借助 VPC Service Controls，您可以定义 Integration Connectors Google Cloud 服务的安全边界。借助服务的安全边界，您可以将数据限制在 VPC Service Controls 边界内并降低数据渗漏风险。如果您尚不熟悉 VPC Service Controls，建议您浏览以下信息：
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-19。"],[[["\u003cp\u003eVPC Service Controls establishes a security perimeter around the Integration Connectors service, helping to prevent data exfiltration.\u003c/p\u003e\n"],["\u003cp\u003eSetting up the perimeter allows you to define policies that control which Google Cloud services or users can access the \u003ccode\u003econnectors.googleapis.com\u003c/code\u003e service.\u003c/p\u003e\n"],["\u003cp\u003eConnections to Google Cloud resources must be accessible within the VPC Service Controls perimeter, and connections to public or non-Google Cloud endpoints must use Private Service Connect (PSC) attachments.\u003c/p\u003e\n"],["\u003cp\u003eYou can create a VPC Service Controls perimeter using the Google Cloud console, \u003ccode\u003egcloud\u003c/code\u003e commands, or the accessPolicies.servicePerimeters.create API, with steps including setting user access and enabling the \u003ccode\u003evpcsc\u003c/code\u003e attribute in project settings.\u003c/p\u003e\n"],["\u003cp\u003eRemoving a project from the VPC Service Controls perimeter involves setting the \u003ccode\u003evpcsc\u003c/code\u003e attribute to \u003ccode\u003efalse\u003c/code\u003e and then updating the perimeter to remove the project.\u003c/p\u003e\n"]]],[],null,["# Set up VPC Service Controls for Integration Connectors\n======================================================\n\n\nVPC Service Controls lets you define a security perimeter around\nthe Integration Connectors Google Cloud service. With the security\nperimeter around your service, you can constrain data within a VPC Service Controls perimeter and\nmitigate data exfiltration risks. If you are not already familiar\nwith VPC Service Controls, it is recommended that you go\nthrough the following information:\n\n- [Overview of VPC Service Controls](/vpc-service-controls/docs/overview)\n- [Service perimeter details and configuration](/vpc-service-controls/docs/service-perimeters)\n- [Grant access to VPC Service Controls](/vpc-service-controls/docs/access-control)\n\n\nThis document describes how to restrict access to Integration Connectors service (`connectors.googleapis.com`)\nby using the VPC Service Controls perimeter. After setting up the perimeter,\nyou can configure policies that determine what other\nGoogle Cloud services or users can access the `connectors.googleapis.com` service.\n\nConsiderations\n--------------\n\n- If your connection is connecting to a Google Cloud resource, then that resource must be accessible from within the VPC Service Controls perimeter.\n- If you have existing connections to a public endpoint, before setting up the VPC Service Controls perimeter, ensure that such connections use the PSC ([Private Service Connect](/integration-connectors/docs/private-connectivity-overview)) attachment to connect the backend systems. Without the PSC attachment, existing connections to a public endpoint will fail after you set up the VPC Service Controls perimeter.\n- If your connection is connecting to a non-Google Cloud resource, the destination of the connection should be a PSC attachment. Connections created without the PSC attacment will fail.\n- If you are setting up a VPC Service Controls perimeter for your Google Cloud project, you must enable private connectivity for event subscriptions to use the [event subscription feature](/integration-connectors/docs/eventsubscription) for the project.\n\nBefore you begin\n----------------\n\nEnsure that you have the required permissions to configure VPC Service Controls perimeters. To view a list of IAM roles required to configure VPC Service Controls, see [Access control with IAM](/vpc-service-controls/docs/access-control) in the VPC Service Controls documentation.\n\nCreate a VPC Service Controls perimeter\n---------------------------------------\n\n\nTo create a VPC Service Controls perimeter you can use either the `Google Cloud console`,\nor the `gcloud` command, or the [accessPolicies.servicePerimeters.create](/access-context-manager/docs/reference/rest/v1/accessPolicies.servicePerimeters/create) API.\nFor more information, see [Create a service perimeter](/vpc-service-controls/docs/create-service-perimeters#create-perimeter).\n\nThe following steps show how to create a VPC Service Controls perimeter with a user access enabled by using\nthe `gcloud` commands.\n\n1. Create an `access.yaml` file having the details of the user who is allowed to access the perimeter. For example: \n\n ```yaml\n - members:\n - user:\u003cvar translate=\"no\"\u003eUSER_EMAIL\u003c/var\u003e\n ```\n2. Get your organization's access policy ID by using the following command: \n\n```bash\ngcloud access-context-manager policies list --organization=ORGANIZATION_ID\n```\n3. This command lists all the policies for the organization. From the list, select the policy for which you want to create the VPC Service Controls perimeter.\n4. You can view your organization's resource ID by using the Google Cloud console. For more information, see [Getting your organization resource ID](/resource-manager/docs/creating-managing-organization#retrieving_your_organization_id).\n5. Create access level for the user. \n\n ```bash\n gcloud access-context-manager levels create ACCESS_LEVEL_NAME \\\n --title \"\u003cvar translate=\"no\"\u003eCUSTOM_TITLE\u003c/var\u003e\" \\\n --basic-level-spec access.yaml \\\n --policy=POLICY_ID\n ```\n\n In this command, POLICY_ID, is the value that you got from the previous step.\n6. In your Google Cloud project's global settings, set the value of the `vpcsc` attribute to `true`. \n\n ```scdoc\n curl -X PATCH -H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"vpcsc\": true}' \\\n https://connectors.googleapis.com/v1/projects/PROJECT_ID/locations/global/settings\n ```\n\n This command returns an operation ID and starts a long-running operation (LRO) which\n may take some time to complete. Wait for the LRO to complete. You can track the progress of\n the operation by using the following command: \n\n ```scdoc\n curl -H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n -H \"Content-Type: application/json\" \\\n https://connectors.googleapis.com/v1/projects/PROJECT_ID/locations/global/operations/OPERATION_ID\n ```\n7. Create the VPC Service Controls perimeter and provide access to the user. \n\n ```bash\n gcloud access-context-manager perimeters create PERIMETER_NAME \\\n --title=\"\u003cvar translate=\"no\"\u003ePERIMETER_TITLE\u003c/var\u003e\" \\\n --resources=projects/PROJECT_ID \\\n --restricted-services=connectors.googleapis.com \\\n --access_levels=ACCESS_LEVEL_NAME\n ```\n\n This command takes some time to complete, during which you can run other tasks in a new\n terminal.\n If want to update the access level, and add the `connectors.googleapis.com` service to an existing perimeter, run the following command: \n\n ```scdoc\n gcloud access-context-manager perimeters update PERIMETER_NAME \\\n --add-restricted-services=\"connectors.googleapis.com\" \\\n --add-access-levels=ACCESS_LEVEL_NAME \\\n --policy=POLICY_ID\n ```\n\nVerify your perimeter\n---------------------\n\n\nTo verify the perimeter, use the [gcloud access-context-manager perimeters describe \u003cvar translate=\"no\"\u003ePERIMETER_NAME\u003c/var\u003e](/sdk/gcloud/reference/access-context-manager/perimeters/describe)\ncommand. For example: \n\n```bash\ngcloud access-context-manager perimeters describe PERIMETER_NAME\n```\n\n\nFor more information, see\n[Managing service perimeters](/vpc-service-controls/docs/manage-service-perimeters#list-and-describe).\n\nRemove a project from the VPC Service Controls perimeter\n--------------------------------------------------------\n\nTo remove your Google Cloud project from the VPC Service Controls perimeter, perform the following steps:\n\n1. In your Google Cloud project's global settings, set the value of the `vpcsc` attribute to `false`. \n\n ```scdoc\n curl -X PATCH -H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"vpcsc\": false}' \\\n https://connectors.googleapis.com/v1/projects/PROJECT_ID/locations/global/settings\n ```\n\n This command returns an operation ID and starts a long-running operation (LRO) which\n may take some time to complete. Wait for the LRO to complete. You can track the progress of\n the operation by using the following command: \n\n ```scdoc\n curl -H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n -H \"Content-Type: application/json\" \\\n https://connectors.googleapis.com/v1/projects/PROJECT_ID/locations/global/operations/OPERATION_ID\n ```\n2. Remove your project from the VPC Service Controls perimeter. \n\n ```scdoc\n gcloud access-context-manager perimeters update accessPolicies/POLICY_ID/servicePerimeters/PERIMETER_NAME\n ```\n\nWhat's next\n-----------\n\nLearn how [VPC Service Controls](/vpc-service-controls/docs/overview) protects your data."]]
