Note: The following remediation instructions use Cloud Storage (GCS) as an example. Similar steps should be followed for other services supported by VPC Service Controls (BigQuery, Cloud SQL, Bigtable, etc.) by substituting the appropriate service API and project resources. From Google Cloud CLI 1: Create an Access Context Manager Policy: # Check if policy exists gcloud access-context-manager policies list --organization= # If no policy exists, create one gcloud access-context-manager policies create \\ --organization= \\ --title="VPC Service Controls Policy" 2. Create a Service Perimeter to protect Cloud Storage buckets: # Get policy ID POLICY_ID=$(gcloud access-context-manager policies list \\ --organization= \\ --format="value(name)") # Create perimeter in dry-run mode first gcloud access-context-manager perimeters create \\ --title="Production Data Perimeter" \\ --resources=projects/ \\ --restricted-services=storage.googleapis.com \\ --policy=${POLICY_ID} \\ --perimeter-type=regular \\ --async 3. Add multiple projects and services to the perimeter: gcloud access-context-manager perimeters update \\ --add-resources=projects/,projects/ \\ --add-restricted-services=bigquery.googleapis.com,sqladmin.googleapis.com \\ --policy=${POLICY_ID} 4. Test with dry-run mode before enforcement: # Create dry-run spec gcloud access-context-manager perimeters dry-run create \\ --policy=${POLICY_ID} \\ --resources=projects/ \\ --restricted-services=storage.googleapis.com 5. Monitor dry-run logs to identify blocked requests: # Query VPC Service Controls logs for dry-run violations gcloud logging read \\ 'protoPayload.metadata."@type"="type.googleapis.com/google.cloud.audit.VpcServiceControlAuditMetadata" AND protoPayload.metadata.dryRun=true' \\ --limit=50 \\ --format=json \\ --project= 6: After testing, enforce the perimeter: gcloud access-context-manager perimeters dry-run enforce \\ --policy=${POLICY_ID} 7: Create access levels for conditional access (optional but recommended): gcloud access-context-manager levels create \\ --title="Corporate Network Access" \\ --basic-level-spec=.yaml \\ --policy=${POLICY_ID} Example access level spec file (access_level.yaml): combiningFunction: AND conditions: - ipSubnetworks: - "203.0.113.0/24" # Corporate IP range members: - "user:admin@example.com" Then add the access level to the perimeter: gcloud access-context-manager perimeters update \\ --add-access-levels= \\ --policy=${POLICY_ID} Impact: Implementing VPC Service Controls requires careful planning as it restricts network access to protected resources. Services outside the perimeter will be denied access to resources inside the perimeter by default, which may impact: - Application connectivity: Applications must be within the same perimeter or use authorized ingress/egress rules - Data pipelines: Cross-project data flows require explicit perimeter bridges or access levels - Third-party integrations: External services may be blocked and require perimeter configuration - Administrative access: Admin tasks from non-corporate networks may be restricted unless access levels permit Organizations should use VPC Service Controls dry-run mode to test policies before enforcement to identify and remediate connectivity issues. There is no direct performance impact on services within the perimeter.

Detections

Analytics

Item Search