[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-18。"],[],[],null,["# VPC accessible services\n\nTo define the services that can be accessed from a network inside your\nservice perimeter, use the *VPC accessible services* feature. The VPC accessible\nservices feature limits the set of services that are accessible from network\nendpoints inside your service perimeter.\n\nThe VPC accessible services feature applies only to traffic from your VPC\nnetwork endpoints to Google APIs. Unlike service perimeters, the VPC accessible\nservices feature does not apply to the communication from one Google API to\nanother, or the networks of [tenancy units](https://cloud.google.com/service-infrastructure/docs/glossary#tenancy), which are used to implement\ncertain Google Cloud services.\n\nWhen configuring VPC accessible services for a perimeter, you can specify a\nlist of individual services, as well as include the `RESTRICTED-SERVICES`\nvalue, which automatically includes all of the services protected by the\nperimeter.\n\nTo ensure access to the expected services is fully limited, you must:\n\n- Configure the perimeter to protect the same set of services that you want to\n make accessible.\n\n- Configure VPCs in the perimeter to [use the restricted VIP](/vpc-service-controls/docs/set-up-private-connectivity).\n\n- Use layer 3 firewalls.\n\nExample: VPC network with Cloud Storage access only\n---------------------------------------------------\n\nAssume you have a service perimeter, `my-authorized-perimeter`, that includes\ntwo projects: `my-authorized-compute-project` and `my-authorized-gcs-project`.\nThe perimeter protects the Cloud Storage service.\n\n`my-authorized-gcs-project` uses a number of services, including\nCloud Storage, Bigtable, and others.\n`my-authorized-compute-project` hosts a VPC network.\n\nBecause the two projects share a perimeter, the VPC network in\n`my-authorized-compute-project` has access to the resources of services in\n`my-authorized-gcs-project`, regardless of whether the perimeter protects those\nservices. However, you want your VPC network to only have\naccess to Cloud Storage resources in `my-authorized-gcs-project`.\n\nYou are concerned that if the credentials for a VM in your VPC network are\nstolen, an adversary could leverage that VM to exfiltrate data from any\navailable service in `my-authorized-gcs-project`.\n\nYou have already configured your VPC network to use the restricted VIP, which\nlimits access from your VPC network only to APIs that are supported by\nVPC Service Controls. Unfortunately, that doesn't prevent your VPC network\nfrom accessing supported services, such as the Bigtable resources\nin `my-authorized-gcs-project`.\n\nTo limit the VPC network's access to only the storage service, you enable\nVPC accessible services and set `storage.googleapis.com` as an allowed service: \n\n gcloud access-context-manager perimeters update my-authorized-perimeter \\\n --enable-vpc-accessible-services \\\n --add-vpc-allowed-services=storage.googleapis.com\n\nSuccess! The VPC network in `my-authorized-compute-project` is now limited to\naccessing only resources for the Cloud Storage service. This\nrestriction also applies to any projects and VPC networks you later add to the\nperimeter.\n\nWhat's next?\n------------\n\n- [Use VPC accessible services.](/vpc-service-controls/docs/manage-service-perimeters#accessible-services)"]]
