Two teams share a single VPC and need strict segmentation so that dev subnet 10.4.1.0/24 cannot initiate connections to prod subnet 10.4.2.0/24, while prod can reach dev for monitoring. What is the recommended GCP mechanism?

VPC firewall rules are the recommended GCP mechanism for controlling traffic flow between subnets within the same VPC. By using tags or service accounts, you can precisely define source and destination for rules. In this scenario, you would create a deny rule with a lower priority for traffic from the dev subnet's tag/service account to the prod subnet's tag/service account. Then, a higher priority allow rule would permit traffic from the prod subnet's tag/service account to the dev subnet's tag/service account for monitoring. Separate route tables per subnet are not a standard GCP mechanism for granular traffic control within a single VPC. VPC peering is used to connect different VPC networks, not to segment subnets within the same VPC. Private Google Access allows instances to reach Google APIs and services without public IPs, but it does not provide network segmentation between subnets.