Compute instances have single public IPs. Block inbound connections originating from IPs belonging to BGP_ASN_TOBLOCK. What should you do?

To block inbound connections based on the originating BGP Autonomous System Number (ASN) for instances with single public IPs, a Cloud Armor network edge security policy is the correct choice. This policy type is designed for traffic entering your Google Cloud network at the edge, before it reaches specific load balancers or backend services, making it suitable for direct-to-VM public IP traffic. The --network-src-asns parameter allows you to specify the ASNs to block. Cloud Armor backend security policies protect services behind HTTP(S) Load Balancers, not direct VM public IPs. Cloud Armor edge security policy is not a distinct policy type; "network edge" is the correct terminology for this use case. Firewall policies operate at the VPC network level and do not support blocking by ASN directly.