Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Kontrol Layanan VPC untuk BigQuery
Halaman ini menjelaskan cara meningkatkan keamanan di sekitar resource BigQuery dengan membuat perimeter menggunakan Kontrol Layanan VPC. Perimeter ini membatasi akses ke dan dari BigQuery serta independen dari kontrol Identity and Access Management (IAM). Keduanya berguna dalam kasus penggunaan berikut:
Mencegah kebocoran data dengan membatasi akses ke resource, kecuali yang
diizinkan secara khusus dalam aturan masuk dan keluar.
Memuat data ke BigQuery dengan aman dari sumber atau layanan Google Cloud pihak ketiga, seperti Cloud Storage.
Mengontrol ekspor data dari BigQuery ke Cloud Storage atau target lainnya.
Untuk mendapatkan izin yang diperlukan guna mengonfigurasi perimeter layanan, lihat
Kontrol akses dengan
IAM untuk Kontrol Layanan VPC.
Anda harus memiliki kebijakan akses untuk organisasi Anda. Untuk mengetahui informasi selengkapnya,
lihat Membuat kebijakan akses.
Membuat perimeter Kontrol Layanan VPC
Contoh berikut menunjukkan cara membuat perimeter Kontrol Layanan VPC yang membatasi rentang alamat IP eksternal yang dapat mengakses project BigQuery.
Buat tingkat akses yang hanya mengizinkan akses ke rentang alamat IP tertentu, misalnya, alamat IP dalam jaringan perusahaan. Untuk membuatnya, gunakan
perintah gcloud access-context-manager levels create:
TITLE: judul yang dapat dibaca manusia untuk
perimeter layanan
Untuk mengetahui informasi selengkapnya tentang cara membuat tingkat akses, lihat contoh
implementasi.
Lindungi resource BigQuery dengan membuat atau memperbarui perimeter. Contoh berikut melindungi project. Untuk kasus penggunaan lainnya, seperti melindungi transfer data dari bucket Cloud Storage di project lain, lihat kasus penggunaan.
Contoh kasus penggunaan berikut menunjukkan cara melindungi data yang masuk dan keluar dari BigQuery dengan Kontrol Layanan VPC.
Membuat kueri data tabel eksternal dari bucket Cloud Storage di project lain
Contoh berikut menunjukkan cara mengizinkan komunikasi secara selektif antara project BigQuery dan Cloud Storage saat project tersebut dipisahkan oleh perimeter.
Izinkan project BigQuery mengakses project Cloud Storage dengan memperbarui aturan keluar untuk perimeter di sekitar project Cloud Storage:
CLOUD_STORAGE_PROJECT_NUMBER: ID project Cloud Storage
PERIMETER: ID perimeter
POLICY_NAME: ID kebijakan akses
Opsional: jika perimeter yang melindungi project BigQuery
menyertakan storage.googleapis.com sebagai layanan yang dibatasi, Anda harus memperbarui
aturan masuk:
Sebagai lapisan pertahanan tambahan, Anda dapat menggunakan perimeter Kontrol Layanan VPC untuk
membatasi akses antara BigQuery Omni dan layanan cloud
eksternal. Untuk informasi dan contoh selengkapnya, lihat konfigurasi Kontrol Layanan VPC saat Anda membuat tabel BigLake Azure Blob Storage.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-17 UTC."],[[["\u003cp\u003eVPC Service Controls enhance BigQuery security by establishing perimeters that restrict access to and from BigQuery resources, independent of IAM controls.\u003c/p\u003e\n"],["\u003cp\u003eThese perimeters help prevent data leakage by limiting access to resources based on defined ingress and egress rules.\u003c/p\u003e\n"],["\u003cp\u003eVPC Service Controls facilitate secure data loading into BigQuery from third-party or Google Cloud services, and control data export to other services.\u003c/p\u003e\n"],["\u003cp\u003eCreating a perimeter involves defining an access level with specific IP address ranges and then protecting a BigQuery resource by creating or updating a perimeter with appropriate ingress and egress rules.\u003c/p\u003e\n"],["\u003cp\u003eVPC Service Controls can be used to selectively allow or restrict communication between BigQuery and other services like Cloud Storage, even across different projects and perimeters, by managing egress and ingress rules.\u003c/p\u003e\n"]]],[],null,["# VPC Service Controls for BigQuery\n=================================\n\nThis page explains how to enhance security around BigQuery resources by\ncreating perimeters with VPC Service Controls. These perimeters restrict access to\nand from BigQuery and are independent from\nIdentity and Access Management (IAM) controls. They're useful in the following use cases:\n\n- Preventing data leakage by restricting access to resources, except those specifically allowed in the ingress and egress rules.\n- Securely loading data into BigQuery from third-party sources or Google Cloud services, such as Cloud Storage.\n- Controlling data export from BigQuery to Cloud Storage or other targets.\n\nFor more information, see the [overview of VPC Service Controls](/vpc-service-controls/docs/overview).\n\nBefore you begin\n----------------\n\n- To get the permissions that you need to configure service perimeters, see [Access control with\n IAM](/vpc-service-controls/docs/access-control) for VPC Service Controls.\n- You must have an access policy for your organization. For more information, see [Create an access\n policy](/access-context-manager/docs/create-access-policy).\n\nCreate the VPC Service Controls perimeter\n-----------------------------------------\n\nThe following example shows how to create a VPC Service Controls perimeter\nthat limits the range of external IP addresses that can access a\nBigQuery project.\n\n1. Create an *access level* that only allows access to a specified range of IP\n addresses---for example, those within a corporate network. To create it, use\n the [`gcloud access-context-manager levels create`](/sdk/gcloud/reference/access-context-manager/levels/create) command:\n\n echo \"\"\"\n - ipSubnetworks:\n - 162.222.181.0/24\n - 2001:db8::/48\n \"\"\" \u003e level.yaml\n\n gcloud access-context-manager levels create \u003cvar translate=\"no\"\u003eACCESS_LEVEL_NAME\u003c/var\u003e \\\n --title=\"\u003cvar translate=\"no\"\u003eTITLE\u003c/var\u003e\" --basic-level-spec=level.yaml\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eACCESS_LEVEL_NAME\u003c/var\u003e: the ID of the access level\n - \u003cvar translate=\"no\"\u003eTITLE\u003c/var\u003e: the human-readable title for the service perimeter\n\n For more information about creating access levels, see the [example\n implementations](/access-context-manager/docs/create-basic-access-level#example_implementations).\n2. Protect the BigQuery resource by creating or updating a\n perimeter. The following examples protect a project. For other use\n cases, such as protecting data transfer from a Cloud Storage\n bucket in another project, see the [use cases](#use-cases).\n\n ### Create perimeter\n\n\n To create a new perimeter to protect the BigQuery project,\n use the [`gcloud access-context-manager perimeters create`](/sdk/gcloud/reference/access-context-manager/perimeters/create) command: \n\n echo \"\"\"\n - ingressFrom:\n identityType: ANY_IDENTITY\n sources:\n - accessLevel: accessPolicies/\u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e/accessLevels/\u003cvar translate=\"no\"\u003eACCESS_LEVEL_NAME\u003c/var\u003e\n ingressTo:\n operations:\n - methodSelectors:\n - method: '*'\n serviceName: bigquery.googleapis.com\n resources:\n - '*'\n\n \"\"\" \u003e ingress.yaml\n\n gcloud access-context-manager perimeters create \u003cvar translate=\"no\"\u003eBIGQUERY_PERIMETER\u003c/var\u003e --title=\"\u003cvar translate=\"no\"\u003eTITLE\u003c/var\u003e\" \\\n --resources=\u003cvar translate=\"no\"\u003eBIGQUERY_PROJECT_NUMBER\u003c/var\u003e \\\n --restricted-services=bigquery.googleapis.com \\\n --ingress-policies=ingress.yaml\n --policy=\u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e: the ID of the access policy\n - \u003cvar translate=\"no\"\u003eACCESS_LEVEL_NAME\u003c/var\u003e: the ID of the access level\n - \u003cvar translate=\"no\"\u003ePERIMETER\u003c/var\u003e: the ID of the perimeter\n - \u003cvar translate=\"no\"\u003eTITLE\u003c/var\u003e: the short, human-readable title for the service perimeter\n - \u003cvar translate=\"no\"\u003eBIGQUERY_PROJECT_NUMBER\u003c/var\u003e: the ID of BigQuery project\n - \u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e: the ID of the access policy\n\n ### Update perimeter\n\n\n To update an existing perimeter, use the [`gcloud access-context-manager perimeters update`](/sdk/gcloud/reference/access-context-manager/perimeters/update) command: \n\n gcloud access-context-manager perimeters update \u003cvar translate=\"no\"\u003eBIGQUERY_PERIMETER\u003c/var\u003e --set-ingress-policies=ingress.yaml\n\n Replace \u003cvar translate=\"no\"\u003eBIGQUERY_PERIMETER\u003c/var\u003e with the ID of the perimeter\n protecting the BigQuery resource.\n\nTest the perimeter\n------------------\n\nTest your VPC Service Controls perimeter before enforcing it. For more\ninformation, see [Dry run mode for service\nperimeters](/vpc-service-controls/docs/dry-run-mode) and [Using dry-run\nmode to test ingress or egress\npolicies](/vpc-service-controls/docs/ingress-egress-rules#using-dryrun-ingress-egress-rules).\n\nUse cases\n---------\n\nThe following use case examples show how to protect data going in and out of\nBigQuery with VPC Service Controls.\n\n### Query external table data from a Cloud Storage bucket in another project\n\nThe following examples show how to selectively allow communication between the\nBigQuery and Cloud Storage projects when they are\nseparated by perimeters.\n\n1. Allow the BigQuery project to access the\n Cloud Storage project by updating the egress rules for the perimeter\n around the Cloud Storage project:\n\n echo \"\"\"\n - egressFrom:\n identityType: ANY_IDENTITY\n egressTo:\n operations:\n - methodSelectors:\n - method: '*'\n serviceName: storage.googleapis.com\n resources:\n - projects/\u003cvar translate=\"no\"\u003eBIGQUERY_PROJECT_NUMBER\u003c/var\u003e\n \"\"\" \u003e egress.yaml\n\n gcloud access-context-manager perimeters update \u003cvar translate=\"no\"\u003eCLOUD_STORAGE_PERIMETER\u003c/var\u003e --policy=\u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e --set-egress-policies=egress.yaml\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eBIGQUERY_PROJECT_NUMBER\u003c/var\u003e: the ID of BigQuery project\n - \u003cvar translate=\"no\"\u003eCLOUD_STORAGE_PERIMETER\u003c/var\u003e: the ID of the perimeter protecting the Cloud Storage resources\n - \u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e: the ID of the access policy\n2. Allow the Cloud Storage project to access the\n BigQuery project by updating the egress rules for the\n perimeter around the BigQuery project:\n\n echo \"\"\"\n - egressFrom:\n identityType: ANY_IDENTITY\n egressTo:\n operations:\n - methodSelectors:\n - method: '*'\n serviceName: storage.googleapis.com\n resources:\n - projects/\u003cvar translate=\"no\"\u003eCLOUD_STORAGE_PROJECT_NUMBER\u003c/var\u003e\n \"\"\" \u003e egress1.yaml\n\n gcloud access-context-manager perimeters update \u003cvar translate=\"no\"\u003eBIGQUERY_PERIMETER\u003c/var\u003e --policy=\u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e --set-egress-policies=egress1.yaml\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eCLOUD_STORAGE_PROJECT_NUMBER\u003c/var\u003e: the ID of Cloud Storage project\n - \u003cvar translate=\"no\"\u003ePERIMETER\u003c/var\u003e: the ID of the perimeter\n - \u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e: the ID of the access policy\n3. Optional: if the perimeter protecting the BigQuery project\n includes `storage.googleapis.com` as a restricted service, you must update\n the ingress rule:\n\n echo \"\"\"\n - ingressFrom:\n identityType: ANY_IDENTITY\n sources:\n - accessLevel: accessPolicies/\u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e/accessLevels/\u003cvar translate=\"no\"\u003eACCESS_LEVEL_NAME\u003c/var\u003e\n ingressTo:\n operations:\n - methodSelectors:\n - method: '*'\n serviceName: bigquery.googleapis.com\n - methodSelectors:\n - method: '*'\n serviceName: storage.googleapis.com\n resources:\n - '*'\n\n \"\"\" \u003e ingress.yaml\n\n gcloud access-context-manager perimeters create \u003cvar translate=\"no\"\u003eBIGQUERY_PERIMETER\u003c/var\u003e --title=\"\u003cvar translate=\"no\"\u003eTITLE\u003c/var\u003e\" \\\n --resources=\u003cvar translate=\"no\"\u003eBIGQUERY_PROJECT_NUMBER\u003c/var\u003e \\\n --restricted-services=bigquery.googleapis.com \\\n --ingress-policies=ingress.yaml\n --policy=\u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e\n\n### Import and export data from BigQuery Omni\n\nAs an extra layer of defense, you can use VPC Service Controls perimeters to\nrestrict access between BigQuery Omni and an external cloud\nservice. For more information and examples, see the\n[VPC Service Controls](/bigquery/docs/omni-azure-create-external-table#vpc-service)\nconfiguration for when you create an Azure Blob Storage BigLake table.\n\nWhat's next\n-----------\n\n- Learn more about [VPC Service Controls in Analytics\n Hub](/bigquery/docs/analytics-hub-vpc-sc-rules).\n- Learn how to [restrict BigQuery Omni access with an\n external cloud\n service.](/bigquery/docs/omni-azure-create-external-table#vpc-service)\n- Understand [risks and mitigation through\n VPC Service Controls](/security/vpc-service-controls).\n- Learn more about [VPC Service Controls support and\n limitations in BigQuery](/vpc-service-controls/docs/supported-products#table_bigquery).\n- [Troubleshoot](/vpc-service-controls/docs/troubleshooting#debugging) common issues for BigQuery and VPC Service Controls."]]
