[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-18。"],[],[],null,["# Configure identity groups and third-party identities in ingress and egress rules\n\nThis page describes how to use identity groups in ingress and egress rules to\nallow access to resources protected by service perimeters.\n\nVPC Service Controls uses [ingress and egress\nrules](/vpc-service-controls/docs/ingress-egress-rules) to allow access to and\nfrom the resources and clients protected by service perimeters. To further\nrefine access, you can specify identity groups in your ingress and egress rules.\n\nAn identity group is a convenient way to apply access controls to a collection\nof users and lets you manage identities that have similar access policies.\n\nTo configure identity groups in the ingress or egress rules, you can use the\nfollowing supported identity groups in the `identities` attribute:\n\n- [Google group](/iam/docs/overview#google_group)\n- Third-party identities such as\n [workforce pool users](/iam/docs/workforce-identity-federation) and [workload\n identities](/iam/docs/workload-identity-federation).\n\n VPC Service Controls doesn't support [Workload Identity Federation for GKE](/kubernetes-engine/docs/concepts/workload-identity).\n\nFor information about how to apply ingress and egress rule policies, see\n[Configuring ingress and egress\npolicies](/vpc-service-controls/docs/configuring-ingress-egress-policies).\n\nBefore you begin\n----------------\n\n- Make sure that you read the [Ingress and egress\n rules](/vpc-service-controls/docs/ingress-egress-rules#ingress-rules-reference).\n\nConfigure identity groups in ingress rules\n------------------------------------------\n\n### Console\n\nWhen you [update an ingress policy of a service perimeter](/vpc-service-controls/docs/configuring-ingress-egress-policies#console)\nor [set an ingress policy during perimeter creation](/vpc-service-controls/docs/configuring-ingress-egress-policies#console_1)\nusing the Google Cloud console, you can configure the ingress rule to use identity groups.\n\n1. When you create a perimeter or edit a perimeter in the Google Cloud console,\n select **Ingress policy**.\n\n2. In the **From** section of your ingress policy, select **Select identities \\& groups**\n from the **Identities** list.\n\n3. Click **Add identities**.\n\n4. In the **Add identities** pane, specify a Google group or a third-party\n identity to which you want to provide access to resources in the perimeter.\n To specify an identity group, use the format specified in [Supported identity\n groups](/vpc-service-controls/docs/configure-identity-groups#supported-identity-groups).\n\n5. Click **Add identities**.\n\n6. Click **Save**.\n\nFor information about the other ingress rule attributes, see [Ingress rules reference](/vpc-service-controls/docs/ingress-egress-rules#ingress-rules-reference).\n\n### gcloud\n\nYou can configure an ingress rule to use identity groups using a JSON file or a\nYAML file. The following sample uses the YAML format: \n\n - ingressFrom:\n identities:\n - \u003cvar translate=\"no\"\u003ePRINCIPAL_IDENTIFIER\u003c/var\u003e\n sources:\n - resource: \u003cvar translate=\"no\"\u003eRESOURCE\u003c/var\u003e\n *OR*\n - accessLevel: \u003cvar translate=\"no\"\u003eACCESS_LEVEL\u003c/var\u003e\n ingressTo:\n operations:\n - serviceName: \u003cvar translate=\"no\"\u003eSERVICE_NAME\u003c/var\u003e\n methodSelectors:\n - method: \u003cvar translate=\"no\"\u003eMETHOD_NAME\u003c/var\u003e\n resources:\n - projects/\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePRINCIPAL_IDENTIFIER\u003c/var\u003e: specify a Google group or a third-party identity to which you want to provide access to resources in the perimeter. To specify an identity group, use the format specified in [Supported identity\n groups](/vpc-service-controls/docs/configure-identity-groups#supported-identity-groups).\n\nFor information about the other ingress rule attributes, see [Ingress rules reference](/vpc-service-controls/docs/ingress-egress-rules#ingress-rules-reference).\n\nAfter you update an existing ingress rule to configure identity groups,\nyou need to update the rule policies of the service perimeter: \n\n```\ngcloud access-context-manager perimeters update PERIMETER_ID --set-ingress-policies=RULE_POLICY.yaml\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePERIMETER_ID\u003c/var\u003e: the ID of the service perimeter that you want to update.\n- \u003cvar translate=\"no\"\u003eRULE_POLICY\u003c/var\u003e: the path of the modified ingress rule file.\n\nFor more information, see [Updating ingress and egress policies for a service\nperimeter](/vpc-service-controls/docs/configuring-ingress-egress-policies#updating).\n\nConfigure identity groups in egress rules\n-----------------------------------------\n\n### Console\n\nWhen you [update an egress policy of a service perimeter](/vpc-service-controls/docs/configuring-ingress-egress-policies#console)\nor [set an egress policy during perimeter creation](/vpc-service-controls/docs/configuring-ingress-egress-policies#console_1)\nusing the Google Cloud console, you can configure the egress rule to use identity groups.\n\n1. When you create a perimeter or edit a perimeter in the Google Cloud console,\n select **Egress policy**.\n\n2. In the **From** section of your egress policy, select **Select identities \\& groups**\n from the **Identities** list.\n\n3. Click **Add identities**.\n\n4. In the **Add identities** pane, specify a Google group or a third-party\n identity that can access the specified resources outside the perimeter.\n To specify an identity group, use the format specified in [Supported identity\n groups](/vpc-service-controls/docs/configure-identity-groups#supported-identity-groups).\n\n5. Click **Add identities**.\n\n6. Click **Save**.\n\nFor information about the other egress rule attributes, see [Egress rules reference](/vpc-service-controls/docs/ingress-egress-rules#egress-rules-reference).\n\n### gcloud\n\nYou can configure an egress rule to use identity groups using a JSON file or a\nYAML file. The following sample uses the YAML format: \n\n - egressTo:\n operations:\n - serviceName: \u003cvar translate=\"no\"\u003eSERVICE_NAME\u003c/var\u003e\n methodSelectors:\n - method: \u003cvar translate=\"no\"\u003eMETHOD_NAME\u003c/var\u003e\n resources:\n - projects/\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e\n egressFrom:\n identities:\n - \u003cvar translate=\"no\"\u003ePRINCIPAL_IDENTIFIER\u003c/var\u003e\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePRINCIPAL_IDENTIFIER\u003c/var\u003e: specify a Google group or a third-party identity that can access the specified resources outside the perimeter. To specify an identity group, use the format specified in [Supported identity\n groups](/vpc-service-controls/docs/configure-identity-groups#supported-identity-groups).\n\nFor information about the other egress rule attributes, see [Egress rules reference](/vpc-service-controls/docs/ingress-egress-rules#egress-rules-reference).\n\nAfter you update an existing egress rule to configure identity groups,\nyou need to update the rule policies of the service perimeter: \n\n```\ngcloud access-context-manager perimeters update PERIMETER_ID --set-egress-policies=RULE_POLICY.yaml\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePERIMETER_ID\u003c/var\u003e: the ID of the service perimeter that you want to update.\n- \u003cvar translate=\"no\"\u003eRULE_POLICY\u003c/var\u003e: the path of the modified egress rule file.\n\nFor more information, see [Updating ingress and egress policies for a service\nperimeter](/vpc-service-controls/docs/configuring-ingress-egress-policies#updating).\n\nSupported identity groups\n-------------------------\n\nVPC Service Controls supports the following identity groups from the\n[IAM `v1` API Principal identifiers](/iam/docs/principal-identifiers#v1):\n\nFor more information about these identities, see [Principal identifiers for\nallow policies](/iam/docs/principal-identifiers#allow).\n\nLimitations\n-----------\n\n- Before using identity groups, understand the [unsupported features](/vpc-service-controls/docs/ingress-egress-rules#unsupported-features) in ingress and egress rules.\n- When you use identity groups in an egress rule, you can't set the `resources` field in the `egressTo` attribute to `\"*\"`.\n- For information about ingress and egress rule limits, see [Quotas and\n limits](/vpc-service-controls/quotas).\n\nWhat's next\n-----------\n\n- [Example of using identity groups and third-party identities in ingress and egress rules](/vpc-service-controls/docs/identity-groups-examples)"]]
