VPC 서비스 제어를 사용하면 Application Integration Google Cloud 서비스 주위에 보안 경계를 정의할 수 있습니다. 서비스 주위의 보안 경계를 사용하면 VPC 내의 데이터를 제한하고 데이터 무단 반출 위험을 완화할 수 있습니다. VPC 서비스 제어에 대해 익숙하지 않은 경우 다음 정보를 살펴보는 것이 좋습니다.
이 문서에서는 Application Integration 서비스의 VPC 서비스 제어 경계를 설정하는 방법을 설명합니다. 경계를 설정한 후 Application Integration 서비스에 액세스할 수 있는 다른 Google Cloud 서비스와 반대로 Application Integration 서비스(integrations.googleapis.com)가 액세스할 수 있는 서비스를 결정하는 이그레스 및 인그레스 정책을 구성할 수 있습니다.
시작하기 전에
서비스 경계를 구성하는 데 필요한 권한이 있는지 확인합니다.
VPC 서비스 제어를 구성하는 데 필요한 IAM 역할 목록을 보려면 VPC 서비스 제어 문서의 IAM으로 액세스 제어를 참조하세요.
VPC 서비스 경계 만들기
VPC 서비스 경계를 만들기 위해 Google Cloud console, gcloud 명령어 또는 accessPolicies.servicePerimeters.create API를 사용할 수 있습니다.
자세한 내용은 서비스 경계 만들기를 참조하세요.
gcloud 명령어를 사용하여 사용자에게 액세스 권한을 제공하는 VPC 서비스 제어 경계를 만들려면 다음 명령어를 실행합니다.
위 명령어를 완료하는 데 다소 시간이 걸립니다.
VPC 서비스 제어 경계는 Application Integration 서비스를 사용할 때 프로젝트의 통합 서비스를 제한합니다.
모든 IP 주소, 서비스 계정 또는 사용자가 Application Integration을 사용하도록 허용하려면 인그레스 및 이그레스 규칙을 사용합니다. VPC 서비스 제어는 인그레스 규칙과 이그레스 규칙을 사용하여 서비스 경계로 보호되는 리소스와 클라이언트의 액세스를 허용합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[[["\u003cp\u003eVPC Service Controls allows you to establish a security perimeter around the Application Integration Google Cloud service to confine data within a VPC and reduce data exfiltration risks.\u003c/p\u003e\n"],["\u003cp\u003eSetting up a VPC service perimeter for Application Integration involves using the Google Cloud console, \u003ccode\u003egcloud\u003c/code\u003e command, or the \u003ccode\u003eaccessPolicies.servicePerimeters.create\u003c/code\u003e API, and requires appropriate permissions.\u003c/p\u003e\n"],["\u003cp\u003eOnce the service perimeter is in place, you can configure ingress and egress policies to regulate access between Application Integration and other Google Cloud services.\u003c/p\u003e\n"],["\u003cp\u003eCertain integration tasks, including Apps Script, Call REST Endpoint, Cloud Function, and Send Email tasks, cannot be utilized if a VPC service perimeter is active for the Application Integration service.\u003c/p\u003e\n"],["\u003cp\u003eVerifying your VPC perimeter involves using the \u003ccode\u003egcloud access-context-manager perimeters describe\u003c/code\u003e command.\u003c/p\u003e\n"]]],[],null,["# Set up VPC Service Controls for Application Integration\n\nSee the [supported connectors](/integration-connectors/docs/connector-reference-overview) for Application Integration.\n\nSet up VPC Service Controls for Application Integration\n=======================================================\n\n\nVPC Service Controls lets you define a security perimeter around\nthe Application Integration Google Cloud service. With the security\nperimeter around your service, you can constrain data within a VPC and\nmitigate data exfiltration risks. If you are not already familiar\nwith VPC Service Controls, it is recommended that you go\nthrough the following information:\n\n- [Overview of VPC Service Controls](/vpc-service-controls/docs/overview)\n- [Service perimeter details and configuration](/vpc-service-controls/docs/service-perimeters)\n- [Grant access to VPC Service Controls](/vpc-service-controls/docs/access-control)\n\n\nThis document describes how to set up a VPC Service Controls perimeter for the\nApplication Integration service. After you have set up the perimeter,\nyou can configure egress and ingress policies that determine what other\nGoogle Cloud services can access the Application Integration service (integrations.googleapis.com) and\nconversely what services the Application Integration service can access.\n\nBefore you begin\n----------------\n\nEnsure that you have the required permissions to configure service perimeters.\nTo view a list of IAM roles required to configure VPC Service Controls,\nsee [Access control with IAM](/vpc-service-controls/docs/access-control) in the\nVPC Service Controls documentation.\n\nCreate a VPC service perimeter\n------------------------------\n\n\nTo create a VPC service perimeter you can use either the `Google Cloud console`,\nor the `gcloud` command, or the [`accessPolicies.servicePerimeters.create`](/access-context-manager/docs/reference/rest/v1/accessPolicies.servicePerimeters/create) API.\nFor more information, see [Create a service perimeter](/vpc-service-controls/docs/create-service-perimeters#create-perimeter).\nTo create a VPC Service Controls perimeter provide access to the user by using the `gcloud` commands, run the following command:\n\n```\ngcloud access-context-manager perimeters create \\\n --title=PERIMETER_TITLE \\\n --resources=projects/PROJECT_ID \\\n --restricted-services=integrations.googleapis.com \\\n```\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePERIMETER_TITLE\u003c/var\u003e: the name of the VPC Service Controls perimeter\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the project for which you want to add the VPC Service Controls perimeter\n\n\nThe preceding command takes some time to complete.\nThe VPC Service Controls perimeter restricts integration services for your project when using the Application Integration services.\n\n\nTo allow any IP addresses, service accounts, or users to use Application Integration, use the [ingress and egress rules](/vpc-service-controls/docs/ingress-egress-rules). VPC Service Controls uses ingress and egress rules to allow access to and from the resources and clients protected by service perimeters.\n\n### Add egress policy to an existing service perimeter\n\nTo add an egress policy to an existing service perimeter,\nuse the [gcloud access-context-manager\nperimeters update](/sdk/gcloud/reference/access-context-manager/perimeters/update) command. For example, the following command adds an egress policy defined\nin the `vpcsc-egress.yaml` file to an existing service perimeter named `integrationPerimeter`: \n\n```bash\ngcloud access-context-manager perimeters update integrationPerimeter\n --set-egress-policies=vpcsc-egress.yaml\n```\n\n\nSimilar to an egress policy, you can also define an ingress policy. To learn more about\nspecifying ingress rules, see [Ingress rules reference](/vpc-service-controls/docs/ingress-egress-rules#ingress-rules-reference).\n\nVerify your perimeter\n---------------------\n\n\nTo verify the perimeter, use the [gcloud access-context-manager perimeters describe \u003cvar translate=\"no\"\u003ePERIMETER_NAME\u003c/var\u003e](/sdk/gcloud/reference/access-context-manager/perimeters/describe)\ncommand. For example, the following command describes the `integrationPerimeter` perimeter: \n\n```bash\ngcloud access-context-manager perimeters describe integrationPerimeter\n```\n\n\nFor more information about managing service perimeters,\nsee [Managing service perimeters](/vpc-service-controls/docs/manage-service-perimeters#list-and-describe).\n\nConsiderations\n--------------\n\nIf you have enabled VPC service perimeter for the Application Integration service, you\nwill not be able to use the following tasks in your integrations:\n\n- [Apps Script task](/application-integration/docs/run-apps-script-task)\n- [Call REST Endpoint task](/application-integration/docs/call-rest-endpoint-task)\n- [Cloud function task](/application-integration/docs/run-cloud-function-task)\n- [Send email task](/application-integration/docs/send-email-task)\n\nWhat's next\n-----------\n\nLearn how [VPC Service Controls](/vpc-service-controls/docs/overview) protects your data."]]
