VPC Service Controls は、Google Cloud リソースの周囲にサービス境界を設定し、データ転送境界を作成できる Google Cloud の機能です。VPC Service Controls を使用すると、データ漏洩のリスクを軽減するなど、App Hub リソースのセキュリティが強化されます。VPC Service Controls を使用すると、境界を越えるリクエストからアプリケーション、サービス、ワークロードを保護するサービス境界にプロジェクトを追加できます。
App Hub リソースは apphub.googleapis.com API で公開されており、アプリケーション、サービス、ワークロードの作成や削除などのオペレーションを実行できます。App Hub で VPC Service Controls を設定するには、この API サーフェスへの接続を制限します。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2024-12-18 UTC。"],[[["\u003cp\u003eVPC Service Controls enhances security for Google Cloud resources by establishing a service perimeter and a data transfer boundary, reducing the risk of data exfiltration.\u003c/p\u003e\n"],["\u003cp\u003eApp Hub resources, accessible through the \u003ccode\u003eapphub.googleapis.com\u003c/code\u003e API, can be secured using VPC Service Controls by limiting connectivity to this API.\u003c/p\u003e\n"],["\u003cp\u003eProtecting all App Hub resources within a service perimeter is a recommended practice.\u003c/p\u003e\n"],["\u003cp\u003eVPC Service Controls must be configured on the App Hub host and service projects prior to creating applications and registering services/workloads.\u003c/p\u003e\n"],["\u003cp\u003eApp Hub allows different resource types such as Applications, Discovered Services, Discovered Workloads, Services, Service Project Attachments and Workloads.\u003c/p\u003e\n"]]],[],null,["# Using VPC Service Controls with App Hub\n\nVPC Service Controls is a Google Cloud feature that lets you set up a\n[service perimeter](/vpc-service-controls/docs/service-perimeters) that creates a data transfer boundary around\nGoogle Cloud resources. VPC Service Controls provides more security for\nyour App Hub resources such as mitigating the risk of data\nexfiltration. Using VPC Service Controls, you can add projects to service\nperimeters that protect applications, services, and workloads from requests that\ncross the perimeter.\n\nApp Hub resources are exposed on the\n`apphub.googleapis.com` API, which lets you perform\noperations, such as creation and deletion of applications, services, and\nworkloads. You can set up VPC Service Controls with App Hub\nby restricting connectivity to this API surface.\n\nWe recommend that you protect all App Hub resources when creating a\nservice perimeter.\n\nApp Hub supports the following resource types:\n\n- Application\n- Discovered service\n- Discovered workload\n- Service\n- Service project attachment (only for applications managed by a host project)\n- Workload\n\nApplications in an app-enabled folder\n-------------------------------------\n\nWhen you [enable application management](/resource-manager/docs/manage-applications) on a folder, the\nfollowing actions occur:\n\n1. Google creates a Google-managed project in the folder called a *management project*.\n2. The system enables the required APIs for application management on that project. Some APIs that the system enables are directly related to application management. The remaining APIs are dependencies.\n\nIf you want to include the management project in a service perimeter, include\nthe enabled APIs that support VPC Service Controls. For more information,\nsee [Create a service perimeter](/vpc-service-controls/docs/create-service-perimeters).\n\n### APIs enabled on a management project\n\nThe following tables list APIs that are automatically enabled for a management\nproject. If a product supports VPC Service Controls, review the linked\ndocumentation for more information, such as limitations or additional\nconfiguration requirements.\n\n**APIs involved in designing, building, and deploying applications**\n\nAPIs in this table include App Hub, Application Design Center,\nand dependencies used to build applications, deploy applications, and store\napplication data.\n\nResource Manager is required for enabling and managing app-enabled folders.\n\n**Google Cloud Observability APIs**\n\n**Google Cloud Observability dependencies**\n\nSome Logging and Cloud Monitoring features require other\nproduct APIs.\n\nThe Dataform API and Dataplex API are BigQuery\ndependencies.\n\n**APIs that provide resource data about resources**\n\n**Gemini Cloud Assist**\n\nApplications managed by a host project\n--------------------------------------\n\nYou must set up VPC Service Controls on the App Hub host and\nservice projects before you create an application and register services and\nworkloads to the application. For more information, see\n[Create a service perimeter](/vpc-service-controls/docs/create-service-perimeters).\n\nWhat's next\n-----------\n\n- To learn more about VPC Service Controls, see the\n [overview](/vpc-service-controls/docs/overview) and\n [supported products and limitations](/vpc-service-controls/docs/supported-products).\n\n- For best practices for enabling VPC Service Controls, see\n [Best practices for enabling VPC Service Controls](/vpc-service-controls/docs/enable).\n\n- For best practices for designing service perimeters, see\n [Design and architect service perimeters](/vpc-service-controls/docs/architect-perimeters).\n\n- To set up a service perimeter, see\n [Create a service perimeter](/vpc-service-controls/docs/create-service-perimeters)."]]
