출시 노트

VPC Service Controls feature: Support for using identity groups in the ingress and egress rules to allow access to resources protected by a service perimeter is generally available.

For more information, see Configure identity groups and third-party identities in ingress and egress rules.

VPC Service Controls feature: VPC Service Controls extends support for etags in the service perimeter resources. For example, you can use the --etag flag with the gcloud CLI commands such as gcloud access-context-manager perimeters update and gcloud access-context-manager perimeters describe. This feature is generally available.

VPC Service Controls feature (Status: Preview): VPC Service Controls adds support for using groups of third-party identities in ingress and egress rules to allow access to resources protected by service perimeters. This feature is available in Preview.

For more information, see Configure identity groups and third-party identities in ingress and egress rules.

General availability support for the following integration:

• Vertex AI in Firebase

Preview stage support for the following integration:

• Audit Manager

Preview stage support for the following integration:

• Privileged Access Manager

Preview stage support for the following integration:

• Contact Center AI Platform

VPC Service Controls feature: VPC Service Controls supports using identity groups and third-party identities (only single identities) in ingress and egress rules to allow access to resources protected by service perimeters. This feature is available in Preview.

For more information, see Configure identity groups and third-party identities in ingress and egress rules. You can also learn an example of using identity groups and third-party identities in ingress and egress rules.

Preview stage support for the following integration:

• Commerce Org Governance API

VPC Service Controls feature: Support to programmatically retrieve the list of services that are supported by VPC Service Controls is generally available. Using this feature, you also can retrieve the list of methods and permissions supported by VPC Service Controls for a service.

• The following changes are made in the output of the gcloud access-context-manager supported-services list command:
  • The field name SUPPORT_STAGE is changed into SERVICE_SUPPORT_STAGE.
  • The status BETA is changed into PREVIEW in the SERVICE_SUPPORT_STAGE field.
  • A new status DEPRECATED is added in the SERVICE_SUPPORT_STAGE field.
• The field name supportStage is changed into serviceSupportStage in the output of the gcloud access-context-manager supported-services describe command.

VPC Service Controls feature: Support for using an internal IP address to allow access to protected resources is generally available.

For more information, see Allow access to protected resources from an internal IP address. Make sure that you read the updated Limitations section before using this feature.

Preview stage support for the following integration:

• Kubernetes Metadata API

For more information, see Anthos On-Prem API, Google Kubernetes Engine, and GKE Multi-Cloud.

Preview stage support for the following integration:

• Workload Manager

General availability support for the following integration:

• Backup and DR Service

General availability support for the following integration:

• Cloud Quotas

General availability support for the following integration:

• Migration Center

Preview stage support for the following integration:

• Sovereign Controls by Partners

Preview stage support for the following integration:

• Cloud Code

Preview stage support for the following integration:

• API keys

General availability support for the following integration:

• Storage Insights

General availability support for the following integration:

• Colab Enterprise

Preview stage support for the following integration:

• Earth Engine

General availability support for the following integration:

• Dataform

Preview stage support for the following integration:

• Personalized Service Health

The ability to programmatically retrieve the list of services that are supported by VPC Service Controls is available in Preview. Using this feature, you can also retrieve the list of methods and permissions supported by VPC Service Controls for a service.

The ability to allow access to protected resources from an internal IP address is available in Preview.

General availability support for the following integration:

• Confidential Space

General availability support for the following integration:

• Duet AI in Google Cloud

General availability support for the following integration:

• Batch

The ability to add individual VPC networks to a perimeter is generally available (GA).

Previously, all VPC networks in a host project were added to a perimeter. You can now do the following:

• Add individual VPC networks as members of a perimeter.
• Create an ingress rule to authorize individual VPC networks to access a perimeter.

Preview stage support for the following integration:

• Policy Simulator

Support for Cloud Tasks is now at General Availability. To learn more, see the Cloud Tasks documentation on setting up a service perimeter using VPC Service Controls.

Preview stage support for the following integration:

• Policy Troubleshooter

Preview stage support for the following integration:

• Video Stitcher API

Preview stage support for the following integrations:

• Batch

Beta stage support for the following integration:

• Config Controller

Beta stage support for the following integration:

• BigQuery Data Policy API

General availability for the following integration:

• Organization Policy Service

General availability for the following integration:

• Analytics Hub

Beta stage support for the following integration:

• Service Account Credentials API

Beta stage support for the following integration:

• Integration Platform

General availability for the following integration:

• BigQuery Reservation API

Support to add individual VPC networks to a perimeter is now available in Preview.

Previously, the entire VPC host project was added to a perimeter. VPC Service Controls now supports the following enhancements (Preview release):

• You can now add individual VPC networks as members of a perimeter.
• You can create an ingress rule to authorize individual VPC networks to access a perimeter.

Beta stage support for the following integration:

• AlloyDB

General availability for the following integration:

• Migrate for Compute Engine

General availability for the following integrations:

• Firestore
• Firestore in Datastore mode

General availability for the following integration:

• Cloud Domains

General availability for the following integration:

• Google Cloud Deploy

General availability for the following integration:

• Database Migration Service

General availability of scoped policies for VPC Service Controls.

To delegate administration of VPC Service Controls perimeters and access levels to folder-level and project-level administrators, you can use scoped policies. You can create access policies that are scoped to specific folders or projects.

General availability for the following integration:

• Transcoder API

General availability for the following integrations:

• Cloud Profiler
• Cloud Monitoring

Beta stage support for the following integration:

• Migrate for Compute Engine

General availability for the following integrations:

• Cloud TPU

Preview support for the following integration:

• Cloud Debugger

Beta stage support for the following integration:

• Cloud Monitoring

Preview support for the following integration:

• Image streaming for container images stored in Artifact Registry.

Preview stage support for the following integrations:

• Firestore
• Datastore

General availability for the following integration: * Connect Gateway

Fleet-related APIs (GKE Hub, GKE Connect, Connect Gateway) are now grouped together.

General availability for the following integration:

• Contact Center AI Insights

General availability for the following integration:

• reCAPTCHA Enterprise

General availability for the following integration:

• Security Token Service

General availability for the following integration:

• Cloud DNS

General availability for the following integration:

• Filestore

Support for Cloud Run is now at General Availability (GA).

General availability for the following integration:

• Certificate Authority Service

General availability for the following integration:

• Traffic Director

This note is incorrect; see entry for July 5, 2021

General availability for the following integration:

• Identity-Aware Proxy for TCP forwarding

Integration with Document AI VPC Service Controls is now generally available.

General availability for the following integration:

• Retail API

General availability for the following integration:

• Memorystore for Memcached

General Availability release of Ingress and egress rules for VPC Service Controls.

General availability for the following integration:

• VM Manager

Preview support for the following integration:

• Cloud Life Sciences

General availability for the following integration:

• OS Login

Beta stage support for the following integration:

• Transcoder API

Preview for the following integration:

• Memorystore for Memcached

Preview release of Ingress and egress rules for VPC Service Controls.

Preview for the following integration:

• AI Platform (Unified)

General availability for the following integration:

• AI Platform Prediction

Preview support for the following integration:

• Connectivity Tests

General availability for the following integration:

• Compute Engine

Preview support for the following integration:

• Dataproc Metastore

Preview support for the following integration:

• Identity-Aware Proxy for TCP forwarding

General availability support for the following integration:

• Artifact Registry

Preview support for the following integration:

• Transfer Appliance

Beta stage support for the following integration:

• VM Manager

Beta stage support for the following integration:

• OS Login

Beta stage support for the following integration:

• Speech-to-Text

General availability for the following integration:

• Memorystore for Redis

General availability for the following integration:

• AI Platform Training

Beta stage support for the following integration:

• AI Platform Prediction

General availability of dry run mode for service perimeters.

This release introduces dry run configurations for your service perimeters, allowing you to test changes to perimeters before enforcing the changes. For more information, read about dry run mode.

Beta release of the VPC Service Controls Troubleshooter.

The VPC Service Controls Troubleshooter allows you to use the unique identifiers generated by VPC Service Controls errors to understand and resolve common denials to services in your perimeters.

During the beta period, the following error types are supported:

• NO_MATCHING_ACCESS_LEVEL
• NETWORK_NOT_IN_SAME_SERVICE_PERIMETER
• RESOURCES_NOT_IN_SAME_SERVICE_PERIMETER

For more information, read about the VPC Service Controls Troubleshooter.

Beta stage support for the following integrations:

• Cloud Composer
• Cloud Healthcare API

General availability for bulk changes to service perimeters.

Using Access Context Manager's Bulk API, you can replace all of your organization's service perimeters in one operation. For more information, see Making bulk changes to service perimeters.

The VPC accessible services feature is now generally available. Use VPC accessible services to limit the access of network endpoints and VMs in a perimeter to only services protected by that perimeter.

For more information about the feature, see VPC accessible services.

Beta stage support for the following integration:

• Service Directory

Beta stage support for the following integration:

• Memorystore for Redis

The beta version of the VPC accessible services feature is now available.

The VPC accessible services feature introduces the ability to limit the access of network endpoints inside your service perimeter to an explicit set of services.

To learn how to configure VPC accessible services for your perimeter, read about limiting access to services inside a perimeter.

The beta version of dry run mode for service perimeters is now available.

This release introduces a new method of configuring service perimeters: dry run mode. For more information, read about dry run mode.

Beta support for bulk changes to service perimeters.

Using the beta release of Access Context Manager's Bulk API, you can perform operations such as replacing all of your organization's service perimeters. For more information, see Making bulk changes to service perimeters.

Beta stage support for the following integrations:

• Container Analysis

Beta stage support for the following integrations:

• AutoML Natural Language
• AutoML Tables
• AutoML Translation
• AutoML Video Intelligence
• AutoML Vision
• Artifact Registry

General availability for the following integration:

• Cloud Functions

Beta stage support for:

• Managed Service for Microsoft Active Directory

Beta stage support for the following integrations:

• Cloud Translation

Beta stage support for the following integrations:

• Cloud Functions
• Cloud Data Fusion

Beta stage support for the following integration:

• AI Platform Training

Beta stage support for the following integrations:

• Cloud Asset Inventory

General availability support for:

• Cloud SQL

Beta stage support for the following integrations:

• Trace API

Beta stage support for the following integrations:

• Profiler API

Unique identifier for VPC Service Controls access errors.

When a request for resources in a perimeter is denied (a 403 error), a unique identifier is generated that you can use to identify the corresponding log entry using Stackdriver Logging.

For more information, see:

• Unique Identifier helps troubleshooting VPC Service Controls perimeter
• VPC Service Controls troubleshooting documentation

Beta stage support for the following integrations:

• Natural Language API

General availability for the following integrations:

• Cloud Dataflow

General availability for the following integrations:

• Cloud Key Management Service
• Cloud Spanner
• Container Registry
• Google Kubernetes Engine

Beta stage support for the following:

• Cloud Dataflow

Beta stage support for the following:

• Cloud Key Management Service
• Cloud Spanner

General availability of VPC Service Controls.

Alpha stage support for the Google Kubernetes Engine API.

Beta stage support for Google Kubernetes Engine private clusters.

As of this release, GKE private clusters can be protected by VPC Service Controls service perimeters.

For more information, refer to the VPC Service Controls page and the documentation.

Public beta release of VPC Service Controls.

As of this release, VPC Service Controls supports the following services:

• Cloud Bigtable
• Cloud Storage
• BigQuery
• Cloud Pub/Sub
• Cloud Dataproc
• Stackdriver Logging

VPC Service Controls also has Alpha stage support for the following services:

• Container Registry
• Cloud Key Management Service
• Cloud Spanner