Learn how to set up a service perimeter usingVPC Service Controls in the Google Cloud console.

Before you begin

Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

• Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains theresourcemanager.projects.create permission.Learn how to grant roles.

Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

Go to project selector

If you're using an existing project for this guide,verify that you have the permissions required to complete this guide. If you created a new project, then you already have the required permissions.

Verify that billing is enabled for your Google Cloud project.

Enable the Access Context Manager API.

Roles required to enable APIs

To enable APIs, you need the Service Usage Admin IAM role (roles/serviceusage.serviceUsageAdmin), which contains theserviceusage.services.enable permission.Learn how to grant roles.

Enable the API

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

• Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains theresourcemanager.projects.create permission.Learn how to grant roles.

Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

Go to project selector

If you're using an existing project for this guide,verify that you have the permissions required to complete this guide. If you created a new project, then you already have the required permissions.

Verify that billing is enabled for your Google Cloud project.

Enable the Access Context Manager API.

Roles required to enable APIs

To enable APIs, you need the Service Usage Admin IAM role (roles/serviceusage.serviceUsageAdmin), which contains theserviceusage.services.enable permission.Learn how to grant roles.

Enable the API

Required roles

To get the permissions that you need to complete this quickstart, ask your administrator to grant you theAccess Context Manager Editor (roles/accesscontextmanager.policyEditor) IAM role on your organization. For more information about granting roles, seeManage access to projects, folders, and organizations.

This predefined role contains the permissions required to complete this quickstart. To see the exact permissions that are required, expand theRequired permissions section:

You might also be able to get these permissions withcustom roles or otherpredefined roles.

Set up a VPC Service Controls perimeter

In the following sections, you specify the perimeter details, add projects and servicesto protect, and create the perimeter.

Add the VPC Service Controls perimeter details

1. In the Google Cloud console, go to theVPC ServiceControls page.

   Go to VPC Service Controls

2. To create a new perimeter by using the default access policy,select your organization from the project selector menu.

   

   If your organization doesn't have an access policy, follow these steps:

   1. On theVPC Service Controls page, clickManage policies.

   2. On theManage VPC Service Controls page, clickCreate.

   3. On theCreate access policy page, in theAccess policy title field,enteraccess_policy_1.

   4. ClickCreate access policy.

3. On theVPC Service Controls page, clickNew perimeter.

4. On theCreate a service perimeter page, in theTitle field, enterperimeter_storage_services.

5. ForPerimeter type andEnforcement mode, retain the default selections.

6. ClickContinue.

Add projects to the perimeter

1. To add projects to the perimeter, clickAdd projects.

2. In theAdd Projects pane, select the projects that you want to add tothe perimeter and then clickAdd selected projects.

   

3. ClickContinue.

Clean up

To avoid incurring charges to your Google Cloud account for the resources used on this page, follow these steps.

1. In the Google Cloud console, go to theVPC Service Controls page.

   Go to VPC Service Controls

2. On theVPC Service Controls page, in the row corresponding to theperimeter that you created, clickdeleteDelete.

3. In the dialog box, clickDelete to confirm that you want todelete the perimeter.

What's next

• Learn more aboutcreating service perimeters.
• Learn aboutmanaging existing service perimeters.
• Learn about thelimitations of using specific services with VPC Service Controls.