To implement hybrid connectivity with an active/passive approach using Dedicated Interconnect and BGP, Google-recommended practices include:
1. Use BGP priority to influence traffic paths:
- A lower priority value (such as 0) indicates a higher preference for the route. In this case, the primary interconnect (interconnect-1) is configured with priority 0 to ensure it is the preferred path.
- The secondary interconnect (interconnect-2) is configured with a higher priority value (e.g., 200), making it the passive backup.
2. Use consistent Google-side ASNs:
Google Cloud uses the same Google-side BGP ASN (e.g., 65100) for both interconnects. This simplifies configuration and ensures proper routing behavior.
3. On-premises ASN configuration:
The on-premises ASN (e.g., 65000) is different from Google-side ASNs to ensure proper communication between the two BGP peers.

Record network flows sent from and received by VM instances, the best approach would be to use VPC Flow Logs feature. If enabled for a subnet, VPC flow logs collect data from all VM instances in that subnet.

The updates-limiter rule has a Deny action and matches the host
https://www.terramearth.com/docs/, which includes the /docs/* path. This rule is preventing users from accessing the necessary documents on https://www.terramearth.com/docs/*. Since the updates-1 rule already explicitly allows access to the https://www.terramearth.com/docs/ host with a path matching /docs/*, the updates-limiter rule is unnecessary and creates a conflict.
By deleting the updates-limiter rule, the traffic will be allowed by the updates-1 rule, resolving the issue without affecting other rules in the Secure Web Proxy configuration.

Using USE_ORIGIN_HEADERS makes Cloud CDN respect the existing Cache-Control headers from the application, preserving the current caching behavior during migration and avoiding the need to change application-side caching logic.