How to Use VPC Service Controls in GCP for Secure Access

Use VPC Service Controls in GCP to create a secure boundary around your cloud resources by defining a service perimeter. This perimeter restricts data access to trusted networks and services, preventing data exfiltration. Configure it via the Google Cloud Console or gcloud CLI by specifying projects and services inside the perimeter.

Syntax

The main components of VPC Service Controls are service perimeters that define trusted boundaries. You specify:

• resources: Projects or services to protect.
• restricted_services: Google Cloud services to include.
• access_levels: Optional conditions for access.

You create or update perimeters using the gcloud access-context-manager perimeters commands or via the Cloud Console.

bash

gcloud access-context-manager perimeters create PERIMETER_NAME \
  --title="Perimeter Title" \
  --resources=projects/PROJECT_ID \
  --restricted-services=storage.googleapis.com,bigquery.googleapis.com \
  --access-levels=ACCESS_LEVEL_NAME

Example

This example creates a service perimeter named my-perimeter that protects a project and restricts access to Cloud Storage and BigQuery services only from a defined access level.

bash

gcloud access-context-manager perimeters create my-perimeter \
  --title="My Service Perimeter" \
  --resources=projects/my-project-id \
  --restricted-services=storage.googleapis.com,bigquery.googleapis.com \
  --access-levels=my-access-level

Output

Created perimeter [my-perimeter].

Common Pitfalls

Common mistakes when using VPC Service Controls include:

• Not including all required projects or services inside the perimeter, which can cause unexpected access failures.
• Forgetting to define or properly configure access levels, leading to overly restrictive or permissive access.
• Trying to access protected services from outside the perimeter without VPN or private connectivity.

Always test access after configuration to ensure legitimate workflows are not blocked.

bash

## Wrong: Missing restricted services

gcloud access-context-manager perimeters create wrong-perimeter \
  --resources=projects/my-project-id

## Right: Include restricted services

gcloud access-context-manager perimeters create correct-perimeter \
  --resources=projects/my-project-id \
  --restricted-services=storage.googleapis.com,bigquery.googleapis.com

Quick Reference

Term	Description
Service Perimeter	Defines the secure boundary around resources.
Resources	Projects or services included inside the perimeter.
Restricted Services	Google Cloud services protected by the perimeter.
Access Levels	Conditions that control who can access resources inside the perimeter.
gcloud CLI	Command line tool to create and manage perimeters.

Key Takeaways

Create service perimeters to protect your GCP projects and services from data leaks.

Specify restricted services and resources carefully to avoid blocking needed access.

Use access levels to control who can access resources inside the perimeter.

Test your perimeter configuration to ensure it allows legitimate access and blocks threats.

Manage VPC Service Controls via gcloud CLI or Google Cloud Console for flexibility.