Dataproc Metastore リソースは metastore.googleapis.com API で公開されており、サービスの作成や削除など、サービスレベルのオペレーションを実行できます。
この API サーフェスへの接続を制限することによって、Dataproc Metastore で VPC Service Controls を設定します。
Virtual Private Cloud（VPC）ネットワークを構成する
サービス境界に対する限定公開の Google アクセスを制限するように VPC ネットワークを構成できます。これにより、VPC またはオンプレミス ネットワーク上のホストは、関連する境界のポリシーに準拠した方法で VPC Service Controls によりサポートされている Google API およびサービスに限り通信できます。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-02-11 UTC。"],[[["VPC Service Controls can be used to enhance the security of Dataproc Metastore services by creating service perimeters that protect resources from cross-perimeter requests, mitigating the risk of data exfiltration."],["Configuring the VPC network with Private Google Access ensures that communication with Google APIs and services adheres to the associated service perimeter policy, restricting connectivity to the `metastore.googleapis.com` API."],["When setting up a service perimeter, the Dataproc Metastore projects that you want to protect must be selected, and if a Dataproc Metastore service uses a network from a different project, both the metastore and network projects must be in the same perimeter."],["To prevent data exfiltration when using Dataproc Metastore import or export APIs, both the Dataproc Metastore API and the Cloud Storage API must be added as restricted services within the service perimeter, and any Cloud Storage buckets or objects must be within the same perimeter."],["Access levels can optionally be created to permit external access to protected resources within a perimeter, but these levels cannot be used to grant protected resources permission to access data and services outside the perimeter."]]],[]]
