Phase 6: Cloud Deployment in Client Environments · 55 min · Python · GCP VPC Service Controls · AWS PrivateLink

Deploying Behind Client Firewalls

They refuse all inbound connections. Design for outbound only.

Hiring signal: System design for integration interviews test the 'no inbound connections' constraint: candidates who design outbound-only deployment patterns using tunnels and reverse proxies pass. Candidates who say 'just open a port' fail. VPC Service Controls on GCP and AWS PrivateLink are the 2026 enterprise patterns for preventing data exfiltration while allowing AI deployment. This is a hard constraint in financial services and government deployments.

What you will learn

Design outbound-only deployment patterns using tunnels and reverse proxies
Configure VPC Service Controls on GCP: security perimeters, preventing data exfiltration
Use AWS PrivateLink for private connectivity between VPCs without public internet
Implement exfiltration auditing: monitoring outbound traffic, detecting anomalous transfers
Negotiate with client security teams: documenting required ports and protocols

What You'll Learn

This lesson takes approximately 55 min. By the end, you will be able to:

Design outbound-only deployment patterns using tunnels and reverse proxies
Configure VPC Service Controls on GCP: security perimeters, preventing data exfiltration
Use AWS PrivateLink for private connectivity between VPCs without public internet
Implement exfiltration auditing: monitoring outbound traffic, detecting anomalous transfers
Negotiate with client security teams: documenting required ports and protocols

The Problem

Some clients refuse all inbound connections. No public endpoints, no ingress from the internet. Your AI system needs to reach the model API, but the firewall blocks outbound traffic to external services. The solution is an outbound-only architecture: your system makes outbound calls to a proxy or model gateway, never receives inbound connections.

Unlock the full lesson

You've read the first 2 sections. The rest of this lesson covers Outbound-Only Architecture with Reverse Tunnels, AWS PrivateLink for Private Connectivity, GCP VPC Service Controls: Preventing Data Exfiltration, Exfiltration Auditing, Negotiating with Client Security Teams, Practical Application, What Hiring Managers Look For, Resources, Key Takeaways, Next Steps — plus a hands-on lab, quiz, and project artifact.

Create a free account to unlock Phase 0 and Phase 1 of every course — no credit card.