Configure Private Service Connect endpoints in service perimeters

Console

You can configure an ingress rule to include forwarding rules when you create or update a perimeter in the Cloud de Confiance console.

1. In the Cloud de Confiance console navigation menu, click Security > VPC Service Controls.

   Go to VPC Service Controls

2. To create a new perimeter, click New perimeter.

   To modify an existing perimeter, select the perimeter and click Edit.

3. Select Ingress policy.

4. In the Ingress rules pane, click Add an ingress rule.

5. In the From section, select Select sources from the Sources list.

6. Click Private Service Connect endpoints.

7. Click Add endpoints.

8. In the Add Private Service Connect endpoints pane, select one of the options:

   • Search for PSC endpoints: This option lets you search and select the required Private Service Connect endpoints from the list.

   • Enter PSC endpoint ID manually: This option lets you manually enter the Private Service Connect endpoints. To specify a Private Service Connect endpoint, use the following format: //compute.googleapis.com/projects/PROJECT_ID/global/forwardingRules/FORWARDING_RULE_ID, where FORWARDING_RULE_ID is the ID of the endpoint's forwarding rule.

9. Click Add endpoints.

10. Click Done.

11. Click Create or Save.

For information about other ingress rule attributes, see Ingress rules reference.

gcloud

You can configure an ingress rule to include forwarding rules using a JSON file or a YAML file. The following sample uses the YAML format:

- ingressFrom:
    identityType: ANY_IDENTITY | ANY_USER_ACCOUNT | ANY_SERVICE_ACCOUNT
    *OR*
    identities:
    - PRINCIPAL_IDENTIFIER
    sources:
    - resource: RESOURCE
    *OR*
    - accessLevel: ACCESS_LEVEL
    *OR*
    - pscEndpoint:
        forwardingRule: PSC_ENDPOINT
  ingressTo:
    operations:
    - serviceName: SERVICE_NAME
      methodSelectors:
      - method: METHOD_NAME
      *OR*
      - permission: PERMISSION
    *OR*
    roles:
    - ROLE_NAME
    resources:
    - projects/PROJECT_NUMBER

Replace PSC_ENDPOINT with the Private Service Connect endpoints from which you want to allow access to resources in the perimeter. To specify a Private Service Connect endpoint, use the following format: //compute.googleapis.com/projects/PROJECT_ID/global/forwardingRules/FORWARDING_RULE_ID, where FORWARDING_RULE_ID is the ID of the endpoint's forwarding rule.

For information about other ingress rule attributes, see Ingress rules reference.

After you configure the ingress rule file with Private Service Connect endpoints, you can use the rule when you create or update a perimeter.

To configure the rule when you create a perimeter, run the following command:

gcloud access-context-manager perimeters create NAME \
--title=TITLE \
--resources=RESOURCES \
--restricted-services=RESTRICTED_SERVICES \
--ingress-policies=INGRESS_FILENAME.yaml \
--policy=POLICY_NAME

Replace INGRESS_FILENAME with the path of the ingress rule file.

For more information, see Create a service perimeter.

To configure the rule when you update a perimeter, run the following command:

gcloud access-context-manager perimeters update PERIMETER_ID \
--set-ingress-policies=INGRESS_FILENAME.yaml

Replace the following:

• PERIMETER_ID: The ID of the service perimeter that you want to update.
• INGRESS_FILENAME: The path of the ingress rule file.

For more information, see Updating ingress and egress policies for a service perimeter.

Console

You can configure an egress rule to include forwarding rules when you create or update a perimeter in the Cloud de Confiance console.

1. In the Cloud de Confiance console navigation menu, click Security > VPC Service Controls.

   Go to VPC Service Controls

2. To create a new perimeter, click New perimeter.

   To modify an existing perimeter, select the perimeter and click Edit.

3. Select Egress policy.

4. In the Egress rules pane, click Add an egress rule.

5. In the From section, select Select sources from the Sources list.

6. Click Private Service Connect endpoints.

7. Click Add endpoints.

8. In the Add Private Service Connect endpoints pane, select one of the options:

   • Search for PSC endpoints: This option lets you search and select the required Private Service Connect endpoints from the list.

   • Enter PSC endpoint ID manually: This option lets you manually enter the Private Service Connect endpoints. To specify a Private Service Connect endpoint, use the following format: //compute.googleapis.com/projects/PROJECT_ID/global/forwardingRules/FORWARDING_RULE_ID, where FORWARDING_RULE_ID is the ID of the endpoint's forwarding rule.

9. Click Add endpoints.

10. Click Done.

11. Click Create or Save.

For information about other egress rule attributes, see Egress rules reference.

gcloud

You can configure an egress rule to include forwarding rules using a JSON file or a YAML file. The following sample uses the YAML format:

- egressTo:
    operations:
    - serviceName: SERVICE_NAME
      methodSelectors:
      - method: METHOD_NAME
      *OR*
      - permission: PERMISSION
    *OR*
    roles:
    - ROLE_NAME
    resources:
    - projects/PROJECT_NUMBER
    *OR*
    externalResources:
    - EXTERNAL_RESOURCE_PATH
  egressFrom:
    identityType: ANY_IDENTITY | ANY_USER_ACCOUNT | ANY_SERVICE_ACCOUNT
    *OR*
    identities:
    - PRINCIPAL_IDENTIFIER
    sources:
    - resource: RESOURCE
    *OR*
    - accessLevel: ACCESS_LEVEL
    *OR*
    - pscEndpoint:
        forwardingRule: PSC_ENDPOINT
    sourceRestriction: RESTRICTION_STATUS

Replace PSC_ENDPOINT with the Private Service Connect endpoints through which you want to allow resources inside the perimeter to access external resources. To specify a Private Service Connect endpoint, use the following format: //compute.googleapis.com/projects/PROJECT_ID/global/forwardingRules/FORWARDING_RULE_ID, where FORWARDING_RULE_ID is the ID of the endpoint's forwarding rule.

For information about other egress rule attributes, see Egress rules reference.

After you configure the egress rule file with Private Service Connect endpoints, you can use the rule when you create or update a perimeter.

To configure the rule when you create a perimeter, run the following command:

gcloud access-context-manager perimeters create NAME \
--title=TITLE \
--resources=RESOURCES \
--restricted-services=RESTRICTED_SERVICES \
--egress-policies=EGRESS_FILENAME.yaml \
--policy=POLICY_NAME

Replace EGRESS_FILENAME with the path of the egress rule file.

For more information, see Create a service perimeter.

To configure the rule when you update a perimeter, run the following command:

gcloud access-context-manager perimeters update PERIMETER_ID \
--set-egress-policies=EGRESS_FILENAME.yaml

Replace the following:

• PERIMETER_ID: The ID of the service perimeter that you want to update.
• EGRESS_FILENAME: The path of the egress rule file.

For more information, see Updating ingress and egress policies for a service perimeter.