Mantenha tudo organizado com as coleções
Salve e categorize o conteúdo com base nas suas preferências.
VPC Service Controls para BigQuery
Nesta página, explicamos como melhorar a segurança dos recursos do BigQuery
criando perímetros com o VPC Service Controls. Esses perímetros restringem o acesso ao BigQuery e são independentes dos controles de Identity and Access Management (IAM). Eles são úteis nos seguintes casos de uso:
Impedir a divulgação de dados restringindo o acesso a recursos, exceto aqueles
especificamente permitidos nas regras de entrada e saída.
Carregar dados com segurança no BigQuery de fontes de terceiros ou de serviços do Google Cloud Google Cloud, como o Cloud Storage.
Controle a exportação de dados do BigQuery para o Cloud Storage ou outras origens.
Para receber as permissões necessárias para configurar perímetros de serviço, consulte
Controle de acesso com
o IAM para o VPC Service Controls.
Você precisa ter uma política de acesso para sua organização. Para mais informações, consulte Criar uma política de acesso.
Criar o perímetro do VPC Service Controls
O exemplo a seguir mostra como criar um perímetro do VPC Service Controls
que limita o intervalo de endereços IP externos que podem acessar um
projeto do BigQuery.
Crie um nível de acesso que permita o acesso apenas a um intervalo especificado de endereços IP, por exemplo, aqueles em uma rede corporativa. Para criar, use o comando gcloud access-context-manager levels create:
Proteja o recurso do BigQuery criando ou atualizando um
perímetro. Os exemplos a seguir protegem um projeto. Para outros casos de uso, como proteger a transferência de dados de um bucket do Cloud Storage em outro projeto, consulte os casos de uso.
Os exemplos de caso de uso a seguir mostram como proteger os dados que entram e saem do
BigQuery com o VPC Service Controls.
Consultar dados de tabelas externas de um bucket do Cloud Storage em outro projeto
Os exemplos a seguir mostram como permitir seletivamente a comunicação entre os projetos do BigQuery e do Cloud Storage quando eles estão separados por perímetros.
Permita que o projeto do BigQuery acesse o projeto do Cloud Storage atualizando as regras de saída para o perímetro em torno do projeto do Cloud Storage:
Como uma camada extra de defesa, é possível usar os perímetros do VPC Service Controls para
restringir o acesso entre o BigQuery Omni e um serviço de nuvem
externo. Para mais informações e exemplos, consulte a configuração do
VPC Service Controls
para quando você cria uma tabela do BigLake do Azure Blob Storage.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-08-17 UTC."],[[["\u003cp\u003eVPC Service Controls enhance BigQuery security by establishing perimeters that restrict access to and from BigQuery resources, independent of IAM controls.\u003c/p\u003e\n"],["\u003cp\u003eThese perimeters help prevent data leakage by limiting access to resources based on defined ingress and egress rules.\u003c/p\u003e\n"],["\u003cp\u003eVPC Service Controls facilitate secure data loading into BigQuery from third-party or Google Cloud services, and control data export to other services.\u003c/p\u003e\n"],["\u003cp\u003eCreating a perimeter involves defining an access level with specific IP address ranges and then protecting a BigQuery resource by creating or updating a perimeter with appropriate ingress and egress rules.\u003c/p\u003e\n"],["\u003cp\u003eVPC Service Controls can be used to selectively allow or restrict communication between BigQuery and other services like Cloud Storage, even across different projects and perimeters, by managing egress and ingress rules.\u003c/p\u003e\n"]]],[],null,["# VPC Service Controls for BigQuery\n=================================\n\nThis page explains how to enhance security around BigQuery resources by\ncreating perimeters with VPC Service Controls. These perimeters restrict access to\nand from BigQuery and are independent from\nIdentity and Access Management (IAM) controls. They're useful in the following use cases:\n\n- Preventing data leakage by restricting access to resources, except those specifically allowed in the ingress and egress rules.\n- Securely loading data into BigQuery from third-party sources or Google Cloud services, such as Cloud Storage.\n- Controlling data export from BigQuery to Cloud Storage or other targets.\n\nFor more information, see the [overview of VPC Service Controls](/vpc-service-controls/docs/overview).\n\nBefore you begin\n----------------\n\n- To get the permissions that you need to configure service perimeters, see [Access control with\n IAM](/vpc-service-controls/docs/access-control) for VPC Service Controls.\n- You must have an access policy for your organization. For more information, see [Create an access\n policy](/access-context-manager/docs/create-access-policy).\n\nCreate the VPC Service Controls perimeter\n-----------------------------------------\n\nThe following example shows how to create a VPC Service Controls perimeter\nthat limits the range of external IP addresses that can access a\nBigQuery project.\n\n1. Create an *access level* that only allows access to a specified range of IP\n addresses---for example, those within a corporate network. To create it, use\n the [`gcloud access-context-manager levels create`](/sdk/gcloud/reference/access-context-manager/levels/create) command:\n\n echo \"\"\"\n - ipSubnetworks:\n - 162.222.181.0/24\n - 2001:db8::/48\n \"\"\" \u003e level.yaml\n\n gcloud access-context-manager levels create \u003cvar translate=\"no\"\u003eACCESS_LEVEL_NAME\u003c/var\u003e \\\n --title=\"\u003cvar translate=\"no\"\u003eTITLE\u003c/var\u003e\" --basic-level-spec=level.yaml\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eACCESS_LEVEL_NAME\u003c/var\u003e: the ID of the access level\n - \u003cvar translate=\"no\"\u003eTITLE\u003c/var\u003e: the human-readable title for the service perimeter\n\n For more information about creating access levels, see the [example\n implementations](/access-context-manager/docs/create-basic-access-level#example_implementations).\n2. Protect the BigQuery resource by creating or updating a\n perimeter. The following examples protect a project. For other use\n cases, such as protecting data transfer from a Cloud Storage\n bucket in another project, see the [use cases](#use-cases).\n\n ### Create perimeter\n\n\n To create a new perimeter to protect the BigQuery project,\n use the [`gcloud access-context-manager perimeters create`](/sdk/gcloud/reference/access-context-manager/perimeters/create) command: \n\n echo \"\"\"\n - ingressFrom:\n identityType: ANY_IDENTITY\n sources:\n - accessLevel: accessPolicies/\u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e/accessLevels/\u003cvar translate=\"no\"\u003eACCESS_LEVEL_NAME\u003c/var\u003e\n ingressTo:\n operations:\n - methodSelectors:\n - method: '*'\n serviceName: bigquery.googleapis.com\n resources:\n - '*'\n\n \"\"\" \u003e ingress.yaml\n\n gcloud access-context-manager perimeters create \u003cvar translate=\"no\"\u003eBIGQUERY_PERIMETER\u003c/var\u003e --title=\"\u003cvar translate=\"no\"\u003eTITLE\u003c/var\u003e\" \\\n --resources=\u003cvar translate=\"no\"\u003eBIGQUERY_PROJECT_NUMBER\u003c/var\u003e \\\n --restricted-services=bigquery.googleapis.com \\\n --ingress-policies=ingress.yaml\n --policy=\u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e: the ID of the access policy\n - \u003cvar translate=\"no\"\u003eACCESS_LEVEL_NAME\u003c/var\u003e: the ID of the access level\n - \u003cvar translate=\"no\"\u003ePERIMETER\u003c/var\u003e: the ID of the perimeter\n - \u003cvar translate=\"no\"\u003eTITLE\u003c/var\u003e: the short, human-readable title for the service perimeter\n - \u003cvar translate=\"no\"\u003eBIGQUERY_PROJECT_NUMBER\u003c/var\u003e: the ID of BigQuery project\n - \u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e: the ID of the access policy\n\n ### Update perimeter\n\n\n To update an existing perimeter, use the [`gcloud access-context-manager perimeters update`](/sdk/gcloud/reference/access-context-manager/perimeters/update) command: \n\n gcloud access-context-manager perimeters update \u003cvar translate=\"no\"\u003eBIGQUERY_PERIMETER\u003c/var\u003e --set-ingress-policies=ingress.yaml\n\n Replace \u003cvar translate=\"no\"\u003eBIGQUERY_PERIMETER\u003c/var\u003e with the ID of the perimeter\n protecting the BigQuery resource.\n\nTest the perimeter\n------------------\n\nTest your VPC Service Controls perimeter before enforcing it. For more\ninformation, see [Dry run mode for service\nperimeters](/vpc-service-controls/docs/dry-run-mode) and [Using dry-run\nmode to test ingress or egress\npolicies](/vpc-service-controls/docs/ingress-egress-rules#using-dryrun-ingress-egress-rules).\n\nUse cases\n---------\n\nThe following use case examples show how to protect data going in and out of\nBigQuery with VPC Service Controls.\n\n### Query external table data from a Cloud Storage bucket in another project\n\nThe following examples show how to selectively allow communication between the\nBigQuery and Cloud Storage projects when they are\nseparated by perimeters.\n\n1. Allow the BigQuery project to access the\n Cloud Storage project by updating the egress rules for the perimeter\n around the Cloud Storage project:\n\n echo \"\"\"\n - egressFrom:\n identityType: ANY_IDENTITY\n egressTo:\n operations:\n - methodSelectors:\n - method: '*'\n serviceName: storage.googleapis.com\n resources:\n - projects/\u003cvar translate=\"no\"\u003eBIGQUERY_PROJECT_NUMBER\u003c/var\u003e\n \"\"\" \u003e egress.yaml\n\n gcloud access-context-manager perimeters update \u003cvar translate=\"no\"\u003eCLOUD_STORAGE_PERIMETER\u003c/var\u003e --policy=\u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e --set-egress-policies=egress.yaml\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eBIGQUERY_PROJECT_NUMBER\u003c/var\u003e: the ID of BigQuery project\n - \u003cvar translate=\"no\"\u003eCLOUD_STORAGE_PERIMETER\u003c/var\u003e: the ID of the perimeter protecting the Cloud Storage resources\n - \u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e: the ID of the access policy\n2. Allow the Cloud Storage project to access the\n BigQuery project by updating the egress rules for the\n perimeter around the BigQuery project:\n\n echo \"\"\"\n - egressFrom:\n identityType: ANY_IDENTITY\n egressTo:\n operations:\n - methodSelectors:\n - method: '*'\n serviceName: storage.googleapis.com\n resources:\n - projects/\u003cvar translate=\"no\"\u003eCLOUD_STORAGE_PROJECT_NUMBER\u003c/var\u003e\n \"\"\" \u003e egress1.yaml\n\n gcloud access-context-manager perimeters update \u003cvar translate=\"no\"\u003eBIGQUERY_PERIMETER\u003c/var\u003e --policy=\u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e --set-egress-policies=egress1.yaml\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eCLOUD_STORAGE_PROJECT_NUMBER\u003c/var\u003e: the ID of Cloud Storage project\n - \u003cvar translate=\"no\"\u003ePERIMETER\u003c/var\u003e: the ID of the perimeter\n - \u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e: the ID of the access policy\n3. Optional: if the perimeter protecting the BigQuery project\n includes `storage.googleapis.com` as a restricted service, you must update\n the ingress rule:\n\n echo \"\"\"\n - ingressFrom:\n identityType: ANY_IDENTITY\n sources:\n - accessLevel: accessPolicies/\u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e/accessLevels/\u003cvar translate=\"no\"\u003eACCESS_LEVEL_NAME\u003c/var\u003e\n ingressTo:\n operations:\n - methodSelectors:\n - method: '*'\n serviceName: bigquery.googleapis.com\n - methodSelectors:\n - method: '*'\n serviceName: storage.googleapis.com\n resources:\n - '*'\n\n \"\"\" \u003e ingress.yaml\n\n gcloud access-context-manager perimeters create \u003cvar translate=\"no\"\u003eBIGQUERY_PERIMETER\u003c/var\u003e --title=\"\u003cvar translate=\"no\"\u003eTITLE\u003c/var\u003e\" \\\n --resources=\u003cvar translate=\"no\"\u003eBIGQUERY_PROJECT_NUMBER\u003c/var\u003e \\\n --restricted-services=bigquery.googleapis.com \\\n --ingress-policies=ingress.yaml\n --policy=\u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e\n\n### Import and export data from BigQuery Omni\n\nAs an extra layer of defense, you can use VPC Service Controls perimeters to\nrestrict access between BigQuery Omni and an external cloud\nservice. For more information and examples, see the\n[VPC Service Controls](/bigquery/docs/omni-azure-create-external-table#vpc-service)\nconfiguration for when you create an Azure Blob Storage BigLake table.\n\nWhat's next\n-----------\n\n- Learn more about [VPC Service Controls in Analytics\n Hub](/bigquery/docs/analytics-hub-vpc-sc-rules).\n- Learn how to [restrict BigQuery Omni access with an\n external cloud\n service.](/bigquery/docs/omni-azure-create-external-table#vpc-service)\n- Understand [risks and mitigation through\n VPC Service Controls](/security/vpc-service-controls).\n- Learn more about [VPC Service Controls support and\n limitations in BigQuery](/vpc-service-controls/docs/supported-products#table_bigquery).\n- [Troubleshoot](/vpc-service-controls/docs/troubleshooting#debugging) common issues for BigQuery and VPC Service Controls."]]
