A network tag is just a string anyone can add or remove.
A service account binding inherits the same IAM rigor as everything else this course built.
A correctly-scoped firewall rule allowing only shipment-api's own service account immediately marked every backend unhealthy — the load balancer's health check comes from Google's own infra IP ranges, not the app's identity at all.
Prefer
Target by service account — governed by IAM, not editable like a tag
Cloud NAT
Outbound-only internet for --no-address instances — what makes "no public IP" still functional