If you've been working with Google Cloud Platform for a while, you've probably bumped into VPC Service Controls at some point — maybe while trying to lock down sensitive data or after reading through a security checklist. It can feel a little abstract at first, so I put together this FAQ to break it down in plain terms. Whether you're just getting started or trying to fill in some gaps, I hope this helps clear things up.
What exactly are VPC Service Controls?
VPC Service Controls (VPC-SC) is a security feature in Google Cloud that lets you define a perimeter around your GCP resources and APIs. Think of it like drawing fence around specific projects or services. Once thatimeter is in place, data't move in or out unless explicitly allowed it. It's designed to prevent data exfiltration — so even if an attacker compromises credentials, they can't just pull your data out to an external project or service. The key thing to understand is that VPC-SC operates at the API level, not the network level, which makes it different from traditional firewalls or VPCs.
How is VPC Service Perimeter different from a regular VPC?
A regular VPC is a network-level construct — controls traffic flow between VMs subnets, and external addresses using firewall rules and routing. A VPC Service Perimeter is an access policy construct that controls which identities and networks can call specific Google APIs, like Cloud Storage, BigQuery, or Pub/Sub. They complement each other rather than replace each other. You might have a VPC handling network traffic whilePC-SC sits on top to protect your managed services from unauthorized access or leakage.
What resources can I protect with VPC Service Controls?
VPC-SC supports growing list of Google Cloud services. Some of the most commonly protected ones include Cloud Storage, BigQuery, Cloud Spanner, Pub/Sub, Cloud KMS, Artifact Registry, and Secret Manager. You define the perimeter around GCP projects, and any supported service within those projects inherits the protection. It's worth checking's official documentation for latest list of supported services, because new ones get added regularly as feature matures.
What is policy and how does it relate to VPC-SC?
An access policy is basically the top-level containerPC Service Controls. It lives the organization level and holds all of serviceimeters and access levels. You think of it as the rulebook that governs howimeters and access conditions organized. Most organizations single access policy, but if you're in a large enterprise environment with multiple business units, you might work with access delegation to manage things at a folder level without giving full org-level control every team.
What levels and when do I need them?
Access levels let you define conditions under which requests are allowed to cross the perimeter. For example, you might want to allow access only from specific IP ranges, from corporate devices meet certain security requirements, or through a particular identity. Access levels are defined in Access Context Manager, which integrates tightly with VPC-SC. They're especially useful when you have users services that legitimately need to access data from outsideimeter — like a developer from home or on-premise system that needs to reach a Cloud Storage bucket.
's the difference between enforced mode and dry run mode?When you create a service perimeter, you can run it in dry run mode (also called simulation mode) before actually enforcing it. In dry run mode,PC-SC logs what would be blocked but doesn't actually block anything. This incredibly useful for testing your perimeter configuration without breaking production workloads. Once you're confident rules are correct and you're not going to cut off legitimate, you switch to enforced mode where the restrictions actually take effect. I'd strongly recommend spending real time in dry run mode — skipping it how teams end up with unexpected outages>CanPC Service Controls block within Cloud itself
Yes this surprises a lot of people. VPC-SC doesn't just against external threats — it also restricts access between. If a project inside your organization isn't inside the perimeter, it can't access resources are inside the perimeter, even if both belong to the same organization. This is great for isolating sensitive data from less-trusted internalloads. You can useimeter bridges to allow controlled communication between two separateimeters, or add to the same perimeter if they're trusted share>How do I handle accounts>
Service accounts are fully subject to VPC-SC restrictions, which something often overlook. If service account running in a outside perimeter tries to access a resource inside the perimeter, the request gets blocked regardless of what IAM permissions that service account has. You can address this with access levels include specific service accountities, or by ensuring the service account's is included the perimeter. The important lesson here is that IAM and VPC-SC are separate layers of defense, and you need both configured correctly for things to work.
What are the most common mistakes people make with VPC-
The biggest one see is skipping dry run mode and going straight to enforcement leading to broken pipelines and angry-call engineers. Another common mistake is forgetting to account for Googlemanaged service accounts, which are used internally by services like Dataflow or Composer and may need explicit access. People also frequently underestimate the blast radius of a perimeter that's too broad or too narrow. Too broad and you lose the security benefit; too narrow and you break legitimate workflows. Finally, not auditing V Logging is a missed opportunity — those logs are gold understanding what's actually happening at the perimeter boundary.
