Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Halaman ini menjelaskan cara mengelola konfigurasi uji coba untuk
perimeter layanan Anda. Untuk informasi tentang cara mengelola perimeter layanan secara umum, lihat Mengelola perimeter layanan.
Dapatkan nama kebijakan Anda. Nama kebijakan diperlukan
untuk perintah yang menggunakan alat command line gcloud dan melakukan panggilan API. Jika menetapkan kebijakan akses default, Anda tidak perlu menentukan kebijakan untuk alat command line gcloud.
Menerapkan konfigurasi uji coba
Jika sudah puas dengan konfigurasi uji coba untuk perimeter layanan,
Anda dapat menerapkan konfigurasi tersebut. Saat diberlakukan, konfigurasi uji coba akan menggantikan konfigurasi yang saat ini diterapkan untuk perimeter, jika ada.
Jika versi perimeter yang diterapkan tidak ada, konfigurasi uji coba
akan digunakan sebagai konfigurasi awal yang diterapkan untuk perimeter.
Setelah Anda memperbarui perimeter layanan, mungkin perlu waktu hingga 30 menit agar
perubahan diterapkan dan berlaku. Selama waktu ini, perimeter mungkin memblokir
permintaan dengan pesan error berikut: Error 403: Request is prohibited by organization's policy.
Konsol
Di menu navigasi konsol Google Cloud , klik Security, lalu
klik VPC Service Controls.
Di halaman VPC Service Controls, klik Dry run mode.
Dalam daftar perimeter layanan, klik nama perimeter layanan
yang ingin Anda terapkan.
Di halaman Detail perimeter layanan, klik Terapkan konfigurasi.
Saat diminta untuk mengonfirmasi bahwa Anda ingin menimpa konfigurasi yang diterapkan
yang ada, klik Konfirmasi.
gcloud
Anda dapat menggunakan alat command line gcloud untuk menerapkan konfigurasi dry run untuk setiap perimeter, serta untuk semua perimeter secara bersamaan.
Menerapkan satu konfigurasi uji coba
Untuk menerapkan konfigurasi uji coba untuk perimeter tunggal, gunakan
perintah dry-run enforce:
PERIMETER_NAME adalah nama perimeter layanan yang detailnya ingin Anda dapatkan.
ETAG adalah string yang mewakili versi
target kebijakan akses organisasi Anda. Jika Anda tidak menyertakan
tag, operasi enforce-all akan menargetkan versi terbaru kebijakan akses
organisasi Anda.
Saat memperbarui konfigurasi uji coba, Anda dapat mengubah daftar layanan, project, dan layanan yang dapat diakses VPC, di antara fitur perimeter lainnya.
Setelah Anda memperbarui perimeter layanan, mungkin perlu waktu hingga 30 menit agar
perubahan diterapkan dan berlaku. Selama waktu ini, perimeter mungkin memblokir
permintaan dengan pesan error berikut: Error 403: Request is prohibited by organization's policy.
Konsol
Di menu navigasi konsol Google Cloud , klik Security, lalu
klik VPC Service Controls.
PERIMETER_NAME adalah nama perimeter layanan yang detailnya ingin Anda dapatkan.
RESOURCES adalah daftar yang dipisahkan koma dari satu atau beberapa nomor project atau nama jaringan VPC. Misalnya: projects/12345 atau
//compute.googleapis.com/projects/my-project/global/networks/vpc1.
Hanya project dan jaringan VPC yang diizinkan. Format project: projects/<project_number>.
Format VPC: //compute.googleapis.com/projects/<project-id>/global/networks/<network_name>.
POLICY_NAME adalah nama kebijakan akses organisasi Anda.
Nilai ini hanya diperlukan jika Anda belum menetapkan
kebijakan akses default.
Untuk memperbarui daftar layanan yang dibatasi, gunakan perintah dry-run update
dan tentukan layanan yang akan ditambahkan sebagai daftar yang dipisahkan koma:
PERIMETER_NAME adalah nama perimeter layanan yang detailnya ingin Anda dapatkan.
SERVICES adalah daftar yang dipisahkan koma dari satu atau beberapa layanan.
Misalnya: storage.googleapis.com atau
storage.googleapis.com,bigquery.googleapis.com.
POLICY_NAME adalah nama kebijakan akses organisasi Anda.
Nilai ini hanya diperlukan jika Anda belum menetapkan
kebijakan akses default.
Mengidentifikasi permintaan yang diblokir
Setelah membuat konfigurasi uji coba, Anda dapat meninjau log untuk mengidentifikasi tempat konfigurasi uji coba akan menolak akses ke layanan jika diterapkan.
Konsol
Di Google Cloud menu navigasi konsol, klik Logging, lalu
klik Logs Explorer.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-18 UTC."],[],[],null,["# Manage dry run configurations\n\nThis page describes how you can manage the dry run configuration for your\nservice perimeters. For information about managing service\nperimeters generally, see [Managing service perimeters](/vpc-service-controls/docs/manage-service-perimeters).\n\nBefore you begin\n----------------\n\n- Read [Overview of VPC Service Controls](/vpc-service-controls/docs/overview)\n\n- Read [Dry run mode](/vpc-service-controls/docs/dry-run-mode)\n\n- [Set your default access policy](/access-context-manager/docs/manage-access-policy#set-default) for using the `gcloud` command-line tool.\n\n *-or-*\n\n [Get the name of your policy.](/access-context-manager/docs/manage-access-policy#get_the_name_of_an_access_policy) The policy name is required\n for commands using the `gcloud` command-line tool and making API calls. If you set a default\n access policy, you do not need to specify the policy for the `gcloud` command-line tool.\n\nEnforcing a dry run configuration\n---------------------------------\n\nWhen you're satisfied with the dry run configuration for a service perimeter,\nyou can enforce that configuration. When a dry run configuration is enforced,\nit replaces the current enforced configuration for a perimeter, if one exists.\nIf an enforced version of the perimeter doesn't exist, the dry run configuration\nis used as the initial enforced configuration for the perimeter.\n| **Note:** You can only enforce a dry run configuration that has been modified. If the dry run configuration has not been changed, you cannot enforce it. In the Google Cloud console, if the dry run configuration has not been modified, the **Enforce** button will not be visible on the **VPC Service Perimeter Detail** page.\n\n\nAfter you update a service perimeter, it may take up to 30 minutes for the\nchanges to propagate and take effect. During this time, the perimeter might block\nrequests with the following error message: `Error 403: Request is prohibited by organization's policy.` \n\n### Console\n\n1. In the Google Cloud console navigation menu, click **Security** , and then\n click **VPC Service Controls**.\n\n [Go to the VPC Service Controls page](https://console.cloud.google.com/security/service-perimeter)\n2. On the **VPC Service Controls** page, click **Dry run mode**.\n\n3. In the list of service perimeters, click the name of the service\n perimeter that you want to enforce.\n\n4. On the **Service perimeter details** page, click **Enforce config**.\n\n5. When you are asked to confirm that you want to overwrite your existing\n enforced configuration, click **Confirm**.\n\n### gcloud\n\nYou can use the `gcloud` command-line tool to enforce the dry configuration for an individual\nperimeter, as well as for all of your perimeters simultaneously.\n\n**Enforce one dry run configuration**\n\nTo enforce the dry run configuration for a *single* perimeter, use the\n`dry-run enforce` command: \n\n gcloud access-context-manager perimeters dry-run enforce \u003cvar translate=\"no\"\u003ePERIMETER_NAME\u003c/var\u003e \\\n [--policy=\u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e]\n\nWhere:\n\n- \u003cvar translate=\"no\"\u003ePERIMETER_NAME\u003c/var\u003e is the name of the service perimeter that you\n want to obtain details about.\n\n- \u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e is the name of your organization's access policy.\n This value is required only if you haven't set a\n [default access policy](/access-context-manager/docs/manage-access-policy#set-default).\n\n**Enforce all dry run configurations**\n\nTo enforce the dry run configuration for *all* of your perimeters, use the\n`dry-run enforce-all` command: \n\n gcloud access-context-manager perimeters dry-run enforce-all \\\n [--etag=\u003cvar translate=\"no\"\u003eETAG\u003c/var\u003e]\n [--policy=\u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e]\n\nWhere:\n\n- \u003cvar translate=\"no\"\u003ePERIMETER_NAME\u003c/var\u003e is the name of the service perimeter that you\n want to obtain details about.\n\n- \u003cvar translate=\"no\"\u003eETAG\u003c/var\u003e is a string that represents the target\n version of your organization's access policy. If you do not include an\n etag, the `enforce-all` operation targets the latest version of the your\n organization's access policy.\n\n To obtain the latest etag of your access policy,\n [`list` your access policies](/access-context-manager/docs/manage-access-policy#get_the_name_of_an_access_policy).\n- \u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e is the name of your organization's access policy.\n This value is required only if you haven't set a\n [default access policy](/access-context-manager/docs/manage-access-policy#set-default).\n\n### API\n\nTo enforce the dry run configuration for *all* of\nyour perimeters, call [`accessPolicies.servicePerimeters.commit`](/access-context-manager/docs/reference/rest/v1/accessPolicies.servicePerimeters/commit).\n\nUpdating a dry run configuration\n--------------------------------\n\nWhen you update a dry run configuration, you can modify the list of services,\nprojects, and VPC accessible services, among other features of the perimeter.\n\n\nAfter you update a service perimeter, it may take up to 30 minutes for the\nchanges to propagate and take effect. During this time, the perimeter might block\nrequests with the following error message: `Error 403: Request is prohibited by organization's policy.` \n\n### Console\n\n1. In the Google Cloud console navigation menu, click **Security** , and then\n click **VPC Service Controls**.\n\n [Go to the VPC Service Controls page](https://console.cloud.google.com/security/service-perimeter)\n2. On the **VPC Service Controls** page, click **Dry run mode**.\n\n3. In the list of service perimeters, click the name of the service\n perimeter that you want to edit.\n\n4. On the **Service perimeter details** page, click **Edit**.\n\n5. On the **Edit service perimeter** page, make changes to the dry\n run configuration of the service perimeter.\n\n6. Click **Save**.\n\n### gcloud\n\nTo add new projects to a perimeter, use the `dry-run update` command and\nspecify the resources to add: \n\n gcloud access-context-manager perimeters dry-run update \u003cvar translate=\"no\"\u003ePERIMETER_NAME\u003c/var\u003e \\\n --add-resources=\u003cvar translate=\"no\"\u003eRESOURCES\u003c/var\u003e \\\n [--policy=\u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e]\n\nWhere:\n\n- \u003cvar translate=\"no\"\u003ePERIMETER_NAME\u003c/var\u003e is the name of the service perimeter that you\n want to obtain details about.\n\n- \u003cvar translate=\"no\"\u003eRESOURCES\u003c/var\u003e is a comma-separated list of one or more project\n numbers or VPC network names. For example: `projects/12345` or\n `//compute.googleapis.com/projects/my-project/global/networks/vpc1`.\n Only projects and VPC networks are allowed. Project format: `projects/\u003cproject_number\u003e`.\n VPC format: `//compute.googleapis.com/projects/\u003cproject-id\u003e/global/networks/\u003cnetwork_name\u003e`.\n\n- \u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e is the name of your organization's access policy.\n This value is required only if you haven't set a\n [default access policy](/access-context-manager/docs/manage-access-policy#set-default).\n\nTo update the list of restricted services, use the `dry-run update` command\nand specify the services to add as a comma-delimited list: \n\n gcloud access-context-manager perimeters dry-run update \u003cvar translate=\"no\"\u003ePERIMETER_ID\u003c/var\u003e \\\n --add-restricted-services=\u003cvar translate=\"no\"\u003eSERVICES\u003c/var\u003e \\\n [--policy=\u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e]\n\nWhere:\n\n- \u003cvar translate=\"no\"\u003ePERIMETER_NAME\u003c/var\u003e is the name of the service perimeter that you\n want to obtain details about.\n\n- \u003cvar translate=\"no\"\u003eSERVICES\u003c/var\u003e is a comma-delimited list of one or more services.\n For example: `storage.googleapis.com` or\n `storage.googleapis.com,bigquery.googleapis.com`.\n\n- \u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e is the name of your organization's access policy.\n This value is required only if you haven't set a\n [default access policy](/access-context-manager/docs/manage-access-policy#set-default).\n\nIdentifying blocked requests\n----------------------------\n\nAfter you have created a dry run configuration, you can review logs to identify where the dry run configuration would deny access to services if enforced. \n\n### Console\n\n1. In the Google Cloud console navigation menu, click **Logging** , and then\n click **Logs Explorer**.\n\n [Go to Logs Explorer](https://console.cloud.google.com/logs/query)\n2. In the **Query** field, input a query filter like the following filter,\n and then click **Run query**.\n\n log_id(\"cloudaudit.googleapis.com/policy\") AND severity=\"error\" AND protoPayload.metadata.dryRun=\"true\"\n\n3. View the logs under **Query results**.\n\n### gcloud\n\nTo view logs using gcloud CLI, run a command like the following: \n\n gcloud logging read 'log_id(\"cloudaudit.googleapis.com/policy\") AND severity=\"error\" AND protoPayload.metadata.dryRun=\"true\"'"]]
