一个服务边界中的项目不能间接访问其他边界中的项目。例如，假设我们有三个项目：A、B、C。每个项目都属于不同的服务边界。A 和 B 共用一个边界网桥。B 和 C 也共用一个网桥。虽然数据可以在 A 和 B 之间移动，也可以在 B 和 C 之间移动，但 A 和 C 之间不能传递数据，因为这两个项目未通过边界网桥直接连接。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-18。"],[],[],null,["# Sharing across perimeters with bridges\n\nThis page describes how perimeter bridges can be used to allow projects and\nservices in different service perimeters to communicate.\n\nBefore you begin\n----------------\n\n- Read [Overview of VPC Service Controls](/vpc-service-controls/docs/overview)\n- Read [Service Perimeter Configuration](/vpc-service-controls/docs/service-perimeters#stages)\n\nService perimeter bridges\n-------------------------\n\nWhile a project can be assigned to only one service perimeter, you\nmay want your project to be able to communicate with projects in another\nperimeter. You can enable communication to services and share data across\nservice perimeters by\n[creating a **perimeter bridge**](/vpc-service-controls/docs/create-perimeter-bridges).\n\nA perimeter bridge allows projects in different service perimeters to\ncommunicate. Perimeter bridges are bidirectional, allowing projects from each\nservice perimeter equal access within the scope of the bridge. However, the\naccess levels and service restrictions of the project are controlled solely by\nthe service perimeter that the project belongs to. A project can have multiple\nbridges connecting it to other projects.\n\nA project from one service perimeter cannot indirectly gain access to projects\nin other perimeters. For example, assume we have three projects: A, B,\nand C. Each project belongs to a different service perimeter. A and B\nshare a perimeter bridge. B and C also share a bridge.\nWhile data can move between A and B, as well as between B and C,\nnothing can pass between A and C because the two projects are not directly\nconnected by a perimeter bridge.\n\n### Considerations\n\nBefore you create a perimeter bridge, consider the following:\n\n- A project must belong to a service perimeter before it can be connected to\n another project using a perimeter bridge.\n\n- Perimeter bridges cannot include projects from different organizations.\n The projects connected by a perimeter bridge must belong to service\n perimeters that are in the same organization.\n\n- Perimeter bridges cannot include projects from different [scoped\n policies](/vpc-service-controls/docs/scoped-policies-overview). Instead, you can\n use [ingress or egress rules](/vpc-service-controls/docs/ingress-egress-rules)\n to allow communication between projects from different scoped policies.\n\n- After you create a perimeter bridge for a project, you cannot add the\n VPC networks from that project to a perimeter.\n\nExample of perimeter bridges\n----------------------------\n\nFor a broader example of how perimeter bridges work, consider the following\nsetup:\n\nThe goal is to allow copies between the Cloud Storage buckets in\nthe DMZ Perimeter and only the buckets in the Sink Project but not allow\nany VMs in the DMZ Perimeter access to data in Storage buckets in the\nPrivate Project.\n\nUsing the following command, a perimeter bridge (**Bridge**) is created,\nspecifying that project A and project B are to be connected by the\nperimeter bridge.\n**Note:** In the example command and the previous diagram, projects A and B are represented by their project numbers, 12345 and 67890, as the project numbers are required for the `resources` option. \n\n gcloud access-context-manager perimeters create Bridge \\\n --title=\"Perimeter Bridge\" --perimeter-type=bridge \\\n --resources=projects/12345,projects/67890\n\nThe perimeter bridge boundary is bidirectional. This means copies from\nDMZ Perimeter to Private Perimeter and from Private Perimeter to\nDMZ Perimeter are both allowed. To provide some directional control,\nit's best to combine perimeters with IAM permissions on the\nservice account or identity that is executing the copy operation."]]
