VPC のアクセス可能なサービス機能は、VPC ネットワーク エンドポイントから Google API へのトラフィックにのみ適用されます。サービス境界とは異なり、VPC のアクセス可能なサービス機能は、ある Google API から別の Google API への通信や、 Google Cloud サービスの実装に使用するテナンシー ユニットのネットワークには適用されません。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-09-01 UTC。"],[],[],null,["# VPC accessible services\n\nTo define the services that can be accessed from a network inside your\nservice perimeter, use the *VPC accessible services* feature. The VPC accessible\nservices feature limits the set of services that are accessible from network\nendpoints inside your service perimeter.\n\nThe VPC accessible services feature applies only to traffic from your VPC\nnetwork endpoints to Google APIs. Unlike service perimeters, the VPC accessible\nservices feature does not apply to the communication from one Google API to\nanother, or the networks of [tenancy units](https://cloud.google.com/service-infrastructure/docs/glossary#tenancy), which are used to implement\ncertain Google Cloud services.\n\nWhen configuring VPC accessible services for a perimeter, you can specify a\nlist of individual services, as well as include the `RESTRICTED-SERVICES`\nvalue, which automatically includes all of the services protected by the\nperimeter.\n\nTo ensure access to the expected services is fully limited, you must:\n\n- Configure the perimeter to protect the same set of services that you want to\n make accessible.\n\n- Configure VPCs in the perimeter to [use the restricted VIP](/vpc-service-controls/docs/set-up-private-connectivity).\n\n- Use layer 3 firewalls.\n\nExample: VPC network with Cloud Storage access only\n---------------------------------------------------\n\nAssume you have a service perimeter, `my-authorized-perimeter`, that includes\ntwo projects: `my-authorized-compute-project` and `my-authorized-gcs-project`.\nThe perimeter protects the Cloud Storage service.\n\n`my-authorized-gcs-project` uses a number of services, including\nCloud Storage, Bigtable, and others.\n`my-authorized-compute-project` hosts a VPC network.\n\nBecause the two projects share a perimeter, the VPC network in\n`my-authorized-compute-project` has access to the resources of services in\n`my-authorized-gcs-project`, regardless of whether the perimeter protects those\nservices. However, you want your VPC network to only have\naccess to Cloud Storage resources in `my-authorized-gcs-project`.\n\nYou are concerned that if the credentials for a VM in your VPC network are\nstolen, an adversary could leverage that VM to exfiltrate data from any\navailable service in `my-authorized-gcs-project`.\n\nYou have already configured your VPC network to use the restricted VIP, which\nlimits access from your VPC network only to APIs that are supported by\nVPC Service Controls. Unfortunately, that doesn't prevent your VPC network\nfrom accessing supported services, such as the Bigtable resources\nin `my-authorized-gcs-project`.\n\nTo limit the VPC network's access to only the storage service, you enable\nVPC accessible services and set `storage.googleapis.com` as an allowed service: \n\n gcloud access-context-manager perimeters update my-authorized-perimeter \\\n --enable-vpc-accessible-services \\\n --add-vpc-allowed-services=storage.googleapis.com\n\nSuccess! The VPC network in `my-authorized-compute-project` is now limited to\naccessing only resources for the Cloud Storage service. This\nrestriction also applies to any projects and VPC networks you later add to the\nperimeter.\n\nWhat's next?\n------------\n\n- [Use VPC accessible services.](/vpc-service-controls/docs/manage-service-perimeters#accessible-services)"]]
