Manage service perimeters

Console

1. In the Cloud de Confiance console navigation menu, click Security, and then click VPC Service Controls.

   Go to the VPC Service Controls page

2. On the VPC Service Controls page, in the table, click the name of the service perimeter that you want to view.

gcloud

To list your organization's service perimeters, use the list command:

gcloud access-context-manager perimeters list

You should see a list of the perimeters for your organization. For example:

NAME           TITLE                 ETAG
ProdPerimeter  Production Perimeter  abcdefg123456789

To view details about a service perimeter, use the describe command:

gcloud access-context-manager perimeters \
  describe PERIMETER_ID

Replace the following:

• PERIMETER_ID is the ID of the service perimeter that you want to obtain details about.

You should see the details about the perimeter. For example:

etag: abcdefg123456789
name: accessPolicies/626111171578/servicePerimeters/ProdPerimeter
status:
  accessLevels:
  - accessPolicies/626111171578/accessLevels/corpAccess
  resources:
  - projects/111584792408
  restrictedServices:
  - bigquery.googleapis.com
  - storage.googleapis.com
title: Production Perimeter

Console

1. In the Cloud de Confiance console navigation menu, click Security, and then click VPC Service Controls.

   Go to the VPC Service Controls page

2. On the VPC Service Controls page, in the table, click the name of the service perimeter that you want to modify.

3. On the Service perimeter details page, click Edit.

4. On the Edit service perimeter page, update the service perimeter.

5. Click Save.

gcloud

To add new resources to a perimeter, use the update command and specify the resources to add:

gcloud access-context-manager perimeters update PERIMETER_ID \
  --add-resources=RESOURCES

Replace the following:

• PERIMETER_ID is the ID of the service perimeter that you want to obtain details about.

• RESOURCES is a comma-separated list of one or more project numbers or VPC network names. For example: projects/12345 or //compute.googleapis.com/projects/my-project/global/networks/vpc1. Only projects and VPC networks are allowed. Project format: projects/project_number. VPC format: //compute.googleapis.com/projects/project-id/global/networks/network_name.

To update the list of restricted services, use the update command and specify the services to add as a comma-delimited list:

gcloud access-context-manager perimeters update PERIMETER_ID \
  --add-restricted-services=SERVICES

Replace the following:

• PERIMETER_ID is the ID of the service perimeter that you want to obtain details about.

• SERVICES is a comma-delimited list of one or more services. For example: storage.googleapis.com or storage.googleapis.com,bigquery.googleapis.com.

Console

1. In the Cloud de Confiance console navigation menu, click Security, and then click VPC Service Controls.

   Go to the VPC Service Controls page

2. On the VPC Service Controls page, in the table, click the name of the service perimeter that you want to modify.

3. On the Service perimeter details page, click Edit.

4. On the Edit service perimeter page, click Access levels.

5. Click Add access levels.

6. In the Add access levels pane, select the checkboxes corresponding to the access levels that you want to apply to the service perimeter.

7. Click Add selected access levels.

8. Click Save.

gcloud

To add an access level to an existing service perimeter, use the update command:

gcloud access-context-manager perimeters update PERIMETER_ID \
  --add-access-levels=LEVEL_NAME

Replace the following:

• PERIMETER_ID is the ID of your service perimeter.

• LEVEL_NAME is the name of the access level that you want to add to the perimeter.

Console

1. In the Cloud de Confiance console navigation menu, click Security, and then click VPC Service Controls.

   Go to the VPC Service Controls page

2. On the VPC Service Controls page, in the table row corresponding to the perimeter that you want to delete, click delete.

gcloud

To delete a service perimeter, use the delete command:

gcloud access-context-manager perimeters delete PERIMETER_ID

Replace the following:

• PERIMETER_ID is the ID of your service perimeter.

Console

1. In the Cloud de Confiance console navigation menu, click Security, and then click VPC Service Controls.

   Go to the VPC Service Controls page

2. On the VPC Service Controls page, in the table, click the name of the service perimeter that you want to modify.

3. On the Service perimeter details page, click edit Edit.

4. In the VPC accessible services pane, select one of the following options:

   • All restricted services: Restricts access to only the services protected by this service perimeter.
   • Selected services: Restricts access to a custom list of services.
   • No services: Blocks access to all services.

5. Click Save, and then click Confirm.

gcloud

To enable VPC accessible services for your service perimeter, use the update command:

gcloud access-context-manager perimeters update PERIMETER_ID \
  --enable-vpc-accessible-services \
  --add-vpc-allowed-services=SERVICES

Replace the following:

• PERIMETER_ID is the ID of your service perimeter.

• SERVICES is a comma-separated list of one or more services that you want to allow networks inside your perimeter to access. Access to any services that are not included in this list are prevented.

  To quickly include the services protected by the perimeter, add RESTRICTED-SERVICES to the list for SERVICES. You can include other services in addition to RESTRICTED-SERVICES.

For example, to ensure that the VPC networks in your perimeter have access only to the Logging and Cloud Storage services, use the following command:

gcloud access-context-manager perimeters update example_perimeter \
  --enable-vpc-accessible-services \
  --add-vpc-allowed-services=\
RESTRICTED-SERVICES,logging.googleapis.com,storage.googleapis.com \
  --policy=11271009391

Console

1. In the Cloud de Confiance console navigation menu, click Security, and then click VPC Service Controls.

   Go to the VPC Service Controls page

2. On the VPC Service Controls page, in the table, click the name of the service perimeter that you want to modify.

3. On the Service perimeter details page, click edit Edit.

4. In the VPC accessible services pane, select Selected services.

5. Click Add services.

6. In the Add services pane, select the checkboxes for the services that you want to allow.

7. Click Add selected services.

8. Optional: To automatically include all services protected by the perimeter, click the Include all restricted services toggle to the on position.

9. Click Save, and then click Confirm.

gcloud

To add additional services to the VPC accessible services for your perimeter, use the update command:

gcloud access-context-manager perimeters update PERIMETER_ID \
  --add-vpc-allowed-services=SERVICES

Replace the following:

• PERIMETER_ID is the ID of your service perimeter.

• SERVICES is a comma-separated list of one or more services that you want to allow networks inside your perimeter to access.

  To quickly include the services protected by the perimeter, add RESTRICTED-SERVICES to the list for SERVICES. You can include separate services in addition to RESTRICTED-SERVICES.

For example, if you enable VPC accessible services and require that the VPC networks in your perimeter have access to the Pub/Sub service, use the following command:

gcloud access-context-manager perimeters update example_perimeter \
  --add-vpc-allowed-services=RESTRICTED-SERVICES,pubsub.googleapis.com \
  --policy=11271009391

Console

1. In the Cloud de Confiance console navigation menu, click Security, and then click VPC Service Controls.

   Go to the VPC Service Controls page

2. On the VPC Service Controls page, in the table, click the name of the service perimeter that you want to modify.

3. On the Service perimeter details page, click edit Edit.

4. In the VPC accessible services pane, make sure that the option is set to Selected services.

5. In the list of allowed services, locate the service that you want to remove, and click delete Delete next to the service name.

6. Click Save, and then click Confirm.

gcloud

To remove services from the VPC accessible services for your service perimeter, use the update command:

gcloud access-context-manager perimeters update PERIMETER_ID \
  --remove-vpc-allowed-services=SERVICES

Replace the following:

• PERIMETER_ID is the ID of your service perimeter.

• SERVICES is a comma-separated list of one or more services that you want to remove from the list of services that networks inside your service perimeter are permitted to access.

For example, if you enable VPC accessible services and you no longer want the VPC networks in your perimeter to have access to the Cloud Storage service, use the following command:

gcloud access-context-manager perimeters update example_perimeter \
  --remove-vpc-allowed-services=storage.googleapis.com \
  --policy=11271009391

Console

1. In the Cloud de Confiance console navigation menu, click Security, and then click VPC Service Controls.

   Go to the VPC Service Controls page

2. On the VPC Service Controls page, in the table, click the name of the service perimeter that you want to modify.

3. On the Service perimeter details page, click edit Edit.

4. In the VPC accessible services pane, select All services.

5. Click Save, and then click Confirm.

gcloud

To disable VPC service restrictions for your service perimeter, use the update command:

gcloud access-context-manager perimeters update PERIMETER_ID \
  --no-enable-vpc-accessible-services \
  --clear-vpc-allowed-services

Replace the following:

• PERIMETER_ID is the ID of your service perimeter.

For example, to disable VPC service restrictions for example_perimeter, use the following command:

gcloud access-context-manager perimeters update example_perimeter \
  --no-enable-vpc-accessible-services \
  --clear-vpc-allowed-services \
  --policy=11271009391

Console

1. In the Cloud de Confiance console navigation menu, click Security, and then click VPC Service Controls.

   Go to the VPC Service Controls page

2. On the VPC Service Controls page, in the table, click the name of the service perimeter that you want to modify.

3. On the Service perimeter details page, click edit Edit.

4. In the VPC accessible services pane, select Select services and patterns.

5. To add a supported service or an unsupported service pattern, click add Add.

   • To add a supported Google API:
     1. Select the Services option.
     2. Select the checkbox next to each service name that you want to allow.
     3. Click Add selected services.
   • To add an unsupported Google API using a custom URL pattern:
     1. Select the Patterns option.
     2. Click Add pattern or enter a URL pattern in the Pattern field (for example, maps.googleapis.com/*).
     3. Optional: Add custom HTTP request headers. Click Add request header, choose a header key from the Key list, and specify the value.
     4. Click Add service patterns.

6. In the Service patterns enforcement scopes drop-down list, select Google APIs via Private Path.

7. Click Save, and then click Confirm.

gcloud

To configure service patterns, you must specify the VPC accessible services configuration in a YAML file.

enableRestriction: true
servicePatternsEnforcementScopes:
- GOOGLE_APIS_VIA_PRIVATE_PATH
allowedServicePatterns:
- service: 'RESTRICTED-SERVICES'
- service: 'logging.googleapis.com'
- pattern: 'maps.googleapis.com/*'
- pattern: 'www.googleapis.com/drive/*'

The YAML file contains the following fields:

• enableRestriction: Set to true to enable limits on accessible services.
• servicePatternsEnforcementScopes: Set this to GOOGLE_APIS_VIA_PRIVATE_PATH to enforce service patterns on Google APIs accessed through the private VIP.
• allowedServicePatterns: The list of allowed services and URL patterns, which represent Google API hostnames and URL path patterns, corresponding to the HTTP Host headers of the requests.
  • Use the service field for supported services (for example, logging.googleapis.com). You can also specify the RESTRICTED-SERVICES value, which expands to all services protected by the service perimeter.
  • Use the pattern field for unsupported URL patterns (for example, maps.googleapis.com/*).

Create or update perimeters with service patterns

To create a service perimeter with service patterns, use the create command. Specify the YAML configuration file that you set up in Limit access by using service patterns:

gcloud access-context-manager perimeters \
  create PERIMETER_ID \
  --title="TITLE" \
  --resources="projects/PROJECT_ID" \
  --restricted-services=SERVICES \
  --vpc-accessible-services=vpc_accessible_services.yaml \
  --policy=POLICY_ID

To update an existing service perimeter to use service patterns, use the update command. Specify the YAML configuration file that you set up in Limit access by using service patterns:

gcloud access-context-manager perimeters \
  update PERIMETER_ID \
  --set-vpc-accessible-services=vpc_accessible_services.yaml \
  --policy=POLICY_ID

Replace the following:

• PERIMETER_ID: The ID of your service perimeter.

• TITLE: The title of the service perimeter.

• PROJECT_ID: The ID of the project to add to the perimeter.

• SERVICES: A comma-separated list of one or more services.

• POLICY_ID: The ID of your access policy.

• vpc_accessible_services.yaml is the path to the YAML configuration file that you set up in Limit access by using service patterns.

Console

To verify the impact of service patterns before enforcing them, configure the service patterns in the dry-run mode of your perimeter:

1. In the Cloud de Confiance console navigation menu, click Security, and then click VPC Service Controls.

   Go to the VPC Service Controls page

2. On the VPC Service Controls page, click the Dry run mode tab.

3. In the list of service perimeters, click the name of the service perimeter that you want to modify.

4. On the Service perimeter details page, click edit Edit.

5. On the Edit service perimeter page, make changes to the dry run configuration (as described in Limit access by using service patterns).

6. Click Save, and then click Confirm.

7. Observe the audit logs to check for violations. For details, see Identifying blocked requests.

8. On the Service perimeter details page, click Enforce config.

9. When you are asked to confirm that you want to overwrite your existing enforced configuration, click Confirm.

gcloud

To verify the impact of service patterns before enforcing them, configure the service patterns in the dry-run mode of your perimeter:

1. Create a dry-run perimeter containing your configuration file.

   gcloud access-context-manager perimeters dry-run \
     create PERIMETER_ID \
     --perimeter-title="TITLE" \
     --perimeter-resources="projects/PROJECT_ID" \
     --perimeter-restricted-services=SERVICES \
     --perimeter-vpc-accessible-services=vpc_accessible_services.yaml \
     --policy=POLICY_ID
   

2. Observe the audit logs to check for violations.

3. Enforce the configuration by replacing the perimeter's main configuration.

   gcloud access-context-manager perimeters dry-run \
     enforce PERIMETER_ID \
     --policy=POLICY_ID