[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-27。"],[[["\u003cp\u003eVPC Service Controls can be used to enhance the security of Dataproc Metastore services by creating service perimeters that protect resources from cross-perimeter requests, mitigating the risk of data exfiltration.\u003c/p\u003e\n"],["\u003cp\u003eConfiguring the VPC network with Private Google Access ensures that communication with Google APIs and services adheres to the associated service perimeter policy, restricting connectivity to the \u003ccode\u003emetastore.googleapis.com\u003c/code\u003e API.\u003c/p\u003e\n"],["\u003cp\u003eWhen setting up a service perimeter, the Dataproc Metastore projects that you want to protect must be selected, and if a Dataproc Metastore service uses a network from a different project, both the metastore and network projects must be in the same perimeter.\u003c/p\u003e\n"],["\u003cp\u003eTo prevent data exfiltration when using Dataproc Metastore import or export APIs, both the Dataproc Metastore API and the Cloud Storage API must be added as restricted services within the service perimeter, and any Cloud Storage buckets or objects must be within the same perimeter.\u003c/p\u003e\n"],["\u003cp\u003eAccess levels can optionally be created to permit external access to protected resources within a perimeter, but these levels cannot be used to grant protected resources permission to access data and services outside the perimeter.\u003c/p\u003e\n"]]],[],null,["# VPC Service Controls with Dataproc Metastore\n\nTo further secure your Dataproc Metastore services, you can protect\nthem using [VPC Service Controls (VPC-SC)](/vpc-service-controls/docs).\n\nVPC Service Controls helps mitigate the risk of data exfiltration. Using\nVPC Service Controls, you can add projects to service perimeters that\nprotect resources and services from requests that cross the perimeter.\n\nTo learn more about VPC Service Controls, see [Overview of VPC Service Controls](https://cloud.google.com/vpc-service-controls/docs/overview).\n\nDataproc Metastore resources are exposed on the\n`metastore.googleapis.com` API, which allows you to perform service-level\noperations, such as the creation and deletion of services.\n\nYou set up VPC Service Controls with Dataproc Metastore by\nrestricting connectivity to this API surface.\n\nConfigure the Virtual Private Cloud (VPC) network\n-------------------------------------------------\n\nYou can configure the VPC network to restrict Private Google Access\nwith respect to a service perimeter. This ensures that hosts on your VPC\nor on-premises network can only communicate with Google APIs and services that\nare supported by VPC Service Controls in ways which conform to the\nassociated perimeter's policy.\n\nFor more information, see [Setting up private connectivity to Google APIs and services](/vpc-service-controls/docs/set-up-private-connectivity).\n\nCreate a service perimeter\n--------------------------\n\nDuring this procedure, you select the Dataproc Metastore projects\nthat you want the VPC service perimeter to protect.\n\nTo create a service perimeter, follow the instructions in [Creating a service perimeter](/vpc-service-controls/docs/create-service-perimeters).\n\n### Add more projects to the service perimeter\n\nTo add existing Dataproc Metastore projects to the perimeter,\nfollow the instructions in [Updating a service perimeter](/vpc-service-controls/docs/manage-service-perimeters#update).\n| **Note:** If your Dataproc Metastore service uses a network belonging to a different project, and Compute Engine is protected by the service perimeter, then the metastore project and network project must be in the same perimeter.\n\n### Add the Dataproc Metastore and Cloud Storage APIs to the service perimeter\n\nTo mitigate the risk of your data being exfiltrated from Dataproc Metastore,\nfor example, when using Dataproc Metastore import or export APIs,\nyou must restrict both the **Dataproc Metastore API** and the\n**Cloud Storage API**.\n| **Note:** You can only import or export data from a Cloud Storage bucket that is in a project that resides in the same service perimeter as the Dataproc Metastore service. If you've configured Kerberos for a service, then the Secret Manager secret and krb5.conf Cloud Storage object must belong to a project that resides in the same service perimeter as the service.\n\nTo add Dataproc Metastore and Cloud Storage APIs as\nrestricted services: \n\n### Console\n\n1. In the Google Cloud console, open the VPC Service Controls page:\n\n [Go to the VPC Service Controls page in the\n Google Cloud console](https://console.cloud.google.com/security/service-perimeter)\n2. On the **VPC Service Controls** page, in the table, click the name of\n the service perimeter that you want to modify.\n\n3. Click **Edit Perimeter**.\n\n4. On the **Edit VPC Service Perimeter** page, click **Add Services**.\n\n5. Add **Dataproc Metastore API** and\n **Cloud Storage API**.\n\n6. Click **Save**.\n\n### gcloud\n\nRun the following `gcloud access-context-manager perimeters update`\ncommand:\n\n\u003cbr /\u003e\n\n```\n gcloud access-context-manager perimeters update PERIMETER_ID \n\n --policy=POLICY_ID \n\n --add-restricted-services=metastore.googleapis.com,storage.googleapis.com\n \n```\n\n\u003cbr /\u003e\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePERIMETER_ID\u003c/var\u003e: The ID of the perimeter or the fully qualifed identifier for the perimeter.\n- \u003cvar translate=\"no\"\u003ePOLICY_ID\u003c/var\u003e: The ID of the access policy.\n\nCreate an access level\n----------------------\n\nOptionally, to permit external access to protected resources inside a perimeter,\nyou can use access levels. Access levels apply only to requests for protected\nresources coming from outside the service perimeter. You can't use access levels\nto give protected resources permission to access data and services outside the\nperimeter.\n\nSee [Allowing access to protected resources from outside a perimeter](/vpc-service-controls/docs/use-access-levels).\n\nWhat's next\n-----------\n\n- [VPC Service Controls](/vpc-service-controls/docs)\n- [Service access](/dataproc-metastore/docs/access-service)\n- [Dataproc Metastore IAM and access control](/dataproc-metastore/docs/iam-and-access-control)"]]
