This page describes how to set up and use the VPC Service Controls violation dashboardto view the details about access denials by service perimeters in your organization.

Cost

When you use the VPC Service Controls violation dashboard, you need to consider thecosts that you incur for using the following billable components of Google Cloud:

• Because you deploy Cloud Logging resources in your organization while settingup the violation dashboard, you incur cost for using these resources.

• Because you use an organization-level Log Router sink for the violation dashboard,VPC Service Controls duplicates all of your audit logs in the configured log bucket.You incur cost for using the log bucket. To estimate the potential cost for usingthe log bucket, query and calculate the volume of your audit logs. For more informationabout querying your existing logs, seeView logs.

For information about the Cloud Logging and Cloud Monitoring pricing, seeGoogle Cloud Observability pricing.

Before you begin

Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

• Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains theresourcemanager.projects.create permission.Learn how to grant roles.

Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

Go to project selector

Verify that billing is enabled for your Google Cloud project.

Enable the Service Usage API.

Roles required to enable APIs

To enable APIs, you need the Service Usage Admin IAM role (roles/serviceusage.serviceUsageAdmin), which contains theserviceusage.services.enable permission.Learn how to grant roles.

Enable the API

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

• Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains theresourcemanager.projects.create permission.Learn how to grant roles.

Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

Go to project selector

Verify that billing is enabled for your Google Cloud project.

Enable the Service Usage API.

Roles required to enable APIs

To enable APIs, you need the Service Usage Admin IAM role (roles/serviceusage.serviceUsageAdmin), which contains theserviceusage.services.enable permission.Learn how to grant roles.

Enable the API

Required roles

• To get the permissions that you need to set up the violation dashboard, ask your administrator to grant you theLogging Admin (roles/logging.admin) IAM role on the project in which you configure a log bucket during the violation dashboard setup. For more information about granting roles, seeManage access to projects, folders, and organizations.

  This predefined role contains the permissions required to set up the violation dashboard. To see the exact permissions that are required, expand theRequired permissions section:

  Required permissions

  The following permissions are required to set up the violation dashboard:

  • To list the log buckets from the selected project: logging.buckets.list
  • To create a new log bucket: logging.buckets.create
  • To enable Log Analytics in the selected log bucket: logging.buckets.update
  • To create a new Log Router sink: logging.sinks.create

  You might also be able to get these permissions withcustom roles or otherpredefined roles.

• To get the permissions that you need to view the violation dashboard, ask your administrator to grant you the following IAM roles on the project in which you configure a log bucket during the violation dashboard setup:

  • Logs View Accessor (roles/logging.viewAccessor)
  • VPC Service Controls Troubleshooter Viewer (roles/accesscontextmanager.vpcScTroubleshooterViewer)

  For more information about granting roles, seeManage access to projects, folders, and organizations.

  These predefined roles contain the permissions required to view the violation dashboard. To see the exact permissions that are required, expand theRequired permissions section:

  Required permissions

  The following permissions are required to view the violation dashboard:

  • To display the access policy names: accesscontextmanager.policies.list
  • To display the project names: resourcemanager.projects.get

  You might also be able to get these permissions withcustom roles or otherpredefined roles.

Set up the dashboard

To set up the violation dashboard, you need to configure alog bucketto aggregate the VPC Service Controls audit logs and create an organization-levelLog Router sink that will route all theVPC Service Controls audit logs to the log bucket.

To set up the violation dashboard for your organization, do the following one time:

1. In the Google Cloud console, go to theVPC Service Controls page.

   Go to VPC Service Controls

   If you are prompted, select your organization. You can access theVPC ServiceControls page only at the organization level.

2. On theVPC Service Controls page, clickViolation dashboard.

3. On theViolation dashboard setup page, in theProject field, select theproject that contains the log bucket in which you want to aggregate the audit logs.

4. ForLog bucket destination, selectExisting log bucket orCreatenew log bucket.

   • If you want to use an existing log bucket, in theLog bucket list,select the required log bucket.

   • If you create a newlog bucket, enter therequired information in the following fields:

     1. Name: A name for your log bucket.

     2. Description: A description for your log bucket.

     3. Region: The region where you want to store your logs.

        Note: After you create the log bucket, you can't change the log bucket'sregion.

     4. Retention period: A custom duration for which Cloud Loggingneeds to retain your logs.

     For more information about these fields, seeCreate a bucket.

5. ClickCreate log router sink. VPC Service Controls creates a new Log Routersink namedreserved_vpc_sc_dashboard_log_router in the selected project.

This operation takes about a minute to complete.

1. In the Google Cloud console, go to theVPC Service Controls page.

   Go to VPC Service Controls

   If you are prompted, select your organization. You can access theVPC ServiceControls page only at the organization level.

2. On theVPC Service Controls page, clickViolation dashboard. TheViolationdashboard page appears.

• Filtering: In thefilter_listFilter list, select the required options to filter and view specificdata—for example, principal, access policy, resource. To apply a specificvalue from one of the tables as a filter, clickfilter_altAdd filter preceding the value.

• Time intervals: To select the time range for the data, click one of the predefinedtime intervals. To define a custom time range, clickCustom.

• Tables and charts: Scroll theViolation dashboard page to view the data categorizedunder different tables and charts. The violation dashboard displays the following tablesand charts:

  • Violations

  • Violation count

  • Top violations by principal

  • Top violations by principal IP

  • Top violations by service

  • Top violations by method

  • Top violations by resource

  • Top violations by service perimeter

  • Top violations by access policy

• Count: TheViolations table lists the total occurrences for each accessdenial in theCount column, whereas theLast occurrence column shows thetimestamp of the most recent denial. TheUnique count columns in other tablesin the violation dashboard show unique occurrences grouped by attributes suchas principal, principal IP, and service.

• Troubleshoot access denials: Click the token in theTroubleshootingtoken column of theViolations table to open the violation analyzer andview the troubleshooting result for the access denial. This column displays onlythe most recent troubleshooting token for the access denial. To view all occurrencesof the access denial, clickunfold_moreUnfold more. TheViolation instances pane opens and lists all tokensfor the access denial along with their timestamps and unique IDs. Clicking atoken in this pane opens the troubleshooting result for the access denial.

  For information about using the violation analyzer, seeDiagnose an access denialin violation analyzer.

• Pagination: The violation dashboard paginates the data displayed in all tables.Clickchevron_leftPrevious andchevron_rightNext to navigate andview the paginated data.

• Modify Log Router sink: To modify the configured Log Router sink, clickEdit log sink.

  For information about modifying a Log Router sink, seeManage sinks.

Troubleshoot

If you encounter issues while using the violation dashboard, then try troubleshootingand resolving the issues as described in the following sections.

A service perimeter denied access to your user account

If you encounter an error due to insufficient permissions, check if any service perimeterwithin your organization is denying access to the Cloud Logging API. To resolve thisissue, create an ingress rule that lets you access the Cloud Logging API:

1. In the Google Cloud console, go to theVPC Service Controls page.

   Go to VPC Service Controls

   If you are prompted, select your organization.

2. On theVPC Service Controls page, click the service perimeter that protectsthe project containing your log bucket.

3. Create an ingress rulethat lets you access the Cloud Logging API in the project.

A service perimeter denied access to the log bucket

If VPC Service Controls doesn't route your audit logs to the configured log bucket,you might have to create an ingress rule that allows the Log Router sink's serviceaccount to access the Cloud Logging API in your service perimeter:

1. In the Google Cloud console, go to theLog Router page.

   Go to Log Router

2. On theLog Router page, selectmore_vert Menufor the configured Log Router sink, and then selectView sink details.

3. In theSink details dialog, from theWriter identity field, copy the serviceaccount that the Log Router sink uses.

4. In the Google Cloud console, go to theVPC Service Controls page.

   Go to VPC Service Controls

   If you are prompted, select your organization.

5. On theVPC Service Controls page, click the service perimeter that protectsthe project containing your log bucket.

6. Create an ingress rulethat allows the Log Router sink's service account to access the Cloud Logging API in the project.

Limitations

• VPC Service Controls doesn't backfill the audit logs from other project-level buckets:

  • If you create a new log bucket while setting up the violation dashboard, VPC Service Controlsdoesn't backfill the existing logs from other projects within your organizationinto the newly created log bucket. The dashboard appears empty until VPC Service Controlslogs new violations and routes these logs to the new log bucket.

  • If you select an existing log bucket while setting up the violation dashboard,the dashboard displays information about all existing logs from the selected logbucket. The dashboard doesn't display logs from other projects within yourorganization because VPC Service Controls doesn't backfill these logs intothe selected log bucket.

What's next

• VPC Service Controls audit logging
• Learn how todiagnose an access denial in violation analyzer and view its comprehensive evaluation report.
• Diagnose an access denial and view the classic report
• Troubleshoot common VPC Service Controls issues with Google Cloud services