VPC 서비스 제어는 서비스 경계를 설정하고 Google Cloud 리소스 주위에 데이터 전송 경계를 만들 수 있는 Google Cloud 기능입니다. VPC 서비스 제어는 데이터 무단 반출 위험 완화와 같이 App Hub 리소스에 대한 더 많은 보안을 제공합니다. VPC 서비스 제어를 사용하면 서비스 경계에 프로젝트를 추가하여 경계를 넘는 요청으로부터 애플리케이션, 서비스, 워크로드를 보호할 수 있습니다.
App Hub 리소스는 애플리케이션, 서비스, 워크로드의 생성 및 삭제와 같은 작업을 수행할 수 있도록 apphub.googleapis.com API에 노출됩니다. 이 API 표면에 대한 연결을 제한하여 App Hub로 VPC 서비스 제어를 설정할 수 있습니다.
서비스 경계를 만들 때 모든 App Hub 리소스를 보호하는 것이 좋습니다.
제한사항
애플리케이션을 만들고 서비스 및 워크로드를 애플리케이션에 등록하기 전에 App Hub 호스트 및 서비스 프로젝트에서 VPC 서비스 제어를 설정해야 합니다.
App Hub는 다음 리소스 유형을 지원합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2024-12-18(UTC)"],[[["\u003cp\u003eVPC Service Controls enhances security for Google Cloud resources by establishing a service perimeter and a data transfer boundary, reducing the risk of data exfiltration.\u003c/p\u003e\n"],["\u003cp\u003eApp Hub resources, accessible through the \u003ccode\u003eapphub.googleapis.com\u003c/code\u003e API, can be secured using VPC Service Controls by limiting connectivity to this API.\u003c/p\u003e\n"],["\u003cp\u003eProtecting all App Hub resources within a service perimeter is a recommended practice.\u003c/p\u003e\n"],["\u003cp\u003eVPC Service Controls must be configured on the App Hub host and service projects prior to creating applications and registering services/workloads.\u003c/p\u003e\n"],["\u003cp\u003eApp Hub allows different resource types such as Applications, Discovered Services, Discovered Workloads, Services, Service Project Attachments and Workloads.\u003c/p\u003e\n"]]],[],null,["# Using VPC Service Controls with App Hub\n\nVPC Service Controls is a Google Cloud feature that lets you set up a\n[service perimeter](/vpc-service-controls/docs/service-perimeters) that creates a data transfer boundary around\nGoogle Cloud resources. VPC Service Controls provides more security for\nyour App Hub resources such as mitigating the risk of data\nexfiltration. Using VPC Service Controls, you can add projects to service\nperimeters that protect applications, services, and workloads from requests that\ncross the perimeter.\n\nApp Hub resources are exposed on the\n`apphub.googleapis.com` API, which lets you perform\noperations, such as creation and deletion of applications, services, and\nworkloads. You can set up VPC Service Controls with App Hub\nby restricting connectivity to this API surface.\n\nWe recommend that you protect all App Hub resources when creating a\nservice perimeter.\n\nApp Hub supports the following resource types:\n\n- Application\n- Discovered service\n- Discovered workload\n- Service\n- Service project attachment (only for applications managed by a host project)\n- Workload\n\nApplications in an app-enabled folder\n-------------------------------------\n\nWhen you [enable application management](/resource-manager/docs/manage-applications) on a folder, the\nfollowing actions occur:\n\n1. Google creates a Google-managed project in the folder called a *management project*.\n2. The system enables the required APIs for application management on that project. Some APIs that the system enables are directly related to application management. The remaining APIs are dependencies.\n\nIf you want to include the management project in a service perimeter, include\nthe enabled APIs that support VPC Service Controls. For more information,\nsee [Create a service perimeter](/vpc-service-controls/docs/create-service-perimeters).\n\n### APIs enabled on a management project\n\nThe following tables list APIs that are automatically enabled for a management\nproject. If a product supports VPC Service Controls, review the linked\ndocumentation for more information, such as limitations or additional\nconfiguration requirements.\n\n**APIs involved in designing, building, and deploying applications**\n\nAPIs in this table include App Hub, Application Design Center,\nand dependencies used to build applications, deploy applications, and store\napplication data.\n\nResource Manager is required for enabling and managing app-enabled folders.\n\n**Google Cloud Observability APIs**\n\n**Google Cloud Observability dependencies**\n\nSome Logging and Cloud Monitoring features require other\nproduct APIs.\n\nThe Dataform API and Dataplex API are BigQuery\ndependencies.\n\n**APIs that provide resource data about resources**\n\n**Gemini Cloud Assist**\n\nApplications managed by a host project\n--------------------------------------\n\nYou must set up VPC Service Controls on the App Hub host and\nservice projects before you create an application and register services and\nworkloads to the application. For more information, see\n[Create a service perimeter](/vpc-service-controls/docs/create-service-perimeters).\n\nWhat's next\n-----------\n\n- To learn more about VPC Service Controls, see the\n [overview](/vpc-service-controls/docs/overview) and\n [supported products and limitations](/vpc-service-controls/docs/supported-products).\n\n- For best practices for enabling VPC Service Controls, see\n [Best practices for enabling VPC Service Controls](/vpc-service-controls/docs/enable).\n\n- For best practices for designing service perimeters, see\n [Design and architect service perimeters](/vpc-service-controls/docs/architect-perimeters).\n\n- To set up a service perimeter, see\n [Create a service perimeter](/vpc-service-controls/docs/create-service-perimeters)."]]
