Mengonfigurasi grup identitas dan identitas pihak ketiga dalam aturan masuk dan keluar
Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Halaman ini menjelaskan cara menggunakan grup identitas dalam aturan masuk dan keluar untuk
mengizinkan akses ke resource yang dilindungi oleh perimeter layanan.
Kontrol Layanan VPC menggunakan aturan ingress dan egressuntuk mengizinkan akses ke dan dari resource serta klien yang dilindungi oleh perimeter layanan. Untuk lebih
memperbaiki akses, Anda dapat menentukan grup identitas dalam aturan masuk dan keluar.
Grup identitas adalah cara mudah untuk menerapkan kontrol akses ke kumpulan
pengguna dan memungkinkan Anda mengelola identitas yang memiliki kebijakan akses serupa.
Untuk mengonfigurasi grup identitas dalam aturan ingress atau egress, Anda dapat menggunakan
grup identitas yang didukung berikut dalam atribut identities:
Saat Anda membuat perimeter atau mengedit perimeter di Google Cloud konsol,
pilih Kebijakan masuk.
Di bagian Dari kebijakan ingress, pilih Pilih identitas & grup
dari daftar Identitas.
Klik Tambahkan identitas.
Di panel Tambahkan identitas, tentukan grup Google atau identitas pihak ketiga yang ingin Anda beri akses ke resource dalam perimeter.
Untuk menentukan grup identitas, gunakan format yang ditentukan dalam Grup identitas yang didukung.
Klik Tambahkan identitas.
Klik Simpan.
Untuk mengetahui informasi tentang atribut aturan ingress lainnya, lihat Referensi aturan ingress.
gcloud
Anda dapat mengonfigurasi aturan ingress untuk menggunakan grup identitas menggunakan file JSON atau
file YAML. Contoh berikut menggunakan format YAML:
PRINCIPAL_IDENTIFIER: tentukan grup Google atau identitas pihak ketiga yang ingin Anda beri akses ke resource dalam perimeter.
Untuk menentukan grup identitas, gunakan format yang ditentukan dalam Grup identitas yang didukung.
Untuk mengetahui informasi tentang atribut aturan ingress lainnya, lihat Referensi aturan ingress.
Setelah memperbarui aturan traffic masuk yang ada untuk mengonfigurasi grup identitas,
Anda harus memperbarui kebijakan aturan perimeter layanan:
Saat Anda membuat perimeter atau mengedit perimeter di konsol Google Cloud , pilih Kebijakan egress.
Di bagian Dari kebijakan keluar, pilih Pilih identitas & grup
dari daftar Identitas.
Klik Tambahkan identitas.
Di panel Tambahkan identitas, tentukan grup Google atau identitas pihak ketiga
yang dapat mengakses resource tertentu di luar perimeter.
Untuk menentukan grup identitas, gunakan format yang ditentukan dalam Grup identitas yang didukung.
Anda dapat mengonfigurasi aturan traffic keluar untuk menggunakan grup identitas menggunakan file JSON atau
file YAML. Contoh berikut menggunakan format YAML:
PRINCIPAL_IDENTIFIER: menentukan grup Google atau
identitas pihak ketiga yang dapat mengakses resource tertentu di luar perimeter.
Untuk menentukan grup identitas, gunakan format yang ditentukan dalam Grup identitas yang didukung.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-18 UTC."],[],[],null,["# Configure identity groups and third-party identities in ingress and egress rules\n\nThis page describes how to use identity groups in ingress and egress rules to\nallow access to resources protected by service perimeters.\n\nVPC Service Controls uses [ingress and egress\nrules](/vpc-service-controls/docs/ingress-egress-rules) to allow access to and\nfrom the resources and clients protected by service perimeters. To further\nrefine access, you can specify identity groups in your ingress and egress rules.\n\nAn identity group is a convenient way to apply access controls to a collection\nof users and lets you manage identities that have similar access policies.\n\nTo configure identity groups in the ingress or egress rules, you can use the\nfollowing supported identity groups in the `identities` attribute:\n\n- [Google group](/iam/docs/overview#google_group)\n- Third-party identities such as\n [workforce pool users](/iam/docs/workforce-identity-federation) and [workload\n identities](/iam/docs/workload-identity-federation).\n\n VPC Service Controls doesn't support [Workload Identity Federation for GKE](/kubernetes-engine/docs/concepts/workload-identity).\n\nFor information about how to apply ingress and egress rule policies, see\n[Configuring ingress and egress\npolicies](/vpc-service-controls/docs/configuring-ingress-egress-policies).\n\nBefore you begin\n----------------\n\n- Make sure that you read the [Ingress and egress\n rules](/vpc-service-controls/docs/ingress-egress-rules#ingress-rules-reference).\n\nConfigure identity groups in ingress rules\n------------------------------------------\n\n### Console\n\nWhen you [update an ingress policy of a service perimeter](/vpc-service-controls/docs/configuring-ingress-egress-policies#console)\nor [set an ingress policy during perimeter creation](/vpc-service-controls/docs/configuring-ingress-egress-policies#console_1)\nusing the Google Cloud console, you can configure the ingress rule to use identity groups.\n\n1. When you create a perimeter or edit a perimeter in the Google Cloud console,\n select **Ingress policy**.\n\n2. In the **From** section of your ingress policy, select **Select identities \\& groups**\n from the **Identities** list.\n\n3. Click **Add identities**.\n\n4. In the **Add identities** pane, specify a Google group or a third-party\n identity to which you want to provide access to resources in the perimeter.\n To specify an identity group, use the format specified in [Supported identity\n groups](/vpc-service-controls/docs/configure-identity-groups#supported-identity-groups).\n\n5. Click **Add identities**.\n\n6. Click **Save**.\n\nFor information about the other ingress rule attributes, see [Ingress rules reference](/vpc-service-controls/docs/ingress-egress-rules#ingress-rules-reference).\n\n### gcloud\n\nYou can configure an ingress rule to use identity groups using a JSON file or a\nYAML file. The following sample uses the YAML format: \n\n - ingressFrom:\n identities:\n - \u003cvar translate=\"no\"\u003ePRINCIPAL_IDENTIFIER\u003c/var\u003e\n sources:\n - resource: \u003cvar translate=\"no\"\u003eRESOURCE\u003c/var\u003e\n *OR*\n - accessLevel: \u003cvar translate=\"no\"\u003eACCESS_LEVEL\u003c/var\u003e\n ingressTo:\n operations:\n - serviceName: \u003cvar translate=\"no\"\u003eSERVICE_NAME\u003c/var\u003e\n methodSelectors:\n - method: \u003cvar translate=\"no\"\u003eMETHOD_NAME\u003c/var\u003e\n resources:\n - projects/\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePRINCIPAL_IDENTIFIER\u003c/var\u003e: specify a Google group or a third-party identity to which you want to provide access to resources in the perimeter. To specify an identity group, use the format specified in [Supported identity\n groups](/vpc-service-controls/docs/configure-identity-groups#supported-identity-groups).\n\nFor information about the other ingress rule attributes, see [Ingress rules reference](/vpc-service-controls/docs/ingress-egress-rules#ingress-rules-reference).\n\nAfter you update an existing ingress rule to configure identity groups,\nyou need to update the rule policies of the service perimeter: \n\n```\ngcloud access-context-manager perimeters update PERIMETER_ID --set-ingress-policies=RULE_POLICY.yaml\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePERIMETER_ID\u003c/var\u003e: the ID of the service perimeter that you want to update.\n- \u003cvar translate=\"no\"\u003eRULE_POLICY\u003c/var\u003e: the path of the modified ingress rule file.\n\nFor more information, see [Updating ingress and egress policies for a service\nperimeter](/vpc-service-controls/docs/configuring-ingress-egress-policies#updating).\n\nConfigure identity groups in egress rules\n-----------------------------------------\n\n### Console\n\nWhen you [update an egress policy of a service perimeter](/vpc-service-controls/docs/configuring-ingress-egress-policies#console)\nor [set an egress policy during perimeter creation](/vpc-service-controls/docs/configuring-ingress-egress-policies#console_1)\nusing the Google Cloud console, you can configure the egress rule to use identity groups.\n\n1. When you create a perimeter or edit a perimeter in the Google Cloud console,\n select **Egress policy**.\n\n2. In the **From** section of your egress policy, select **Select identities \\& groups**\n from the **Identities** list.\n\n3. Click **Add identities**.\n\n4. In the **Add identities** pane, specify a Google group or a third-party\n identity that can access the specified resources outside the perimeter.\n To specify an identity group, use the format specified in [Supported identity\n groups](/vpc-service-controls/docs/configure-identity-groups#supported-identity-groups).\n\n5. Click **Add identities**.\n\n6. Click **Save**.\n\nFor information about the other egress rule attributes, see [Egress rules reference](/vpc-service-controls/docs/ingress-egress-rules#egress-rules-reference).\n\n### gcloud\n\nYou can configure an egress rule to use identity groups using a JSON file or a\nYAML file. The following sample uses the YAML format: \n\n - egressTo:\n operations:\n - serviceName: \u003cvar translate=\"no\"\u003eSERVICE_NAME\u003c/var\u003e\n methodSelectors:\n - method: \u003cvar translate=\"no\"\u003eMETHOD_NAME\u003c/var\u003e\n resources:\n - projects/\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e\n egressFrom:\n identities:\n - \u003cvar translate=\"no\"\u003ePRINCIPAL_IDENTIFIER\u003c/var\u003e\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePRINCIPAL_IDENTIFIER\u003c/var\u003e: specify a Google group or a third-party identity that can access the specified resources outside the perimeter. To specify an identity group, use the format specified in [Supported identity\n groups](/vpc-service-controls/docs/configure-identity-groups#supported-identity-groups).\n\nFor information about the other egress rule attributes, see [Egress rules reference](/vpc-service-controls/docs/ingress-egress-rules#egress-rules-reference).\n\nAfter you update an existing egress rule to configure identity groups,\nyou need to update the rule policies of the service perimeter: \n\n```\ngcloud access-context-manager perimeters update PERIMETER_ID --set-egress-policies=RULE_POLICY.yaml\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePERIMETER_ID\u003c/var\u003e: the ID of the service perimeter that you want to update.\n- \u003cvar translate=\"no\"\u003eRULE_POLICY\u003c/var\u003e: the path of the modified egress rule file.\n\nFor more information, see [Updating ingress and egress policies for a service\nperimeter](/vpc-service-controls/docs/configuring-ingress-egress-policies#updating).\n\nSupported identity groups\n-------------------------\n\nVPC Service Controls supports the following identity groups from the\n[IAM `v1` API Principal identifiers](/iam/docs/principal-identifiers#v1):\n\nFor more information about these identities, see [Principal identifiers for\nallow policies](/iam/docs/principal-identifiers#allow).\n\nLimitations\n-----------\n\n- Before using identity groups, understand the [unsupported features](/vpc-service-controls/docs/ingress-egress-rules#unsupported-features) in ingress and egress rules.\n- When you use identity groups in an egress rule, you can't set the `resources` field in the `egressTo` attribute to `\"*\"`.\n- For information about ingress and egress rule limits, see [Quotas and\n limits](/vpc-service-controls/quotas).\n\nWhat's next\n-----------\n\n- [Example of using identity groups and third-party identities in ingress and egress rules](/vpc-service-controls/docs/identity-groups-examples)"]]
