry"/></mxCell>
<mxCell id="c11" value="" style="sketch=0;html=1;aspect=fixed;strokeColor=none;fillColor=#5184F3;shape=mxgraph.gcp2.virtual_private_cloud;" vertex="1" parent="1"><mxGeometry x="608" y="685" width="22" height="20" as="geometry"/></mxCell>
<mxCell id="sdns" value='&lt;b&gt;Forwarding zone&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:10px" color="#5F6368"&gt;corp.example.com&lt;/font&gt;' style="sketch=0;html=1;aspect=fixed;strokeColor=none;shadow=0;fillColor=#5184F3;fontSize=12;fontColor=#3C4043;shape=mxgraph.gcp2.cloud_dns;labelPosition=right;verticalLabelPosition=middle;align=left;verticalAlign=middle;spacingLeft=4;" vertex="1" parent="1"><mxGeometry x="663" y="760" width="52" height="46.07" as="geometry"/></mxCell>
<mxCell id="c12" style="edgeStyle=none;html=1;rounded=0;strokeColor=#1E8E3E;strokeWidth=2.5;dashed=0;startArrow=none;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="users" target="armor"><mxGeometry relative="1" as="geometry"></mxGeometry></mxCell>
<mxCell id="c13" style="edgeStyle=none;html=1;rounded=0;strokeColor=#1E8E3E;strokeWidth=2.5;dashed=0;startArrow=none;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="armor" target="alb"><mxGeometry relative="1" as="geometry"></mxGeometry></mxCell>
<mxCell id="c14" style="edgeStyle=none;html=1;rounded=0;strokeColor=#1E8E3E;strokeWidth=2.5;dashed=0;startArrow=none;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=0.5;entryY=0;entryDx=0;entryDy=0;" edge="1" parent="1" source="alb" target="gke"><mxGeometry relative="1" as="geometry"><Array as="points"><mxPoint x="676" y="173"/></Array></mxGeometry></mxCell>
<mxCell id="c15" style="edgeStyle=none;html=1;rounded=0;strokeColor=#4285F4;strokeWidth=2.5;dashed=0;startArrow=block;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="rtr" target="ic"><mxGeometry relative="1" as="geometry"></mxGeometry></mxCell>
<mxCell id="c16" style="edgeStyle=none;html=1;rounded=0;strokeColor=#4285F4;strokeWidth=2.5;dashed=0;startArrow=block;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="ic" target="cr"><mxGeometry relative="1" as="geometry"></mxGeometry></mxCell>
<mxCell id="c17" style="edgeStyle=none;html=1;rounded=0;strokeColor=#4285F4;strokeWidth=2.5;dashed=0;startArrow=block;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=0.5;exitY=0;exitDx=0;exitDy=0;entryX=0.5;entryY=1;entryDx=0;entryDy=0;" edge="1" parent="1" source="cr" target="hub"><mxGeometry relative="1" as="geometry"></mxGeometry></mxCell>
<mxCell id="c18" style="edgeStyle=none;html=1;rounded=0;strokeColor=#4285F4;strokeWidth=2.5;dashed=0;startArrow=none;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=0.5;exitY=0;exitDx=0;exitDy=0;entryX=0.5;entryY=1;entryDx=0;entryDy=0;" edge="1" parent="1" source="hub" target="ilb"><mxGeometry relative="1" as="geometry"></mxGeometry></mxCell>
<mxCell id="c19" style="edgeStyle=none;html=1;rounded=0;strokeColor=#4285F4;strokeWidth=2.5;dashed=0;startArrow=none;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=0.3;entryY=1;entryDx=0;entryDy=0;" edge="1" parent="1" source="ilb" target="gke"><mxGeometry relative="1" as="geometry"><Array as="points"><mxPoint x="665.6" y="443"/></Array></mxGeometry></mxCell>
<mxCell id="c20" style="edgeStyle=none;html=1;rounded=0;strokeColor=#8430CE;strokeWidth=2.5;dashed=0;startArrow=none;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=1;exitY=0.75;exitDx=0;exitDy=0;entryX=0.5;entryY=0;entryDx=0;entryDy=0;" edge="1" parent="1" source="gke" target="psc"><mxGeometry relative="1" as="geometry"><Array as="points"><mxPoint x="842" y="324.5"/></Array></mxGeometry></mxCell>
<mxCell id="c21" style="edgeStyle=none;html=1;rounded=0;strokeColor=#8430CE;strokeWidth=2.5;dashed=0;startArrow=none;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="psc" target="sql"><mxGeometry relative="1" as="geometry"></mxGeometry></mxCell>
<mxCell id="c22" style="edgeStyle=none;html=1;rounded=0;strokeColor=#E8710A;strokeWidth=2.5;dashed=0;startArrow=none;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=1;exitY=0.25;exitDx=0;exitDy=0;entryX=0.5;entryY=1;entryDx=0;entryDy=0;" edge="1" parent="1" source="gke" target="nat"><mxGeometry relative="1" as="geometry"><Array as="points"><mxPoint x="846" y="301.5"/></Array></mxGeometry></mxCell>
<mxCell id="c23" style="edgeStyle=none;html=1;rounded=0;strokeColor=#E8710A;strokeWidth=2.5;dashed=0;startArrow=none;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="nat" target="inet"><mxGeometry relative="1" as="geometry"></mxGeometry></mxCell>
<mxCell id="c24" style="edgeStyle=none;html=1;rounded=0;strokeColor=#5F6368;strokeWidth=2;dashed=1;startArrow=none;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=0.75;exitY=1;exitDx=0;exitDy=0;entryX=0.5;entryY=0;entryDx=0;entryDy=0;" edge="1" parent="1" source="gke" target="pdns"><mxGeometry relative="1" as="geometry"></mxGeometry></mxCell>
<mxCell id="c25" style="edgeStyle=none;html=1;rounded=0;strokeColor=#5F6368;strokeWidth=2;dashed=1;startArrow=none;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=0.5;exitY=1;exitDx=0;exitDy=0;entryX=0.5;entryY=0;entryDx=0;entryDy=0;" edge="1" parent="1" source="pdns" target="sdns"><mxGeometry relative="1" as="geometry"></mxGeometry></mxCell>
<mxCell id="c26" style="edgeStyle=none;html=1;rounded=0;strokeColor=#5F6368;strokeWidth=2;dashed=1;startArrow=none;startFill=1;endArrow=block;endFill=1;endSize=4;startSize=4;exitX=0.5;exitY=1;exitDx=0;exitDy=0;entryX=1;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="sdns" target="odns"><mxGeometry relative="1" as="geometry"><Array as="points"><mxPoint x="689" y="882"/></Array></mxGeometry></mxCell>
<mxCell id="c27" value="queries leave from 35.199.192.0/19" style="text;html=1;whiteSpace=wrap;align=left;verticalAlign=top;fontSize=10;fontColor=#5F6368;fontStyle=0;spacing=0;" vertex="1" parent="1"><mxGeometry x="300" y="888" width="260" height="16" as="geometry"/></mxCell>
<mxCell id="c28" value="1" style="ellipse;html=1;fillColor=#1E8E3E;strokeColor=none;fontColor=#FFFFFF;fontStyle=1;fontSize=12;aspect=fixed;" vertex="1" parent="1"><mxGeometry x="200" y="140" width="22" height="22" as="geometry"/></mxCell>
<mxCell id="c29" value="2" style="ellipse;html=1;fillColor=#4285F4;strokeColor=none;fontColor=#FFFFFF;fontStyle=1;fontSize=12;aspect=fixed;" vertex="1" parent="1"><mxGeometry x="255" y="738" width="22" height="22" as="geometry"/></mxCell>
<mxCell id="c30" value="3" style="ellipse;html=1;fillColor=#8430CE;strokeColor=none;fontColor=#FFFFFF;fontStyle=1;fontSize=12;aspect=fixed;" vertex="1" parent="1"><mxGeometry x="900" y="410" width="22" height="22" as="geometry"/></mxCell>
<mxCell id="c31" value="4" style="ellipse;html=1;fillColor=#E8710A;strokeColor=none;fontColor=#FFFFFF;fontStyle=1;fontSize=12;aspect=fixed;" vertex="1" parent="1"><mxGeometry x="900" y="150" width="22" height="22" as="geometry"/></mxCell>
<mxCell id="c32" value="5" style="ellipse;html=1;fillColor=#5F6368;strokeColor=none;fontColor=#FFFFFF;fontStyle=1;fontSize=12;aspect=fixed;" vertex="1" parent="1"><mxGeometry x="700" y="640" width="22" height="22" as="geometry"/></mxCell>
<mxCell id="c33" value="&lt;b&gt;Legend&lt;/b&gt;" style="rounded=1;arcSize=8;html=1;whiteSpace=wrap;strokeColor=#9AA0A6;fillColor=#FFFFFF;dashed=0;fontSize=12;fontStyle=0;fontColor=#3C4043;align=left;verticalAlign=top;spacingLeft=8;" vertex="1" parent="1"><mxGeometry x="960" y="620" width="220" height="135" as="geometry"/></mxCell>
<mxCell id="c34" style="edgeStyle=none;html=1;rounded=0;strokeColor=#1E8E3E;strokeWidth=2.5;dashed=0;startArrow=none;startFill=1;endArrow=none;endFill=1;endSize=4;startSize=4;" edge="1" parent="1"><mxGeometry relative="1" as="geometry"><mxPoint x="974" y="658" as="sourcePoint"/><mxPoint x="1014" y="658" as="targetPoint"/></mxGeometry></mxCell>
<mxCell id="c35" value="1  internet ingress" style="text;html=1;whiteSpace=wrap;align=left;verticalAlign=top;fontSize=11;fontColor=#3C4043;fontStyle=0;spacing=0;" vertex="1" parent="1"><mxGeometry x="1026" y="651" width="144" height="17" as="geometry"/></mxCell>
<mxCell id="c36" style="edgeStyle=none;html=1;rounded=0;strokeColor=#4285F4;strokeWidth=2.5;dashed=0;startArrow=none;startFill=1;endArrow=none;endFill=1;endSize=4;startSize=4;" edge="1" parent="1"><mxGeometry relative="1" as="geometry"><mxPoint x="974" y="679" as="sourcePoint"/><mxPoint x="1014" y="679" as="targetPoint"/></mxGeometry></mxCell>
<mxCell id="c37" value="2  on-prem to prod" style="text;html=1;whiteSpace=wrap;align=left;verticalAlign=top;fontSize=11;fontColor=#3C4043;fontStyle=0;spacing=0;" vertex="1" parent="1"><mxGeometry x="1026" y="672" width="144" height="17" as="geometry"/></mxCell>
<mxCell id="c38" style="edgeStyle=none;html=1;rounded=0;strokeColor=#8430CE;strokeWidth=2.5;dashed=0;startArrow=none;startFill=1;endArrow=none;endFill=1;endSize=4;startSize=4;" edge="1" parent="1"><mxGeometry relative="1" as="geometry"><mxPoint x="974" y="700" as="sourcePoint"/><mxPoint x="1014" y="700" as="targetPoint"/></mxGeometry></mxCell>
<mxCell id="c39" value="3  consumer to producer" style="text;html=1;whiteSpace=wrap;align=left;verticalAlign=top;fontSize=11;fontColor=#3C4043;fontStyle=0;spacing=0;" vertex="1" parent="1"><mxGeometry x="1026" y="693" width="144" height="17" as="geometry"/></mxCell>
<mxCell id="c40" style="edgeStyle=none;html=1;rounded=0;strokeColor=#E8710A;strokeWidth=2.5;dashed=0;startArrow=none;startFill=1;endArrow=none;endFill=1;endSize=4;startSize=4;" edge="1" parent="1"><mxGeometry relative="1" as="geometry"><mxPoint x="974" y="721" as="sourcePoint"/><mxPoint x="1014" y="721" as="targetPoint"/></mxGeometry></mxCell>
<mxCell id="c41" value="4  egress to internet" style="text;html=1;whiteSpace=wrap;align=left;verticalAlign=top;fontSize=11;fontColor=#3C4043;fontStyle=0;spacing=0;" vertex="1" parent="1"><mxGeometry x="1026" y="714" width="144" height="17" as="geometry"/></mxCell>
<mxCell id="c42" style="edgeStyle=none;html=1;rounded=0;strokeColor=#5F6368;strokeWidth=2;dashed=1;startArrow=none;startFill=1;endArrow=none;endFill=1;endSize=4;startSize=4;" edge="1" parent="1"><mxGeometry relative="1" as="geometry"><mxPoint x="974" y="742" as="sourcePoint"/><mxPoint x="1014" y="742" as="targetPoint"/></mxGeometry></mxCell>
<mxCell id="c43" value="5  DNS resolution" style="text;html=1;whiteSpace=wrap;align=left;verticalAlign=top;fontSize=11;fontColor=#3C4043;fontStyle=0;spacing=0;" vertex="1" parent="1"><mxGeometry x="1026" y="735" width="144" height="17" as="geometry"/></mxCell>
<mxCell id="c44" value="&lt;b&gt;The control on each flow&lt;/b&gt;" style="rounded=1;absoluteArcSize=1;arcSize=6;html=1;whiteSpace=wrap;strokeColor=#9AA0A6;fillColor=#F8F9FA;strokeWidth=1;dashed=0;fontSize=12;fontStyle=0;fontColor=#3C4043;align=left;verticalAlign=top;spacingLeft=8;spacingTop=-2;" vertex="1" parent="1"><mxGeometry x="1210" y="60" width="270" height="880" as="geometry"/></mxCell>
<mxCell id="c45" value="1  Cloud Armor on the backend service.&lt;br&gt;Firewall allows only the Google&lt;br&gt;front ends: 35.191.0.0/16 and&lt;br&gt;130.211.0.0/22.&lt;br&gt;&lt;br&gt;2  Cloud Router advertises summaries,&lt;br&gt;learns 10.0.0.0/12 only. Firewall&lt;br&gt;rule: on-prem ranges to tag&lt;br&gt;payments-api on 443.&lt;br&gt;&lt;br&gt;3  Prod never routes to the data VPC&lt;br&gt;(edge to edge is blocked in star).&lt;br&gt;It reaches Cloud SQL through its&lt;br&gt;own PSC endpoint. The producer&lt;br&gt;accepts consumers by project.&lt;br&gt;&lt;br&gt;4  Cloud NAT with static IPs so&lt;br&gt;SaaS vendors can allow-list you.&lt;br&gt;Egress firewall: FQDN objects,&lt;br&gt;deny the rest.&lt;br&gt;&lt;br&gt;5  Spokes peer DNS to shared&lt;br&gt;services. One forwarding zone&lt;br&gt;sends corp.example.com on-prem.&lt;br&gt;On-prem routers must accept&lt;br&gt;35.199.192.0/19.&lt;br&gt;&lt;br&gt;Everywhere:&lt;br&gt;hierarchical firewall policy at&lt;br&gt;the org node, IAP for admin SSH&lt;br&gt;from 35.235.240.0/20, VPC Service&lt;br&gt;Controls around data projects." style="text;html=1;whiteSpace=wrap;align=left;verticalAlign=top;fontSize=11;fontColor=#3C4043;fontStyle=0;spacing=0;" vertex="1" parent="1"><mxGeometry x="1225" y="100" width="250" height="482" as="geometry"/></mxCell></root></mxGraphModel></diagram>
</mxfile>
