To define the services that can be accessed from a network inside your service perimeter, use the VPC accessible services feature. The VPC accessible services feature limits the set of services that are accessible from network endpoints inside your service perimeter.
The VPC accessible services feature applies only to traffic from your VPC network endpoints to Google APIs. Unlike service perimeters, the VPC accessible services feature does not apply to the communication from one Google API to another, or the networks of tenancy units, which are used to implement certain Cloud de Confiance services.
When configuring VPC accessible services for a perimeter, you can specify a
list of individual services. You can also include the RESTRICTED-SERVICES
value, which automatically includes all services protected by the perimeter.
To ensure that access to the expected services is limited, you must do the following:
- Configure the perimeter to protect the same set of services that you want to make accessible.
- Restrict network access depending on whether you need to use
unsupported services:
- To restrict access to supported services, configure VPC networks to use the restricted VIP.
- To restrict access to unsupported Google APIs, configure VPC networks to use the private VIP and configure service patterns.
- Use VPC firewall rules to restrict traffic based on destination IP addresses.
VPC network with Cloud Storage only
Assume you have a service perimeter, my-authorized-perimeter, that includes
two projects: my-authorized-compute-project and my-authorized-gcs-project.
The perimeter protects the Cloud Storage service.
my-authorized-gcs-project uses a number of services, including
Cloud Storage, Bigtable, and others.
my-authorized-compute-project hosts a VPC network.
Because the two projects share a perimeter, the VPC network in
my-authorized-compute-project has access to the resources of services in
my-authorized-gcs-project, regardless of whether the perimeter protects those
services. However, you want your VPC network to only have
access to Cloud Storage resources in my-authorized-gcs-project.
You are concerned that if the credentials for a VM in your VPC
network are stolen, an adversary could leverage that VM to exfiltrate data
from any available service in my-authorized-gcs-project.
You have already configured your VPC network to use the
restricted VIP, which limits access from your VPC network
only to APIs that are supported by VPC Service Controls. However, this
setting doesn't prevent your VPC network from accessing
supported services, such as the Bigtable resources in
my-authorized-gcs-project.
To limit the VPC network's access to only the storage service,
you enable VPC accessible services and set storage.googleapis.com as an
allowed service:
gcloud access-context-manager perimeters update my-authorized-perimeter \
--enable-vpc-accessible-services \
--add-vpc-allowed-services=storage.googleapis.com
Success! The VPC network in my-authorized-compute-project is
now limited to accessing only resources for the Cloud Storage service.
This restriction also applies to any projects and VPC networks
you later add to the perimeter.
VPC Service Controls service patterns
VPC Service Controls service patterns let you configure which Google APIs can be accessed from VPC networks in a service perimeter when using the private VIP. You can specify Google API URL patterns for unsupported services that you want to allow access to, and deny access to all other unsupported API requests on the private VIP path.
You can use service patterns to attach HTTP headers (such as
X-Goog-Allowed-Resources) to API requests for unsupported services without
deploying a proxy. This helps mitigate exfiltration risks by enforcing
tenant-based or domain-based restrictions.
To configure service patterns, see Limit access to Google APIs by using service patterns.