VPC Service Controls define security perimeters around GCP resources and prevent data exfiltration at the API level.
What are VPC Service Controls?
VPC Service Controls are a security layer that protects Google Cloud services through perimeters. Even if an attacker has valid credentials, they cannot copy data out of the perimeter.
Protection operates at the API level, not the network level. A compromised service account can access a protected service such as BigQuery but cannot export data to an external project. This is crucial for defense-in-depth: even with successful credential theft, data exfiltration remains blocked.
VPC Service Controls integrate with Access Context Manager for context-based access decisions. You can restrict access based on IP address, device status, or identity.
Core Features
- Security perimeters: Isolation of resources across multiple GCP services within a defined perimeter.
- API-level protection: Prevents data exfiltration even with valid but compromised credentials.
- Context-based access control: Integration with Access Context Manager for rules based on IP, device, and identity.
- Dry-run mode: Test perimeter configurations with logging only before enabling enforcement.
- Perimeter bridges: Controlled data exchange between separate perimeters for defined use cases.
Common Use Cases
Protecting Sensitive Data in BigQuery
A financial services company stores customer data in BigQuery. A service perimeter protects the project. Analysts can run queries but cannot export data to other projects or local files. Even administrators with full BigQuery permissions cannot bypass the perimeter.
Multi-Project Perimeter for Compliance
A healthcare company groups all regulatory-relevant projects into one perimeter. Cloud Storage, BigQuery, and the Gemini Enterprise Agent Platform within the perimeter can communicate. Data exchange with unprotected projects is blocked, simplifying compliance.
Development Environment with Dry-Run
A company plans to implement VPC Service Controls. The perimeter is first created in dry-run mode. All potential blocks are logged in Cloud Logging. After an analysis phase, enforcement mode is enabled.
Context-Based Access Control
A company allows access to sensitive data only from the corporate network. Access levels define that accesses from outside corporate IP ranges are blocked. Remote employees must access via VPN.
Perimeter Bridges for Controlled Communication
Two teams operate separate perimeters. For a shared analytics project, a perimeter bridge is configured. Teams can exchange defined data without fully opening their perimeters.
Benefits
- Protection against data exfiltration: Effective even with compromised credentials, since protection operates at the API level.
- No additional costs: Using VPC Service Controls itself is free.
- Fine-grained control: Context-based rules enable differentiated access management.
- Safe testing: Dry-run mode allows risk-free validation before production use.
- Compliance support: Perimeters help meet regulatory requirements for data isolation.
Integration with innFactory
As a certified Google Cloud partner, innFactory supports you in implementing VPC Service Controls: from perimeter planning through dry-run to production enforcement.
Contact us for a security consultation.
Available Tiers & Options
VPC Service Controls
- Free to use
- No infrastructure required
- Policy-based
- Requires careful planning
Typical Use Cases
Technical Specifications
Frequently Asked Questions
What are VPC Service Controls?
VPC Service Controls define security perimeters around Google Cloud resources. Within a perimeter, services can communicate; access from outside is blocked. This prevents data exfiltration even with compromised credentials.
Which services support VPC Service Controls?
Many GCP services are supported, including BigQuery, Cloud Storage, Cloud SQL, the Gemini Enterprise Agent Platform (formerly Vertex AI), GKE, Pub/Sub, and Spanner. The list grows continuously with new services; the official documentation provides the current overview.
What is the difference from VPC Firewall Rules?
Firewall Rules control network traffic at the IP/port level. VPC Service Controls operate at the API level and prevent data exfiltration from protected services, even with valid credentials.
How much do VPC Service Controls cost?
VPC Service Controls themselves are free. There are no additional fees for creating and using service perimeters. Protected services within the perimeter continue to be billed normally.
How does dry-run mode work?
In dry-run mode, access violations are logged but not blocked. This allows testing perimeter configurations in production before enabling enforcement mode.
Note: All product information on this page has been compiled with care, but is provided without guarantee and may be outdated or incomplete. Cloud services evolve rapidly — features, pricing, SLAs, and availability change frequently. Authoritative and up-to-date information can only be found on the official product page of Google Cloud (official documentation). This page does not represent an offer by Google Cloud.
