Mantenha tudo organizado com as coleções
Salve e categorize o conteúdo com base nas suas preferências.
O VPC Service Controls ajuda a reduzir o risco de cópia ou
transferência não autorizada de dados dos serviços gerenciados pelo Google.
Com VPC Service Controls, é possível configurar os perímetros de serviço em torno dos
recursos dos serviços gerenciados pelo Google e controlar a movimentação de dados
em todo o limite do perímetro.
Ao projetar o perímetro de serviço, inclua os seguintes serviços:
API Migration Center (migrationcenter.googleapis.com)
API Cloud Storage (storage.googleapis.com)
API Resource Manager (cloudresourcemanager.googleapis.com)
API Cloud Logging (logging.googleapis.com)
Permitir tráfego com regras de transferência de dados de entrada
Por padrão, o perímetro de serviço foi projetado para impedir a transferência de dados de entrada
de serviços fora do perímetro.
Se você planeja usar a importação de dados para fazer upload de dados de fora do perímetro ou usar o discovery client para coletar dados de infraestrutura, configure regras de acesso a dados para permitir isso.
SERVICE_ACCOUNT: a conta de serviço por produto e por projeto
que você usa para fazer upload de dados no Migration Center, com o
seguinte formato:
service-PROJECT_NUMBER@gcp-sa-migcenter.iam.gserviceaccount.com.
Aqui, PROJECT_NUMBER é o identificador exclusivo do
projetoGoogle Cloud em que você ativou a API Migration Center.
Para mais informações sobre números de projeto, consulte
Como identificar projetos.
PROJECT_ID: o ID do projeto dentro do perímetro
em que você quer fazer upload dos dados.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-09-04 UTC."],[],[],null,["# Secure your data with a service perimeter\n\nVPC Service Controls helps you reduce the risk of unauthorized copying or\ntransfer of data from your Google-managed services.\n\nWith VPC Service Controls, you can configure service perimeters around the\nresources of your Google-managed services and control the movement of data\nacross the perimeter boundary.\n\nCreate a service perimeter\n--------------------------\n\nTo create a service perimeter, follow the\n[VPC Service Controls guide to creating a service perimeter](/vpc-service-controls/docs/create-service-perimeters).\n\nWhen you design the service perimeter, include the following services:\n\n- Migration Center API (`migrationcenter.googleapis.com`)\n- Cloud Storage API (`storage.googleapis.com`)\n- Resource Manager API (`cloudresourcemanager.googleapis.com`)\n- Cloud Logging API (`logging.googleapis.com`)\n\nAllow traffic with inbound data transfer rules\n----------------------------------------------\n\nBy default, the service perimeter is designed to prevent inbound data transfer\nfrom services outside of the perimeter.\nIf you plan to use data import to upload data from outside the perimeter,\nor use the discovery client to collect your infrastructure data,\nconfigure data access rules to allow this.\n\n### Enable data import\n\nTo enable data import, specify the\n[inbound data transfer rules](/vpc-service-controls/docs/ingress-egress-rules#ingress-rules-reference)\nusing the following syntax: \n\n - ingressFrom:\n identities:\n - serviceAccount: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eSERVICE_ACCOUNT\u003c/span\u003e\u003c/var\u003e\n sources:\n - accessLevel: \\\"*\\\"\n - ingressTo:\n operations:\n - serviceName: storage.googleapis.com\n methodSelectors:\n - method: google.storage.buckets.testIamPermissions\n - method: google.storage.objects.create\n resources:\n - projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eSERVICE_ACCOUNT\u003c/var\u003e: the per-product, per-project service\n account that you use to upload data to Migration Center, with the\n following format:\n `service-`\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e`@gcp-sa-migcenter.iam.gserviceaccount.com.`\n\n Here \u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e is the unique identifier of the\n Google Cloud project where you enabled the Migration Center API.\n For more information on project numbers, see\n [Identifying projects](/resource-manager/docs/creating-managing-projects#identifying_projects).\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the ID of the project inside the perimeter\n that you want to upload the data to.\n\nYou can't use\n[`ANY_SERVICE_ACCOUNT` and `ANY_USER_ACCOUNT`](/vpc-service-controls/docs/ingress-egress-rules#unsupported-features)\nidentity types with signed URLs.\nFor more information, see\n[Allow access to protected resources from outside the perimeter](/vpc-service-controls/docs/use-access-levels).\n\n### Enable data collection with discovery client\n\nTo enable data collection with the discovery client, specify\nthe inbound data transfer rules with the following syntax: \n\n - ingressFrom:\n identities:\n - serviceAccount: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eSERVICE_ACCOUNT\u003c/span\u003e\u003c/var\u003e\n sources:\n - accessLevel: \\\"*\\\"\n - ingressTo:\n operations:\n - serviceName: storage.googleapis.com\n methodSelectors:\n - method: \\\"*\\\"\n resources:\n - projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eSERVICE_ACCOUNT\u003c/var\u003e: the service account that you\n used to create the discovery client. For more information, review\n the [discovery client installation process](/migration-center/docs/installation-process#create_a_service_account).\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the ID of the project inside the perimeter\n that you want to upload the data to."]]
