Set up a service perimeter by using VPC Service Controls

Set up a VPC Service Controls perimeter

In the following sections, you specify the perimeter details, add projects and services to protect, and create the perimeter.

Add the VPC Service Controls perimeter details

1. In the Google Cloud console, go to the VPC Service Controls page.

   Go to VPC Service Controls

2. To create a new perimeter by using the default access policy, select your organization from the project selector menu.

   

   If your organization doesn't have an access policy, follow these steps:

   1. On the VPC Service Controls page, click Manage policies.

   2. On the Manage VPC Service Controls page, click Create.

   3. On the Create access policy page, in the Access policy title field, enter access_policy_1.

   4. Click Create access policy.

3. On the VPC Service Controls page, click New perimeter.

4. On the Create a service perimeter page, in the Title field, enter perimeter_storage_services.

5. For Perimeter type and Enforcement mode, retain the default selections.

6. Click Continue.

Add projects to the perimeter

1. To add projects to the perimeter, click Add projects.

2. In the Add Projects pane, select the projects that you want to add to the perimeter and then click Add selected projects.

   

3. Click Continue.

Secure the BigQuery and Cloud Storage services within the perimeter

1. In the Restricted services pane, click Add services.

2. In the Add services pane, select the checkboxes for the BigQuery and Cloud Storage APIs.

   To locate the services, you can use the filter query.

   

3. Click Add selected services.

4. Click Create.

You just created a perimeter! You can see your perimeter listed on the VPC Service Controls page. The perimeter might take up to 30 minutes to propagate and take effect. When the changes have propagated, access to the BigQuery and Cloud Storage services is limited to the projects you added to the perimeter.

Additionally, the Google Cloud console interface for the BigQuery and Cloud Storage services that you protected with the perimeter might become partially or fully inaccessible.