You can deploy resources from several Azure services into an Azure virtual network. For a complete list, see Services that can be deployed into a virtual network. You can associate zero, or one, network security group to each virtual network subnet and network interface in a virtual machine. The same network security group can be associated to as many subnets and network interfaces as you choose.

AWS NAT gateway allows instances in a private subnet to connect to the internet or other AWS services without using NAT instance. the main routing table sends internet traffic from the private subnet instances to the NAT gateway, then NAT gateway sends traffic to the IGW using the source IP address of the elastic IP address.

Deploy a NAT gateway with an EIP in the public subnet, edit route tables, select Private-route and add a new route destination 0.0.0.0/0 to target the NAT gateway.

session_affinity = "CLIENT_IP"

A - we using A-A architecture with GCP NLB

B to ensure that the same client always reach the same machine regardless the protocol we must configure a session affinity that route the same source IP to the same instance

as we can see in the TF deployment file

"### Target Pools ###

resource "google_compute_target_pool" "default" {

name = "${var.cluster_name}-instancepool-${random_string.random_name_post.result}"

session_affinity = "CLIENT_IP"

health_checks = [

"${google_compute_http_health_check.default.name}",

]

}

"