3.4 Cloud NAT

Once the compute.vmExternalIpAccess policy (see Organization Policies) disables external IPs on VMs, how do they reach the outside world to download package updates? The answer is Cloud NAT — a fully managed, distributed NAT service from Google, not a single NAT VM acting as a point of failure. You just open a gateway in each region that needs outbound access, and set logging to at least ERRORS_ONLY so failed connections are easy to investigate afterwards.