借助 VPC Service Controls，您可以定义 Application Integration Google Cloud 服务的安全边界。借助服务的安全边界，您可以将数据限制在某个 VPC 的范围内并降低数据渗漏风险。如果您尚不熟悉 VPC Service Controls，建议您浏览以下信息：
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-03。"],[[["\u003cp\u003eVPC Service Controls allows you to establish a security perimeter around the Application Integration Google Cloud service to confine data within a VPC and reduce data exfiltration risks.\u003c/p\u003e\n"],["\u003cp\u003eSetting up a VPC service perimeter for Application Integration involves using the Google Cloud console, \u003ccode\u003egcloud\u003c/code\u003e command, or the \u003ccode\u003eaccessPolicies.servicePerimeters.create\u003c/code\u003e API, and requires appropriate permissions.\u003c/p\u003e\n"],["\u003cp\u003eOnce the service perimeter is in place, you can configure ingress and egress policies to regulate access between Application Integration and other Google Cloud services.\u003c/p\u003e\n"],["\u003cp\u003eCertain integration tasks, including Apps Script, Call REST Endpoint, Cloud Function, and Send Email tasks, cannot be utilized if a VPC service perimeter is active for the Application Integration service.\u003c/p\u003e\n"],["\u003cp\u003eVerifying your VPC perimeter involves using the \u003ccode\u003egcloud access-context-manager perimeters describe\u003c/code\u003e command.\u003c/p\u003e\n"]]],[],null,["# Set up VPC Service Controls for Application Integration\n\nSee the [supported connectors](/integration-connectors/docs/connector-reference-overview) for Application Integration.\n\nSet up VPC Service Controls for Application Integration\n=======================================================\n\n\nVPC Service Controls lets you define a security perimeter around\nthe Application Integration Google Cloud service. With the security\nperimeter around your service, you can constrain data within a VPC and\nmitigate data exfiltration risks. If you are not already familiar\nwith VPC Service Controls, it is recommended that you go\nthrough the following information:\n\n- [Overview of VPC Service Controls](/vpc-service-controls/docs/overview)\n- [Service perimeter details and configuration](/vpc-service-controls/docs/service-perimeters)\n- [Grant access to VPC Service Controls](/vpc-service-controls/docs/access-control)\n\n\nThis document describes how to set up a VPC Service Controls perimeter for the\nApplication Integration service. After you have set up the perimeter,\nyou can configure egress and ingress policies that determine what other\nGoogle Cloud services can access the Application Integration service (integrations.googleapis.com) and\nconversely what services the Application Integration service can access.\n\nBefore you begin\n----------------\n\nEnsure that you have the required permissions to configure service perimeters.\nTo view a list of IAM roles required to configure VPC Service Controls,\nsee [Access control with IAM](/vpc-service-controls/docs/access-control) in the\nVPC Service Controls documentation.\n\nCreate a VPC service perimeter\n------------------------------\n\n\nTo create a VPC service perimeter you can use either the `Google Cloud console`,\nor the `gcloud` command, or the [`accessPolicies.servicePerimeters.create`](/access-context-manager/docs/reference/rest/v1/accessPolicies.servicePerimeters/create) API.\nFor more information, see [Create a service perimeter](/vpc-service-controls/docs/create-service-perimeters#create-perimeter).\nTo create a VPC Service Controls perimeter provide access to the user by using the `gcloud` commands, run the following command:\n\n```\ngcloud access-context-manager perimeters create \\\n --title=PERIMETER_TITLE \\\n --resources=projects/PROJECT_ID \\\n --restricted-services=integrations.googleapis.com \\\n```\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePERIMETER_TITLE\u003c/var\u003e: the name of the VPC Service Controls perimeter\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the project for which you want to add the VPC Service Controls perimeter\n\n\nThe preceding command takes some time to complete.\nThe VPC Service Controls perimeter restricts integration services for your project when using the Application Integration services.\n\n\nTo allow any IP addresses, service accounts, or users to use Application Integration, use the [ingress and egress rules](/vpc-service-controls/docs/ingress-egress-rules). VPC Service Controls uses ingress and egress rules to allow access to and from the resources and clients protected by service perimeters.\n\n### Add egress policy to an existing service perimeter\n\nTo add an egress policy to an existing service perimeter,\nuse the [gcloud access-context-manager\nperimeters update](/sdk/gcloud/reference/access-context-manager/perimeters/update) command. For example, the following command adds an egress policy defined\nin the `vpcsc-egress.yaml` file to an existing service perimeter named `integrationPerimeter`: \n\n```bash\ngcloud access-context-manager perimeters update integrationPerimeter\n --set-egress-policies=vpcsc-egress.yaml\n```\n\n\nSimilar to an egress policy, you can also define an ingress policy. To learn more about\nspecifying ingress rules, see [Ingress rules reference](/vpc-service-controls/docs/ingress-egress-rules#ingress-rules-reference).\n\nVerify your perimeter\n---------------------\n\n\nTo verify the perimeter, use the [gcloud access-context-manager perimeters describe \u003cvar translate=\"no\"\u003ePERIMETER_NAME\u003c/var\u003e](/sdk/gcloud/reference/access-context-manager/perimeters/describe)\ncommand. For example, the following command describes the `integrationPerimeter` perimeter: \n\n```bash\ngcloud access-context-manager perimeters describe integrationPerimeter\n```\n\n\nFor more information about managing service perimeters,\nsee [Managing service perimeters](/vpc-service-controls/docs/manage-service-perimeters#list-and-describe).\n\nConsiderations\n--------------\n\nIf you have enabled VPC service perimeter for the Application Integration service, you\nwill not be able to use the following tasks in your integrations:\n\n- [Apps Script task](/application-integration/docs/run-apps-script-task)\n- [Call REST Endpoint task](/application-integration/docs/call-rest-endpoint-task)\n- [Cloud function task](/application-integration/docs/run-cloud-function-task)\n- [Send email task](/application-integration/docs/send-email-task)\n\nWhat's next\n-----------\n\nLearn how [VPC Service Controls](/vpc-service-controls/docs/overview) protects your data."]]
