Instances use private IPs with a global load balancer fronting them. Restrict origin traffic so only a third‑party traffic‑scrubbing service can connect.

Cloud Armor is the correct choice because it operates at the edge of Google Cloud's network, before traffic reaches your instances. It can inspect incoming requests and apply security policies based on various criteria, including source IP addresses. By creating a Cloud Armor security policy that explicitly allows traffic only from the IP addresses of the third-party scrubbing service and denies all other traffic, you effectively restrict access to your global load balancer and the instances behind it. VPC firewall rules operate at the network interface level of your instances, which is after the load balancer has already processed the traffic. While they can block traffic, Cloud Armor provides a more robust and centralized solution for protecting services fronted by a global load balancer. VPC Service Controls are designed to prevent data exfiltration and control access to Google Cloud services, not to filter incoming internet traffic to applications. Iptables rules are host-based and would need to be configured on each instance, which is less scalable and manageable than a centralized Cloud Armor policy.