Application Integration 用の VPC Service Controls の設定
VPC Service Controls を使用すると、Application Integration の Google Cloud サービスの周囲にセキュリティ境界を定義できます。サービスの周囲にセキュリティ境界を設けることで、VPC 内のデータを制限し、データ漏洩のリスクを軽減できます。VPC Service Controls に精通していない場合は、次の情報を確認することをおすすめします。
上記のコマンドは完了するまでしばらく時間がかかります。VPC Service Controls の境界は、Application Integration サービスを使用しているときに、プロジェクトのインテグレーション サービスを制限します。
任意の IP アドレス、サービス アカウント、またはユーザーが Application Integration を使用できるようにするには、上り（内向き）ルールと下り（外向き）ルールを使用します。VPC Service Controls は、上り（内向き）ルールと下り（外向き）ルールを使用して、サービス境界で保護されたリソースとクライアントに関するアクセスを可能にします。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-06-16 UTC。"],[[["\u003cp\u003eVPC Service Controls allows you to establish a security perimeter around the Application Integration Google Cloud service to confine data within a VPC and reduce data exfiltration risks.\u003c/p\u003e\n"],["\u003cp\u003eSetting up a VPC service perimeter for Application Integration involves using the Google Cloud console, \u003ccode\u003egcloud\u003c/code\u003e command, or the \u003ccode\u003eaccessPolicies.servicePerimeters.create\u003c/code\u003e API, and requires appropriate permissions.\u003c/p\u003e\n"],["\u003cp\u003eOnce the service perimeter is in place, you can configure ingress and egress policies to regulate access between Application Integration and other Google Cloud services.\u003c/p\u003e\n"],["\u003cp\u003eCertain integration tasks, including Apps Script, Call REST Endpoint, Cloud Function, and Send Email tasks, cannot be utilized if a VPC service perimeter is active for the Application Integration service.\u003c/p\u003e\n"],["\u003cp\u003eVerifying your VPC perimeter involves using the \u003ccode\u003egcloud access-context-manager perimeters describe\u003c/code\u003e command.\u003c/p\u003e\n"]]],[],null,["# Set up VPC Service Controls for Application Integration\n\nSee the [supported connectors](/integration-connectors/docs/connector-reference-overview) for Application Integration.\n\nSet up VPC Service Controls for Application Integration\n=======================================================\n\n\nVPC Service Controls lets you define a security perimeter around\nthe Application Integration Google Cloud service. With the security\nperimeter around your service, you can constrain data within a VPC and\nmitigate data exfiltration risks. If you are not already familiar\nwith VPC Service Controls, it is recommended that you go\nthrough the following information:\n\n- [Overview of VPC Service Controls](/vpc-service-controls/docs/overview)\n- [Service perimeter details and configuration](/vpc-service-controls/docs/service-perimeters)\n- [Grant access to VPC Service Controls](/vpc-service-controls/docs/access-control)\n\n\nThis document describes how to set up a VPC Service Controls perimeter for the\nApplication Integration service. After you have set up the perimeter,\nyou can configure egress and ingress policies that determine what other\nGoogle Cloud services can access the Application Integration service (integrations.googleapis.com) and\nconversely what services the Application Integration service can access.\n\nBefore you begin\n----------------\n\nEnsure that you have the required permissions to configure service perimeters.\nTo view a list of IAM roles required to configure VPC Service Controls,\nsee [Access control with IAM](/vpc-service-controls/docs/access-control) in the\nVPC Service Controls documentation.\n\nCreate a VPC service perimeter\n------------------------------\n\n\nTo create a VPC service perimeter you can use either the `Google Cloud console`,\nor the `gcloud` command, or the [`accessPolicies.servicePerimeters.create`](/access-context-manager/docs/reference/rest/v1/accessPolicies.servicePerimeters/create) API.\nFor more information, see [Create a service perimeter](/vpc-service-controls/docs/create-service-perimeters#create-perimeter).\nTo create a VPC Service Controls perimeter provide access to the user by using the `gcloud` commands, run the following command:\n\n```\ngcloud access-context-manager perimeters create \\\n --title=PERIMETER_TITLE \\\n --resources=projects/PROJECT_ID \\\n --restricted-services=integrations.googleapis.com \\\n```\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePERIMETER_TITLE\u003c/var\u003e: the name of the VPC Service Controls perimeter\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the project for which you want to add the VPC Service Controls perimeter\n\n\nThe preceding command takes some time to complete.\nThe VPC Service Controls perimeter restricts integration services for your project when using the Application Integration services.\n\n\nTo allow any IP addresses, service accounts, or users to use Application Integration, use the [ingress and egress rules](/vpc-service-controls/docs/ingress-egress-rules). VPC Service Controls uses ingress and egress rules to allow access to and from the resources and clients protected by service perimeters.\n\n### Add egress policy to an existing service perimeter\n\nTo add an egress policy to an existing service perimeter,\nuse the [gcloud access-context-manager\nperimeters update](/sdk/gcloud/reference/access-context-manager/perimeters/update) command. For example, the following command adds an egress policy defined\nin the `vpcsc-egress.yaml` file to an existing service perimeter named `integrationPerimeter`: \n\n```bash\ngcloud access-context-manager perimeters update integrationPerimeter\n --set-egress-policies=vpcsc-egress.yaml\n```\n\n\nSimilar to an egress policy, you can also define an ingress policy. To learn more about\nspecifying ingress rules, see [Ingress rules reference](/vpc-service-controls/docs/ingress-egress-rules#ingress-rules-reference).\n\nVerify your perimeter\n---------------------\n\n\nTo verify the perimeter, use the [gcloud access-context-manager perimeters describe \u003cvar translate=\"no\"\u003ePERIMETER_NAME\u003c/var\u003e](/sdk/gcloud/reference/access-context-manager/perimeters/describe)\ncommand. For example, the following command describes the `integrationPerimeter` perimeter: \n\n```bash\ngcloud access-context-manager perimeters describe integrationPerimeter\n```\n\n\nFor more information about managing service perimeters,\nsee [Managing service perimeters](/vpc-service-controls/docs/manage-service-perimeters#list-and-describe).\n\nConsiderations\n--------------\n\nIf you have enabled VPC service perimeter for the Application Integration service, you\nwill not be able to use the following tasks in your integrations:\n\n- [Apps Script task](/application-integration/docs/run-apps-script-task)\n- [Call REST Endpoint task](/application-integration/docs/call-rest-endpoint-task)\n- [Cloud function task](/application-integration/docs/run-cloud-function-task)\n- [Send email task](/application-integration/docs/send-email-task)\n\nWhat's next\n-----------\n\nLearn how [VPC Service Controls](/vpc-service-controls/docs/overview) protects your data."]]
