Com2us Platform · Multi-cloud
Summoners War: Sky Arena multi-cloud and firewall redesign
A massive game platform across GCP and Tencent Cloud, with 600 servers and 70 databases, a full firewall policy redesign, and patching with no maintenance window.
- Role
- Cloud Engineer · Main engineer
- Period
- Feb 2023 – Feb 2026
- Cloud
- GCP · Tencent
- Scale
- 600 servers · 70 databases · Massive
- Key tech
- GCP · Tencent Cloud · Terraform · Terragrunt · Cloud Armor
- 600
- Servers
- 70
- Databases
- - 40 %
- Deployment time after moving to Terragrunt
At a glance
Problem
This was the company's largest project, with Tencent added for service in China. Firewall policies across the two clouds had grown duplicated and complex, and code spread across many regions had become hard to manage with Terraform alone.
Approach
A full analysis of cross-cloud firewall policies removed duplicate and unneeded rules and regrouped the rest by role: web, game, database, and admin. Terraform moved to a Terragrunt structure to remove code duplication. Most servers sat behind load balancers, so patches rolled through by taking servers out and back one at a time.
Result
Simpler firewall policies were easier to review and change, with a smaller exposed surface. Moving to Terragrunt cut deployment time by 40%, and GCP Cloud Armor provided DDoS protection.
Up close
Firewall rules from a map (related public repository pf-02)
What this code does: Builds firewall rules from a rule map through for_each. This is code from a related public repository, not the production code of this project.
resource "google_compute_firewall" "rules" {
for_each = var.rules
network = each.value.network
name = each.key
direction = each.value.direction
source_ranges = each.value.direction == "INGRESS" ? each.value.ranges : null
destination_ranges = each.value.direction == "EGRESS" ? each.value.ranges : null
source_tags = each.value.use_service_accounts || each.value.direction == "EGRESS" ? null : each.value.sources
source_service_accounts = each.value.use_service_accounts && each.value.direction == "INGRESS" ? each.value.sources : null
target_tags = each.value.use_service_accounts ? null : each.value.targets
target_service_accounts = each.value.use_service_accounts ? each.value.targets : null
priority = each.value.priorityWhat I learned
Rules that are only ever added soon become unreadable. Grouping by role shows where to look for any change.
What I would improve
The duplicates and unused rules were found through a one-time full analysis. Next, I want to turn that analysis into a recurring check.