[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-19。"],[[["\u003cp\u003eVPC Service Controls enhances Dataplex security by mitigating data exfiltration risks through the creation of service perimeters.\u003c/p\u003e\n"],["\u003cp\u003eDataplex resources, such as Lakes, Assets, data profile scans, and data quality scans, are protected by restricting connectivity to the \u003ccode\u003edataplex.googleapis.com\u003c/code\u003e API within a service perimeter.\u003c/p\u003e\n"],["\u003cp\u003eSetting up the VPC Service Controls security perimeter before creating Dataplex resources is crucial, as resources created prior to setting up will not be protected.\u003c/p\u003e\n"],["\u003cp\u003eTo add the Dataplex API as a restricted service, users must navigate to the VPC Service Controls page in the Google Cloud console and add it to the relevant service perimeter.\u003c/p\u003e\n"],["\u003cp\u003eAccess levels can be configured to permit external access to resources within the perimeter, but they cannot be used to give protected resources permission to access data and services outside the perimeter.\u003c/p\u003e\n"]]],[],null,["# VPC Service Controls with Dataplex Universal Catalog\n\nThis document describes how to secure your Dataplex Universal Catalog services using\nVPC Service Controls (VPC-SC).\n\nVPC Service Controls provides additional security for your\nDataplex Universal Catalog services to help mitigate the risk of data\nexfiltration. Using VPC Service Controls, you can add projects to service\nperimeters that protect resources and services from requests that cross the\nperimeter. For more information, see\n[Overview of VPC Service Controls](/vpc-service-controls/docs/overview).\n\nDataplex Universal Catalog resources are exposed on the\n`dataplex.googleapis.com` API, which lets you perform service-level\noperations, such as creation and deletion of services.\n\nYou set up VPC Service Controls with Dataplex Universal Catalog by\nrestricting connectivity to this API surface.\n\nLimitations\n-----------\n\nBefore you create Dataplex Universal Catalog resources, set up the\nVPC Service Controls security perimeter. Otherwise, your resources don't\nhave perimeter protection. Dataplex Universal Catalog supports the following resource\ntypes:\n\n- Lake\n- Assets\n- Data profile scan\n- Data quality scan\n\nConfigure the Virtual Private Cloud (VPC) network\n-------------------------------------------------\n\nYou can configure the VPC network to restrict\nPrivate Google Access with respect to a service perimeter. This ensures that\nhosts on your VPC or on-premises network can only communicate\nwith Google APIs and services that are supported by VPC Service Controls\nin ways which conform to the associated perimeter's policy.\n\nFor more information, see [Setting up private connectivity to Google APIs and services](/vpc-service-controls/docs/set-up-private-connectivity).\n\nCreate a service perimeter\n--------------------------\n\nWhen you create a service perimeter, you select the Dataplex Universal Catalog\nprojects that you want the VPC Service Controls service perimeter to protect.\n\nTo create a service perimeter, follow the instructions in [Create a service perimeter](/vpc-service-controls/docs/create-service-perimeters).\n\n### Add more projects to the service perimeter\n\nTo add existing Dataplex Universal Catalog projects to the perimeter,\nfollow the instructions in [Update a service perimeter](/vpc-service-controls/docs/manage-service-perimeters#update).\n\n### Add the Dataplex API to the service perimeter\n\nTo mitigate the risk of your data being exfiltrated from Dataplex Universal Catalog,\nfor example, using Dataplex API methods, you\nmust restrict the Dataplex API.\n\nTo add the Dataplex API as a restricted service, follow these steps: \n\n### Console\n\n1. In the Google Cloud console, go to the **VPC Service Controls** page.\n\n [Go to VPC Service Controls](https://console.cloud.google.com/security/service-perimeter)\n2. On the **VPC Service Controls** page, in the table, click the name of\n the service perimeter that you want to modify.\n\n3. Click **Edit Perimeter**.\n\n4. On the **Edit Service Perimeter** page,\n click **Add Services**.\n\n5. Add **Dataplex API**.\n\n6. Click **Save**.\n\n### gcloud\n\n- Use the `gcloud access-context-manager perimeters update` command:\n\n ```\n gcloud access-context-manager perimeters update PERIMETER_ID \\\n --policy=POLICY_ID \\\n --add-restricted-services=dataplex.googleapis.com\n ```\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003ePERIMETER_ID\u003c/var\u003e: the ID of the perimeter or the fully qualified identifier for the perimeter\n - \u003cvar translate=\"no\"\u003ePOLICY_ID\u003c/var\u003e: the ID of the access policy\n\nOptional: Create an access level\n--------------------------------\n\nTo permit external access to protected resources inside a perimeter,\nyou can use access levels. Access levels apply only to requests for protected\nresources coming from outside the service perimeter. You can't use access levels\nto give protected resources permission to access data and services outside the\nperimeter.\n\nFor more information, see\n[Allow access to protected resources from outside a perimeter](/vpc-service-controls/docs/use-access-levels).\n\nData lineage support\n--------------------\n\nData lineage is supported by restricted Virtual IP (VIP).\nFor more information, see\n[Services supported by the restricted VIP](/vpc-service-controls/docs/restricted-vip-services).\n\nWhat's next\n-----------\n\n- Learn more about [VPC Service Controls](/vpc-service-controls/docs).\n- Learn more about [Dataplex Universal Catalog access control with IAM](/dataplex/docs/iam-and-access-control).\n- Learn more about [Dataplex Universal Catalog security](/dataplex/docs/lake-security)."]]
