Mantenha tudo organizado com as coleções
Salve e categorize o conteúdo com base nas suas preferências.
Configurar conectores em projetos de serviço de VPC compartilhada
Se a organização usa a VPC compartilhada, é possível configurar
conectores de acesso VPC sem servidor no projeto de serviço ou no
projeto host. Este guia mostra como configurar um conector no projeto de serviço.
É necessário criar regras de firewall para permitir que as solicitações dos seguintes intervalos de IP alcancem o conector e sejam alcançadas por ele:
Intervalos NAT
107.178.230.64/26
35.199.224.0/19
Intervalos de verificação de integridade
130.211.0.0/22
35.191.0.0/16
108.170.220.0/23
Esses intervalos são usados pela infraestrutura do Google que serve como base para o Cloud Run functions, o Cloud Functions e o ambiente padrão do App Engine. Todas as solicitações desses IPs têm a garantia
de se originar da infraestrutura do Google, o que garante que sua função
se comunique apenas com o conector VPC a que ela está conectada.
Para uma configuração simples, aplique as regras para permitir que os serviços sem servidor em qualquer projeto de serviço conectado à rede VPC compartilhada enviem solicitações para qualquer recurso da rede.
Para aplicar essas regras, faça o seguinte:
Execute os três comandos a seguir para definir regras que permitem que as solicitações do ambiente sem servidor alcancem todos os conectores de VPC na rede:
Esta regra concede ao conector da VPC acesso a todos os recursos da rede. Para
limitar os recursos que seu ambiente sem servidor pode alcançar usando
o acesso VPC sem servidor,
especifique um destino para essas regras de firewall.
Criar regras de firewall para conectores específicos
Seguir o procedimento descrito em
Adicionar regras de firewall para permitir intervalos de IP
resulta em regras de firewall que se aplicam a todos os conectores, tanto os atuais
quanto os criados no futuro. Se você não quiser fazer isso, mas quiser criar regras somente para conectores específicos, poderá definir o escopo das regras para que elas se apliquem apenas a esses conectores.
Para limitar o escopo das regras a conectores específicos, use um destes
mecanismos:
Tags de rede. Cada conector tem duas tags de rede: vpc-connector e vpc-connector-REGION-CONNECTOR_NAME.
Use o último formato para limitar o escopo das suas regras de firewall a um conector
específico.
Intervalos de IP. Use esse método apenas para regras de saída, pois ele não funciona para entrada. É possível usar o intervalo de IP da sub-rede do conector para limitar o escopo das regras de firewall a um único conector de VPC.
Conceder permissões a contas de serviço nos projetos de serviço
Em cada projeto de serviço que usará conectores de VPC, o administrador de VPC compartilhada precisa conceder o papel de usuário de rede do Compute (compute.networkUser) no projeto host ao projeto de serviço cloudservices e às contas de serviço vpcaccess.
Ao usar a VPC compartilhada, o administrador de VPC compartilhada precisa criar uma sub-rede para cada conector. Siga a documentação sobre
como adicionar uma sub-rede para adicionar uma sub-rede /28 na
rede VPC compartilhada. Essa sub-rede precisa estar na mesma região que os serviços sem servidor que usarão o conector.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-09-05 UTC."],[[["\u003cp\u003eThis guide outlines the steps to configure Serverless VPC Access connectors within a Shared VPC service project, detailing the necessary procedures when operating in a Shared VPC environment.\u003c/p\u003e\n"],["\u003cp\u003eSetting up requires adding firewall rules to permit specified IP ranges, granting appropriate permissions to service accounts, and creating a subnet for the connector within the Shared VPC network.\u003c/p\u003e\n"],["\u003cp\u003eFirewall rules can be configured to apply to all connectors or limited to specific connectors using network tags or IP ranges, depending on security requirements and desired scope.\u003c/p\u003e\n"],["\u003cp\u003eService accounts in service projects must be granted the Compute Network User role in the host project to facilitate the use of VPC Connectors.\u003c/p\u003e\n"],["\u003cp\u003eAfter the initial setup, the process includes creating a Serverless VPC Access connector and configuring the serverless environment to utilize this connector, as detailed in the "Configuring Serverless VPC Access" documentation.\u003c/p\u003e\n"]]],[],null,["# Configure connectors in Shared VPC service projects\n\nConfigure connectors in Shared VPC service\nprojects\n===================================================\n\nIf your organization uses Shared VPC, you can set up\nServerless VPC Access connectors in either the service project or the\nhost project. This guide shows how to set up a connector in the service project.\n\nIf you need to set up a connector in the host project, see\n[Configure connectors in the host project](/functions/1stgendocs/networking/shared-vpc-host-project).\nTo learn about the advantages of each method, see\n[Connecting to a Shared VPC network](/functions/1stgendocs/networking/connecting-shared-vpc).\n\nAt a high level, you must take the following steps:\n\n1. [Add firewall rules to allow required IP ranges](#firewall-rules-shared-vpc)\n2. [Grant permissions](#grant-permissions)\n3. [Create a subnet](#subnet)\n4. In the page [Configuring Serverless VPC Access](/vpc/docs/configure-serverless-vpc-access), complete the steps in the following sections:\n - [Create a Serverless VPC Access connector](/vpc/docs/configure-serverless-vpc-access#create-connector)\n - [Configure your serverless environment to use a connector](/vpc/docs/configure-serverless-vpc-access#configure-environment)\n\nAdd firewall rules to allow IP ranges\n-------------------------------------\n\nTo perform these steps, you must have one of the following roles on the\nhost project:\n\n- Compute Engine [Security Admin](/compute/docs/access/iam#compute.securityAdmin) role\n- Custom [Identity and Access Management (IAM)](/iam) role with the [`compute.firewalls.create`](/compute/docs/reference/rest/v1/firewalls/insert#iam-permissions) permission enabled\n\nYou must create firewall rules to allow requests from the following IP ranges to\nreach the connector and to be reached by the connector:\n\n- NAT ranges\n - `107.178.230.64/26`\n - `35.199.224.0/19`\n- Health check ranges\n - `130.211.0.0/22`\n - `35.191.0.0/16`\n - `108.170.220.0/23`\n\nThese ranges are used by the Google infrastructure underlying Cloud Run,\nCloud Run functions, and App Engine Standard. All requests from these IPs are guaranteed\nto originate from Google infrastructure, which ensures that your function\nonly communicates with the VPC connector it is connected to.\n\nFor a simple configuration, apply the rules to allow serverless services in any\nservice project connected to the Shared VPC network to send requests to\nany resource in the network.\n| **Important:** The rules you create using the following process apply to existing and future connectors. If you want to scope these rules so they only apply to specified connectors, see [Create firewall rules for specific connectors](#create_firewall_rules_for_specific_connectors).\n\nTo apply these rules:\n\n1. Run the following three commands to set the rules to allow requests from the\n serverless environment to reach all VPC Connectors in the network:\n\n **Note:** In these commands, UDP and TCP ports are used for proxying and HTTP health checks, respectively. \n\n ```bash\n gcloud compute firewall-rules create serverless-to-vpc-connector \\\n --allow tcp:667,udp:665-666,icmp \\\n --source-ranges 107.178.230.64/26,35.199.224.0/19 \\\n --direction=INGRESS \\\n --target-tags vpc-connector \\\n --network=VPC_NETWORK\n ``` \n\n ```bash\n gcloud compute firewall-rules create vpc-connector-to-serverless \\\n --allow tcp:667,udp:665-666,icmp \\\n --destination-ranges 107.178.230.64/26,35.199.224.0/19 \\\n --direction=EGRESS \\\n --target-tags vpc-connector \\\n --network=VPC_NETWORK\n ``` \n\n ```bash\n gcloud compute firewall-rules create vpc-connector-health-checks \\\n --allow tcp:667 \\\n --source-ranges 130.211.0.0/22,35.191.0.0/16,108.170.220.0/23 \\\n --direction=INGRESS \\\n --target-tags vpc-connector \\\n --network=VPC_NETWORK\n ```\n\n Where \u003cvar translate=\"no\"\u003eVPC_NETWORK\u003c/var\u003e is the VPC network to attach your\n connector to.\n2. Create an ingress rule on your VPC network to allow requests\n from connectors:\n\n ```bash\n gcloud compute firewall-rules create vpc-connector-requests \\\n --allow tcp,udp,icmp \\\n --direction=INGRESS \\\n --source-tags vpc-connector \\\n --network=VPC_NETWORK\n ```\n\n This rule gives the VPC connector access to every resource in the network. To\n limit the resources that your serverless environment can reach using\n Serverless VPC Access,\n [specify a target for these firewall rules](/vpc/docs/firewalls#rule_assignment).\n\n### Create firewall rules for specific connectors\n\nFollowing the procedure in\n[Add firewall rules to allow IP ranges](#firewall-rules-shared-vpc)\nresults in firewall rules that apply to *all* connectors, both current ones\nand ones created in the future. If you don't want this, but instead want to\ncreate rules for specific connectors only, you can scope the rules so that\nthey apply only to those connectors.\n\nTo limit the scope of the rules to specific connectors, you can use one of the\nfollowing mechanisms:\n\n- Network tags. Every connector has two network tags: `vpc-connector` and `vpc-connector-`\u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e`-`\u003cvar translate=\"no\"\u003eCONNECTOR_NAME\u003c/var\u003e. Use the latter format to limit the scope of your firewall rules to a specific connector.\n- IP ranges. Use this for the Egress rules only, because it doesn't work for Ingress. You can use the IP range of the connector subnet to limit the scope of your firewall rules to a single VPC connector.\n\nGrant permissions to service accounts in your service projects\n--------------------------------------------------------------\n\nFor each service project that will use VPC Connectors, a Shared VPC\nAdmin must grant the Compute Network User\nrole ([`compute.networkUser`](/compute/docs/access/iam#compute.networkUser)) in the\nhost project to the service project `cloudservices` and `vpcaccess` service\naccounts.\n\nTo grant the role:\n\n1. Use these commands:\n\n ```bash\n gcloud projects add-iam-policy-binding HOST_PROJECT_ID \\\n --role \"roles/compute.networkUser\" \\\n --member \"serviceAccount:service-\u003cvar translate=\"no\"\u003eSERVICE_PROJECT_NUMBER\u003c/var\u003e@gcp-sa-vpcaccess.iam.gserviceaccount.com\"\n ``` \n\n ```bash\n gcloud projects add-iam-policy-binding HOST_PROJECT_ID \\\n --role \"roles/compute.networkUser\" \\\n --member \"serviceAccount:\u003cvar translate=\"no\"\u003eSERVICE_PROJECT_NUMBER\u003c/var\u003e@cloudservices.gserviceaccount.com\"\n ```\n2. If the `@gcp-sa-vpcaccess` service account does not exist, turn on the\n Serverless VPC Access API in the service project and try again:\n\n ```bash\n gcloud services enable vpcaccess.googleapis.com\n ```\n\n \u003cbr /\u003e\n\nIf you prefer not to grant these service accounts access to the entire\nShared VPC network and would rather only grant access to specific subnets, you\ncan instead [grant these roles to these service accounts on specific subnets only](/vpc/docs/shared-vpc#svc_proj_admins).\n\nCreate a subnet\n---------------\n\nWhen using Shared VPC, the Shared VPC Admin must create a subnet\nfor each connector. Follow the documentation in\n[adding a subnet](/vpc/docs/create-modify-vpc-networks#add-subnets) to add a `/28` subnet to the\nShared VPC network. This subnet must be in the same region as the\nserverless services that will use the connector.\n\nNext steps\n----------\n\n- In the page [Configuring Serverless VPC Access](/vpc/docs/configure-serverless-vpc-access), complete the steps in the following sections:\n - [Create a Serverless VPC Access connector](/vpc/docs/configure-serverless-vpc-access#create-connector)\n - [Configure your serverless environment to use a connector](/vpc/docs/configure-serverless-vpc-access#configure-environment)"]]
