[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-19。"],[],[],null,["# Manage security for Private Service Connect producers\n=====================================================\n\nThis page describes how service producers can implement security for producer\norganizations and projects that use Private Service Connect.\n\n*Consumer accept lists* let service owners specify networks or\nprojects that can connect to individual [service attachments](/vpc/docs/about-vpc-hosted-services#service-attachments). *Organization policies* also\ncontrol access to service attachments, but they let network\nadministrators broadly control access to all service attachments in an\norganization.\n\nConsumer accept lists and organization policies are complementary and\ncan be used together. In this case, a Private Service Connect\nconnection is only created if it is authorized by both of these security\nmechanisms.\n\nRoles\n-----\n\n\nTo get the permissions that\nyou need to manage organization policies,\n\nask your administrator to grant you the\n\n\n[Organization policy administrator](/iam/docs/roles-permissions/orgpolicy#orgpolicy.policyAdmin) (`roles/orgpolicy.policyAdmin`)\nIAM role on the organization.\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nYou might also be able to get\nthe required permissions through [custom\nroles](/iam/docs/creating-custom-roles) or other [predefined\nroles](/iam/docs/roles-overview#predefined).\n\nProducer organization policies\n------------------------------\n\nYou can use [organization policies](/resource-manager/docs/organization-policy/overview#organization_policy) with the\n`compute.restrictPrivateServiceConnectConsumer`\n[list constraint](/resource-manager/docs/organization-policy/using-constraints#list-constraint) to control which endpoints and backends can\nconnect to Private Service Connect service attachments. If an endpoint\nor backend is rejected by a producer organization policy, the creation of\nthe resource succeeds, but the connection enters the rejected state.\n\nFor more information, see [Producer-side organization policies](/vpc/docs/private-service-connect-security#producer-side-org-policies).\n\n### Reject connections from unauthorized endpoints and backends\n\n**Resources**: endpoints and backends \n\n### gcloud\n\n1. Create a temporary file called `/tmp/policy.yaml` to store the new\n policy. Add the following content to the file:\n\n name: organizations/\u003cvar translate=\"no\"\u003ePRODUCER_ORG\u003c/var\u003e/policies/compute.restrictPrivateServiceConnectConsumer\n spec:\n rules:\n - values:\n allowedValues:\n - under:organizations/\u003cvar translate=\"no\"\u003eCONSUMER_ORG_NUMBER\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003ePRODUCER_ORG\u003c/var\u003e: the [organization ID](/resource-manager/docs/creating-managing-organization#retrieving_your_organization_id) of the producer organization that you want to control consumer Private Service Connect access to.\n - \u003cvar translate=\"no\"\u003eCONSUMER_ORG_NUMBER\u003c/var\u003e: the numeric resource ID of the consumer organization that you want to let connect to service attachments in the producer organization.\n\n To specify additional organizations that can connect to service\n attachments in your project, include additional entries in the\n `allowedValues` section.\n\n In addition to organizations, you can specify authorized folders and\n projects in the following form:\n - `under:folders/`\u003cvar translate=\"no\"\u003eFOLDER_ID\u003c/var\u003e\n\n The \u003cvar translate=\"no\"\u003eFOLDER_ID\u003c/var\u003e must be the numeric ID.\n - `under:projects/`\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e\n\n The \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e must be the string ID.\n\n For example, the following file shows an organization policy configuration\n that rejects connections from endpoints or backends to service\n attachments in `Producer-org-1` unless they are associated with an\n allowed value or a descendant of an allowed value. The allowed values\n are the organization `Consumer-org-1`, the project `Consumer-project-1`,\n and the folder `Consumer-folder-1`. \n\n name: organizations/Producer-org-1/policies/compute.restrictPrivateServiceConnectConsumer\n spec:\n rules:\n - values:\n allowedValues:\n - under:organizations/Consumer-org-1\n - under:projects/Consumer-project-1\n - under:folders/Consumer-folder-1\n\n2. Apply the policy.\n\n ```\n gcloud org-policies set-policy /tmp/policy.yaml\n ```\n3. View the policy that is in effect.\n\n ```\n gcloud org-policies describe compute.restrictPrivateServiceConnectConsumer \\\n --effective \\\n --organization=PRODUCER_ORG\n ```\n\nConsumer accept and reject lists\n--------------------------------\n\n**Resources**: endpoints and backends\n\nConsumer accept and reject lists are associated with service attachments. These\nlists let you explicitly accept or deny connections from consumer projects or\nnetworks.\n\nFor more information, see [Consumer accept and reject lists](/vpc/docs/private-service-connect-security#consumer-lists).\n\nInteraction between accept lists and organization policies\n----------------------------------------------------------\n\n\nBoth consumer accept lists and organization policies control whether a connection can\nbe established between two Private Service Connect resources. Connections are blocked\nif either an accept list or an organization policy denies the connection.\n\nFor example, a policy with the `restrictPrivateServiceConnectConsumer` constraint can\nbe configured to block connections from outside of the producer's organization. Even if a\nservice attachment is configured to automatically accept all connections, the organization\npolicy still blocks connections from outside of the producer's organization. We recommend\nusing both accept lists and organization policies together to help provide layered\nsecurity.\n\n\u003cbr /\u003e\n\nConfigure accept and reject lists\n---------------------------------\n\nFor information about how to create a new service attachment that has consumer\naccept or reject lists, see\n[Publish a service with explicit project approval](/vpc/docs/configure-private-service-connect-producer#publish-service-explicit).\n\nFor information about how to update consumer accept or reject lists, see\n[Manage requests for access to a published service](/vpc/docs/manage-private-service-connect-services#access)."]]
