You have a 3‑tier web→API→database application in one VPC where tiers scale independently. Traffic must flow web→API→DB and web must not reach DB directly. How should you configure networking?

Tagging each tier and creating firewall rules is the most effective and scalable solution. Network tags allow you to logically group VMs regardless of their subnet, making it easy to apply specific firewall rules. You can then create ingress firewall rules that permit traffic from the 'web' tag to the 'API' tag on the necessary ports, and from the 'API' tag to the 'database' tag. This inherently prevents the 'web' tier from directly accessing the 'database' tier, as no rule would permit that specific flow. Putting each tier in a different subnetwork adds complexity without inherently preventing direct web-to-DB access, as routing between subnets would still be allowed by default. Host-based firewalls are difficult to manage at scale and prone to misconfiguration. Creating routes to permit flow is not a security mechanism; routes define paths, not access permissions.