VPC Service Controls in GCP - Commands & Configuration

Introduction

VPC Service Controls help protect your Google Cloud services by creating a secure boundary around them. This stops data from being accessed or moved outside your trusted network, reducing the risk of data leaks.

When you want to keep sensitive data inside your company network and prevent it from being accessed from outside.

When you use Google Cloud services like Cloud Storage or BigQuery and want to add extra protection around them.

When you need to control which projects or users can access your cloud services based on network boundaries.

When you want to reduce the risk of data theft or accidental exposure from misconfigured permissions.

When you want to enforce security policies that limit data movement between different environments.

Config File - access_policy.yaml

access_policy.yaml

accessPolicies:
- name: accessPolicies/123456789
  title: example-access-policy
  scopes:
  - organizations/123456789
  servicePerimeters:
  - name: accessPolicies/123456789/servicePerimeters/example-perimeter
    title: example-perimeter
    perimeterType: PERIMETER_TYPE_REGULAR
    status:
      resources:
      - projects/123456789012
      restrictedServices:
      - storage.googleapis.com
      - bigquery.googleapis.com
      accessLevels:
      - accessPolicies/123456789/accessLevels/example-level
accessLevels:
- name: accessPolicies/123456789/accessLevels/example-level
  title: example-level
  basic:
    conditions:
    - ipSubnetworks:
      - 192.168.1.0/24
      - 10.0.0.0/16
      members:
      - user:[e-mail]

This YAML file defines an access policy for VPC Service Controls.

• accessPolicies: The main container for your security boundaries.
• servicePerimeters: Defines the secure boundary around specific projects and services.
• restrictedServices: Lists Google Cloud services protected by the perimeter.
• accessLevels: Specifies who and from where can access the services inside the perimeter.

Commands

List all access policies in your organization to find the policy ID needed for creating service perimeters.

Terminal

gcloud access-context-manager policies list

Expected Output

NAME            TITLE

123456789       example-access-policy

Create a service perimeter named 'example-perimeter' around the specified project and restrict access to Cloud Storage and BigQuery services.

Terminal

gcloud access-context-manager perimeters create example-perimeter --policy=123456789 --title="example-perimeter" --resources=projects/123456789012 --restricted-services=storage.googleapis.com,bigquery.googleapis.com --perimeter-type=regular

Expected Output

create: Operation completed successfully.

→

--policy - Specifies the access policy ID to use.

→

--resources - Defines which projects are inside the perimeter.

→

--restricted-services - Lists the Google Cloud services protected by the perimeter.

Check the details of the created service perimeter to verify its configuration.

Terminal

gcloud access-context-manager perimeters describe example-perimeter --policy=123456789

Expected Output

name: accessPolicies/123456789/servicePerimeters/example-perimeter

title: example-perimeter

perimeterType: PERIMETER_TYPE_REGULAR

status:

  resources:

  - projects/123456789012

  restrictedServices:

  - storage.googleapis.com

  - bigquery.googleapis.com

→

--policy - Specifies the access policy ID to query.

Create an access level that allows only user [e-mail] from specific IP ranges to access resources inside the perimeter.

Terminal

gcloud access-context-manager access-levels create example-level --policy=123456789 --title="example-level" --basic-ip-subnetworks=192.168.1.0/24,10.0.0.0/16 --basic-members=user:[e-mail]

Expected Output

create: Operation completed successfully.

→

--basic-ip-subnetworks - Defines allowed IP address ranges.

→

--basic-members - Specifies allowed user identities.

Key Concept

If you remember nothing else from this pattern, remember: VPC Service Controls create a secure boundary around your cloud services to keep data safe inside trusted networks.

Common Mistakes

Not specifying the correct project IDs inside the service perimeter.

The perimeter won't protect the intended resources if projects are missing or incorrect.

Always double-check project IDs and include all relevant projects in the perimeter configuration.

Forgetting to create or attach access levels to control who can access the perimeter.

Without access levels, the perimeter might block all access or allow unintended users.

Define access levels with specific users and IP ranges, then attach them to the perimeter.

Trying to protect unsupported services or misnaming service names in restrictedServices.

The perimeter won't apply restrictions to services not listed or incorrectly named.

Use exact service names from Google Cloud documentation when listing restricted services.

Summary

Use 'gcloud access-context-manager policies list' to find your access policy ID.

Create a service perimeter with 'gcloud access-context-manager perimeters create' to protect projects and services.

Verify perimeter details with 'gcloud access-context-manager perimeters describe'.

Create access levels to specify who and from where can access the perimeter.

Practice

1. What is the main purpose of VPC Service Controls in Google Cloud?

easy

A. To manage user identities and access permissions

B. To create a secure boundary around cloud services to protect data

C. To automatically back up data to multiple regions

D. To increase the speed of network traffic between services

Solution

1. Step 1: Understand the role of VPC Service Controls

   VPC Service Controls create a security perimeter around Google Cloud services to protect sensitive data from unauthorized access.

2. Step 2: Compare with other options

   Options A, B, and C describe different Google Cloud features unrelated to VPC Service Controls.

3. Final Answer:

   To create a secure boundary around cloud services to protect data -> Option B

4. Quick Check:

   VPC Service Controls = Secure boundary [OK]

Hint: VPC Service Controls protect data by creating security boundaries [OK]

Common Mistakes:

• Confusing VPC Service Controls with identity management
• Thinking it speeds up network traffic
• Assuming it handles backups automatically

2. Which of the following is the correct way to define a VPC Service Controls perimeter in a YAML configuration?

easy

A. perimeterType: 'NETWORK_PERIMETER'
resources:
- projects/project-123
restrictedServices:
- storage.googleapis.com
enforce: true

B. perimeterType: 'SERVICE_PERIMETER'
resources:
- projects/project-123
restrictedServices:
- storage.googleapis.com
allowAll: true

C. perimeterType: 'SERVICE_PERIMETER'
resources:
- projects/project-123
restrictedServices:
- compute.googleapis.com
enforce: false

D. perimeterType: 'SERVICE_PERIMETER'
resources:
- projects/project-123
restrictedServices:
- storage.googleapis.com
enforce: true

Solution

1. Step 1: Identify correct perimeter type and enforcement

   VPC Service Controls use 'SERVICE_PERIMETER' as perimeterType and enforce true to activate restrictions.

2. Step 2: Check restricted services and resource format

   Restricted services should list Google Cloud APIs like storage.googleapis.com, and resources should be project IDs.

3. Final Answer:

   perimeterType: 'SERVICE_PERIMETER' with enforce: true and correct resources -> Option D

4. Quick Check:

   Correct perimeterType and enforce true = perimeterType: 'SERVICE_PERIMETER' resources: - projects/project-123 restrictedServices: - storage.googleapis.com enforce: true [OK]

Hint: SERVICE_PERIMETER with enforce: true is required for VPC SC [OK]

Common Mistakes:

• Using NETWORK_PERIMETER instead of SERVICE_PERIMETER
• Setting enforce to false disables the perimeter
• Using allowAll instead of enforce

3. Given this VPC Service Controls perimeter configuration:

perimeterType: 'SERVICE_PERIMETER'
resources:
  - projects/project-abc
restrictedServices:
  - storage.googleapis.com
  - bigquery.googleapis.com
enforce: true

What happens if a VM in project-abc tries to access compute.googleapis.com?

medium

A. Access is allowed only if the VM has special IAM roles

B. Access is denied because all services are blocked inside the perimeter

C. Access is allowed because compute.googleapis.com is not restricted

D. Access is denied because compute.googleapis.com is implicitly restricted

Solution

1. Step 1: Understand restricted services in the perimeter

   The perimeter restricts only storage.googleapis.com and bigquery.googleapis.com.

2. Step 2: Check access to compute.googleapis.com

   Since compute.googleapis.com is not listed, access is allowed by default.

3. Final Answer:

   Access is allowed because compute.googleapis.com is not restricted -> Option C

4. Quick Check:

   Only listed services are restricted = Access is allowed because compute.googleapis.com is not restricted [OK]

Hint: Only services listed in restrictedServices are blocked [OK]

Common Mistakes:

• Assuming all services are blocked inside perimeter
• Thinking IAM roles override perimeter restrictions
• Believing unlisted services are implicitly blocked

4. You configured a VPC Service Controls perimeter but users report they cannot access Cloud Storage from inside the perimeter. Which of the following is the most likely cause?

medium

A. The perimeter's restrictedServices includes storage.googleapis.com and enforce is set to true

B. The perimeter is missing storage.googleapis.com in restrictedServices

C. The perimeter's enforce is set to false

D. The perimeter uses NETWORK_PERIMETER instead of SERVICE_PERIMETER

Solution

1. Step 1: Analyze the effect of restrictedServices and enforce

   If storage.googleapis.com is in restrictedServices and enforce is true, access to Cloud Storage is blocked inside the perimeter.

2. Step 2: Evaluate other options

   Missing storage.googleapis.com or enforce false would allow access; NETWORK_PERIMETER is invalid for VPC SC.

3. Final Answer:

   restrictedServices includes storage.googleapis.com and enforce is true -> Option A

4. Quick Check:

   Restricted service + enforce true blocks access [OK]

Hint: Restricted service with enforce true blocks access inside perimeter [OK]

Common Mistakes:

• Thinking missing restrictedServices blocks access
• Assuming enforce false blocks access
• Confusing NETWORK_PERIMETER with SERVICE_PERIMETER

5. Your company wants to protect sensitive data in BigQuery and Cloud Storage using VPC Service Controls. You have two projects: project-secure and project-public. You want to allow project-public to access BigQuery but not Cloud Storage inside the perimeter. How should you configure the perimeter?

hard

A. Include both projects in resources, restrict only storage.googleapis.com

B. Include only project-secure in resources, restrict both storage.googleapis.com and bigquery.googleapis.com

C. Include both projects in resources, restrict both storage.googleapis.com and bigquery.googleapis.com

D. Include only project-public in resources, restrict storage.googleapis.com

Solution

1. Step 1: Determine which projects to include in the perimeter

   To protect data in both projects but allow project-public access to BigQuery, include both projects in the perimeter.

2. Step 2: Set restricted services to block only Cloud Storage

   Restrict storage.googleapis.com to block Cloud Storage access, but do not restrict bigquery.googleapis.com to allow BigQuery access from project-public.

3. Final Answer:

   Include both projects and restrict only storage.googleapis.com -> Option A

4. Quick Check:

   Both projects + restrict storage only = Include both projects in resources, restrict only storage.googleapis.com [OK]

Hint: Restrict only storage to block Cloud Storage, include both projects [OK]

Common Mistakes:

• Restricting both services blocks BigQuery access
• Including only one project limits protection
• Restricting BigQuery when access is needed