3

Assume we build an application that has internal components (or microservices) on GCP (or AWS, Azure...).

I guess there are 2 main security options:

  1. use VPC to protect internal communications.
  2. use service account-based authentication and encryption between each internal components.

Of course, we still could apply VPC to "2" but I'm wondering if that is overkill.

Is #1 more secure than #2?

Or when should we choose VPC from a security perspective except that is the only option specified by clients?

Improve this question

1 Answer 1

Reset to default
1

I'm not sure I understand the question. VPC is one component for proviing defense in depth. VPC alone won't protect you once one of the services or servers are exploited and an attacker is inside your network.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .