Protect repositories in a service perimeter

VPC Service Controls improves your ability to mitigate the risk of unauthorized copying or transfer of data from Trusted Cloud by S3NS-managed services.

With VPC Service Controls, you can configure security perimeters around the resources of your Trusted Cloud by S3NS-managed services and control the movement of data across the perimeter boundary.

Using Artifact Registry with VPC Service Controls

If you are using Artifact Registry and Google Kubernetes Engine private clusters in a project within a service perimeter, you can access container images inside the service perimeter as well as Trusted Cloud by S3NS-provided images.

To learn about ingress and egress rules, see Ingress and egress rules.

You can access Artifact Registry using the IP addresses for the default Google APIs and services domains, or using these special IP addresses:

• 199.36.153.4/30 (restricted.s3nsapis.fr)
• 199.36.153.8/30 (private.s3nsapis.fr)

For details about these options, see Configuring Private Google Access. For an example configuration that uses 199.36.153.4/30 (restricted.s3nsapis.fr), see the documentation for registry access with a virtual IP.

Ensure that Trusted Cloud by S3NS services that need to access Artifact Registry are also in the service perimeter, including runtime environments such as Google Kubernetes Engine. See the list of supported services for details about each service.

For general instructions to add Artifact Registry to a service perimeter, see Creating a service perimeter.

Access images in gcr.io repositories

To access images in Artifact Registry gcr.io repositories, when setting ingress or egress policies, use the identity type ANY_IDENTITY. You can't use the identity types ANY_SERVICE_ACCOUNT or ANY_USER_ACCOUNT for images in the gcr.io domain.