Menerapkan akses berbasis sertifikat dengan Kontrol Layanan VPC
Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Untuk melindungi layanan Google Cloud dalam project dan memitigasi risiko pemindahan data yang tidak sah, Anda dapat menentukan perimeter layanan Kontrol Layanan VPC di tingkat organisasi, folder, atau project. Menerapkan perimeter layanan memberi Anda kontrol terperinci atas kebijakan traffic masuk serta layanan dan resource yang akan dilindungi.
Menerapkan kebijakan ingress CBA ke perimeter layanan
Dengan menerapkan tingkat akses CBA ke perimeter layanan, Anda dapat memberikan akses ke
resource yang dilindungi perimeter hanya dari perangkat tepercaya. Untuk informasi selengkapnya
tentang cara membuat tingkat akses CBA, lihat Membuat tingkat akses untuk akses berbasis sertifikat.
Diagram berikut mengilustrasikan contoh dasar pembatasan akses ke data sensitif Cloud Storage dari perangkat yang tidak dikenal dengan mengaitkan tingkat akses CBA dengan perimeter layanan:
Untuk menerapkan kebijakan ingress CBA ke perimeter layanan, selesaikan langkah-langkah berikut:
Di Google Cloud menu navigasi konsol, klik Security, lalu klik
VPC Service Controls.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-05 UTC."],[],[],null,["# Enforce certificate-based access with VPC Service Controls\n\nTo protect Google Cloud services in your projects and mitigate the risk of data\nexfiltration, you can specify VPC Service Controls service perimeters at an\norganization, folder, or project level. Applying a service perimeter provides\nyou with fine-grained control over the ingress policy as well as which services\nand resources to protect.\n\nFor more information about the benefits of service perimeters, see [Overview of VPC Service Controls](/vpc-service-controls/docs/overview).\n\nApplying a CBA ingress policy to service perimeters\n---------------------------------------------------\n\nApplying CBA access levels to service perimeters allows you to grant access to\nperimeter-protected resources from only trusted devices. For more information\nabout creating a CBA access level, see [Create access levels for certificate-based access](/chrome-enterprise-premium/docs/create-cba-access-levels).\n\nThe following diagram illustrates a basic example of restricting access to\nCloud Storage sensitive data from unknown devices by associating a CBA access\nlevel with a service perimeter:\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\nTo apply a CBA ingress policy to a service perimeter, complete the following steps:\n\n1. In the Google Cloud console navigation menu, click **Security** , and then click\n **VPC Service Controls**.\n\n [Go to the VPC Service Controls page](https://console.cloud.google.com/security/service-perimeter)\n2. On the **VPC Service Controls** page, in the table, click the name of\n the service perimeter that you want to modify.\n\n3. On the **Edit VPC Service Perimeter** page, click **Access Levels**.\n\n4. For the **Choose Access Level**, select the CBA access level.\n\n5. Click **Save**."]]
