Secure Web Proxy supports distributed tracing by integrating with Cloud Trace. With distributed tracing, you can track the lifecycle of outbound requests from internal workloads through your Secure Web Proxy gateways to external endpoints. This integration helps you detect latency bottlenecks and troubleshoot connectivity errors.

This feature is available in Preview.

Secure Web Proxy supports the local intermediate CA signing certificate issuance mode for TLS inspection. By using this mode, Secure Web Proxy caches a single intermediate certificate authority (CA) certificate from your CA pool to sign leaf certificates locally for requested domains, reducing certificate issuance requests and transaction costs. To use this certificate issuance mode, you must make sure that your CA pool is configured to issue intermediate CA certificates.

For more information, see Certificate issuance modes and Configure a local intermediate CA signing.

This feature is generally available (GA).

You can use authorization policies to perform identity-based and content-based access control checks when processing outbound traffic requests through Secure Web Proxy.

By configuring authorization policies, you can set rules for your workloads to access external destinations. You can also use these authorization policies to delegate complex authorization decisions to identity and content-scanning services like Service Extensions.

This feature is available in Preview.

Feature

You can integrate frontend mutual TLS (mTLS) with Secure Web Proxy to boost the security of your applications and workloads.

With this integration, you can use validated client identities in Secure Web Proxy authorization policies to enforce granular access control for outbound traffic.

This feature is available in Preview.

When you deploy your Secure Web Proxy instance as a next hop, you can configure the gateway to listen on all ports (1 through 65535). With this feature, your proxy automatically intercepts all outbound traffic and enforces security policies and rules on it. This removes the need to manage specific port lists.

This feature is available in Preview.

Secure Web Proxy supports VPC Service Controls. For more information, see Configure VPC Service Controls for Secure Web Proxy.

This feature is generally available (GA).

Secure Web Proxy uses a Cloud NAT gateway to allow external communication between Google Cloud workloads and internet destinations. When you set up your Secure Web Proxy instance, a network address translation (NAT) gateway is automatically created.

To limit the number of IP addresses that are used, the Cloud NAT gateway uses dynamic port allocation (DPA) for Secure Web Proxy. For more information, see Use Cloud NAT for Secure Web Proxy.

This feature is generally available (GA).

You can configure your Secure Web Proxy instance as a next hop to route web traffic within your Virtual Private Cloud (VPC) network. To deploy your Secure Web Proxy instance as a next hop, you can use either policy-based routes or static routes.

This feature is generally available (GA).

The Direct Virtual Private Cloud (VPC) egress feature of Cloud Run supports Secure Web Proxy. This feature is generally available (GA).

You can deploy your Secure Web Proxy instance as a Private Service Connect (PSC) service attachment. Use this deployment mode to centralize and apply gateway security policies on your outbound web traffic.

This feature is generally available (GA).

Secure Web Proxy is generally available (GA).

Secure Web Proxy supports Transport Layer Security (TLS) inspection. You can use TLS inspection to intercept TLS traffic, inspect encrypted requests, and enforce gateway security policies and rules.

This feature is available in Preview.

Cloud Secure Web Gateway helps protect your outbound HTTP and HTTPS traffic. To sign up to use Secure Web Gateway, contact your sales representative.

Secure Web Gateway is available in Preview.