Phase 6: Cloud Deployment in Client Environments · 55 min · Python · GCP VPC Service Controls · AWS PrivateLink

Deploying Behind Client Firewalls

They refuse all inbound connections. Design for outbound only.

What you will learn

Design outbound-only deployment patterns using tunnels and reverse proxies
Configure VPC Service Controls on GCP: security perimeters, preventing data exfiltration
Use AWS PrivateLink for private connectivity between VPCs without public internet
Implement exfiltration auditing: monitoring outbound traffic, detecting anomalous transfers
Negotiate with client security teams: documenting required ports and protocols

Objective

What you'll learn

This lesson takes approximately 55 min. By the end, you will be able to:

Design outbound-only deployment patterns using tunnels and reverse proxies
Configure VPC Service Controls on GCP: security perimeters, preventing data exfiltration
Use AWS PrivateLink for private connectivity between VPCs without public internet
Implement exfiltration auditing: monitoring outbound traffic, detecting anomalous transfers
Negotiate with client security teams: documenting required ports and protocols

The Problem

Some clients refuse all inbound connections. No public endpoints, no ingress from the internet. Your AI system needs to reach the model API, but the firewall blocks outbound traffic to external services. The solution is an outbound-only architecture: your system makes outbound calls to a proxy or model gateway, never receives inbound connections.

Unlock the full lesson

You've read the first 2 sections. The rest of this lesson covers The Concept, Build, Key Terms & Next — plus a hands-on lab, quiz, and project artifact.

Create a free account — the opening phases of 29 of 35 courses are free, no credit card.