[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-18。"],[],[],null,["# Service perimeter details and configuration\n\nThis page [describes service perimeters](#about-perimeters) and includes the\nhigh-level steps for [configuring perimeters](#stages).\n\nAbout service perimeters\n------------------------\n\nThis section provides details about the way service perimeters function, and\nthe differences between enforced and dry run perimeters.\n\nTo protect Google Cloud services in your projects and mitigate the risk of data\nexfiltration, you can specify service perimeters at the project or VPC network\nlevel. For more information about the benefits of service perimeters, see\n[Overview of VPC Service Controls](/vpc-service-controls/docs/overview).\n\nAlso, the services that are accessible *inside* a perimeter, such as\nfrom VMs in a VPC network that is hosted inside a perimeter, can be restricted\nusing the [VPC accessible services](/vpc-service-controls/docs/vpc-accessible-services) feature.\n\nYou can configure Service Controls perimeters in enforced or\ndry run mode. The same configuration steps apply to both enforced and dry\nrun perimeters. The difference is that dry run perimeters log violations as\nthough the perimeters are enforced but don't prevent access to restricted\nservices.\n\n### Enforced mode\n\nEnforced mode is the default mode for service perimeters. When a service\nperimeter is enforced, requests that violate the perimeter policy, such as\nrequests to restricted services from outside a perimeter, are denied.\n\nA perimeter in enforced mode protects Google Cloud resources by enforcing\nthe perimeter boundary for the services restricted in the perimeter configuration.\nAPI requests to restricted services do not cross the perimeter boundary unless\nthe conditions of the necessary [ingress and egress rules](/vpc-service-controls/docs/ingress-egress-rules)\nof the perimeter are satisfied. An enforced perimeter protects against data\nexfiltration risks, such as stolen credentials, misconfigured permissions, or\nmalicious insiders that have access to the projects.\n\n### Dry run mode\n\nIn dry run mode, requests that violate the perimeter policy are not denied but\nonly logged. *Dry run service perimeters* are used to test perimeter\nconfiguration and to monitor usage of services without preventing access to\nresources. The following are some of the common use cases:\n\n- Determining the impact when you change existing service perimeters.\n\n- Previewing the impact when you add new service perimeters.\n\n- Monitoring requests to restricted services that originate from outside a\n service perimeter. For example, to identify from where requests to a given\n service are coming from or to identify unexpected service usage in your\n organization.\n\n- Creating a perimeter architecture in your development environment that is\n analogous to your production environment. You can identify and mitigate any\n issues caused by your service perimeters before submitting changes to your\n production environment.\n\nFor more information, see [Dry run mode](/vpc-service-controls/docs/dry-run-mode).\n\nService perimeter configuration stages\n--------------------------------------\n\nTo configure VPC Service Controls, you can use the Google Cloud console,\n[the `gcloud` command-line tool](/sdk/gcloud/reference/access-context-manager), and the [Access Context Manager APIs](/access-context-manager/docs/apis).\n\nYou can configure VPC Service Controls as described in the following high-level steps:\n\n1. Create an access policy.\n\n2. Secure Google-managed resources with service perimeters.\n\n3. Set up VPC accessible services to add additional restrictions to how\n services can be used inside your perimeters (optional).\n\n4. Set up private connectivity from a VPC network (optional).\n\n5. Allow context-aware access from outside a service perimeter using ingress\n rules (optional).\n\n6. Configure secure data exchange using ingress and egress rules (optional).\n\n### Create an access policy\n\nAn access policy collects the service perimeters and access levels you create\nfor your organization. An organization can have one access policy for the entire\norganization and multiple scoped access policies for the folders and projects.\n\nYou can use the Google Cloud console, [the `gcloud` command-line tool](/sdk/gcloud/reference/access-context-manager), or the [Access Context Manager APIs](/access-context-manager/docs/apis) to [create an access policy](/access-context-manager/docs/create-access-policy).\n\nTo learn more about Access Context Manager and access policies, read the\n[overview of Access Context Manager](/access-context-manager/docs/overview).\n\n### Secure Google-managed resources with service perimeters\n\nService perimeters are used to protect services used by projects in your\norganization. After identifying the projects and services you want to protect,\n[create one or more service perimeters](/vpc-service-controls/docs/create-service-perimeters).\n| **Note:** If you're using [Shared VPC](/vpc/docs/shared-vpc), you must [include the host\n| project](/vpc-service-controls/docs/troubleshooting#shared_vpc) in a service perimeter along with any projects that belong to the Shared VPC.\n\nTo learn more about how service perimeters work and what services\nVPC Service Controls can be used to secure, read the\n[Overview of VPC Service Controls](/vpc-service-controls/docs/overview).\n\nSome services have limitations with how they can be used with\n[VPC Service Controls](/vpc-service-controls/docs/supported-products#service-limitations). If you encounter\nissues with your projects after setting up your service perimeters, read\n[Troubleshooting](/vpc-service-controls/docs/troubleshooting).\n\n### Set up VPC accessible services\n\nWhen you enable VPC accessible services for a perimeter, access from network\nendpoints inside your perimeter is limited to a set of services that you\nspecify.\n\nTo learn more about how to limit access inside your perimeter to only a specific\nset of services, read about [VPC accessible services](/vpc-service-controls/docs/vpc-accessible-services).\n\n### Set up private connectivity from a VPC network\n\nTo provide additional security for VPC networks and on-premises hosts that are\nprotected by a service perimeter, we recommend using Private Google Access.\nFor more information, see [private connectivity from on-premises networks](/vpc-service-controls/docs/private-connectivity).\n\nTo learn about configuring private connectivity, read\n[Setting up private connectivity to Google APIs and services](/vpc-service-controls/docs/set-up-private-connectivity).\n\nRestricting access to Google Cloud resources to only private access from\nVPC networks means that access using interfaces such as the Google Cloud console\nand the Cloud Monitoring console are denied. You can continue to use\nthe `gcloud` command-line tool or API clients from VPC networks that share a service perimeter\nor perimeter bridge with the restricted resources.\n\n### Allow context-aware access from outside a service perimeter using ingress rules\n\nYou can allow context-aware access to resources restricted by a perimeter based\non client attributes. You can specify client attributes, such as identity type\n(service account or user), identity, device data, and network origin (IP address or VPC network).\n\nFor example, you can set up ingress rules to allow internet access to resources\nwithin a perimeter based on the range of IPv4 and IPv6 addresses. For more\ninformation about using ingress rules to set up context-aware access, see\n[Context-aware access](/vpc-service-controls/docs/context-aware-access).\n\n### Configure secure data exchange using ingress and egress rules\n\nYou can include your project only in one service perimeter. If you want to allow\ncommunication across the perimeter boundary, set up ingress and egress rules.\nFor example, you can specify ingress and egress rules to let projects from\nmultiple perimeters to share logs in a separate perimeter. To learn more about\nsecure data exchange use cases, read [secure data exchange](/vpc-service-controls/docs/secure-data-exchange).\n\n*[VPC]: Virtual Private Cloud"]]
