An enterprise has a central IT team and multiple independent development teams. The central IT team must control all network resources (subnets, firewalls, VPNs), while the development teams need full control over creating VMs and GKE clusters in their own projects. How should you design the GCP network architecture?

Create a separate VPC in each development team's project and connect them using VPC Peering.

Create a Shared VPC in a Host Project managed by central IT, and attach the development teams' projects as Service Projects.

Place all resources (network and compute) in a single project and use IAM conditions to restrict access.

Use Cloud VPN to connect the development projects to a central IT project.