Assured Workloads 可協助您遵守各種法規遵循架構，方法是導入邏輯控管機制，將網路和使用者與範圍內的機密資料加以區隔。許多美國法規遵循架構都是以 NIST SP 800-53 修訂版 5 為基礎，但會根據資訊敏感度和架構的管理機構，制定各自的特定控管機制。如果客戶必須遵守 FedRAMP 高等風險或 DoD IL4 規範，建議您使用 VPC Service Controls 為受管制環境建立強大邊界。
VPC Service Controls 可為 Google Cloud服務提供 Identity and Access Management (IAM) 以外的另一層防護。Identity and Access Management 提供精細的身分式存取權控管功能，VPC Service Controls 則提供較廣泛的情境式範圍安全防護，例如控管跨範圍的資料輸入和輸出作業。控制項 VPC Service Controls 是圍繞 Google Cloud API 的邏輯邊界，這些 API 會在機構層級管理，並在專案層級套用及強制執行。如要概略瞭解 VPC Service Controls 的優點和設定階段，請參閱 VPC Service Controls 總覽。如要進一步瞭解法規指南，請參閱「控制項 ID SC-7」。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eVPC Service Controls provide an additional security layer for Google Cloud services, independent of Identity and Access Management (IAM), by enabling context-based perimeter security.\u003c/p\u003e\n"],["\u003cp\u003eAssured Workloads helps users comply with regulatory frameworks, such as FedRAMP High and DoD IL4, by implementing controls that segment sensitive data, and VPC Service Controls is recommended to create a strong boundary around these regulated environments.\u003c/p\u003e\n"],["\u003cp\u003eVPC Service Controls manages a logical boundary around Google Cloud APIs at the organization level and enforces them at the project level, with the ability to control data ingress and egress across the perimeter.\u003c/p\u003e\n"],["\u003cp\u003eConfiguring VPC Service Controls can be done via the Google Cloud console, gcloud CLI, or Access Context Manager APIs, with the recommendation to initially use the Dry run mode to test new or updated service perimeters.\u003c/p\u003e\n"],["\u003cp\u003eService perimeters can be configured to include specific projects and services, and to further restrict communication between services within the perimeter through VPC Accessible Services, as well as through ingress and egress policies.\u003c/p\u003e\n"]]],[],null,["# Configure VPC Service Controls for Assured Workloads\n====================================================\n\nOverview\n--------\n\nAssured Workloads helps you comply with different regulatory compliance\nframeworks by implementing logical controls that segment networks and users from\nin-scope sensitive data. Many of the US compliance frameworks are built upon\n[NIST SP 800-53 Rev. 5](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final),\nbut have their own particular controls based on the sensitivity of the\ninformation and the framework's governing body. For customers who must comply\nwith [FedRAMP High](/assured-workloads/docs/control-packages#fedramp-high)\nor [DoD IL4](/assured-workloads/docs/control-packages#il4), we\nrecommend that you use VPC Service Controls to create a strong boundary around\nthe regulated environment.\n\nVPC Service Controls provides an extra layer of security defense for Google Cloud\nservices that is independent of Identity and Access Management (IAM). While\nIdentity and Access Management enables granular identity-based access control, VPC Service Controls\nenables broader context-based perimeter security, such as controlling data\ningress and egress across the perimeter. The controls VPC Service Controls are a\nlogical boundary around Google Cloud APIs that are managed at the\n[organization level](/resource-manager/docs/cloud-platform-resource-hierarchy#organizations)\nand applied and enforced at the\n[project level](/resource-manager/docs/cloud-platform-resource-hierarchy#projects).\nFor a high-level overview of VPC Service Controls benefits and configuration\nstages, please see the\n[VPC Service Controls overview](/vpc-service-controls/docs/overview#benefits). For\nmore information about the regulatory guidance, see\n[Control ID SC-7](https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/control?version=5.1&number=SC-7).\n\nBefore you begin\n----------------\n\n- Ensure that you've read and understand the purpose and usage of [VPC Service Controls](/vpc-service-controls/docs/overview) and its [service perimeters](/vpc-service-controls/docs/service-perimeters).\n- Read about how access control in [VPC Service Controls works with IAM](/vpc-service-controls/docs/access-control).\n- If you want to configure external access to your protected services when you create your perimeter, first [create one or more access levels](/access-context-manager/docs/create-access-level) before you create the perimeter.\n- Ensure that the Google Cloud services and their resources are [in scope for IL4](/security/compliance/disa) or [in scope for FedRAMP High](/security/compliance/fedramp) and are [supported by VPC Service Controls](/vpc-service-controls/docs/supported-products).\n\nConfigure VPC Service Controls for Assured Workloads\n----------------------------------------------------\n\nTo configure VPC Service Controls, you can use the Google Cloud console, the\nGoogle Cloud CLI (gcloud CLI), or the\n[Access Context Manager APIs](/access-context-manager/docs/reference/rest). The\nfollowing steps show you how to use the Google Cloud console. \n\n### Console\n\n1. In the Google Cloud console navigation menu, click **Security** , and then\n click **VPC Service Controls**.\n\n [Go to the VPC Service Controls page](https://console.cloud.google.com/security/service-perimeter)\n2. If you are prompted, select your organization, folder, or project.\n\n3. On the **VPC Service Controls** page, select the *Dry run mode* . While you\n can create in either a *Dry run mode* or an *Enforced mode* , we recommend\n using the *Dry run mode* first for either a new or updated service\n perimeter. *Dry run mode* will also allow you to create a test run of your\n new service perimeter to see how it performs before you choose to enforce\n it within your environment.\n\n4. Click **New perimeter**.\n\n5. On the **New VPC Service Perimeter** page, in the **Perimeter Name** box,\n type a name for the perimeter.\n\n6. In the **Details** tab, select the desired perimeter type and configuration\n type.\n\n7. In the **Projects** tab, select the projects that you want to include\n within the service perimeter boundary. For your IL4 workloads, these should\n be the projects that are within your Assured Workloads IL4 folder.\n\n | **Note:** At this time, you can only select projects (and not folders) when setting up a service perimeter.\n8. In the **Restricted Services** tab, add services to include within the\n service perimeter boundary. You should only select services that are in\n scope for your Assured Workloads folder.\n\n9. (Optional) In the **VPC Accessible Services** tab, you can further restrict\n services within your service perimeter from communicating with each other.\n Assured Workloads will implement\n [Service Usage Restrictions](/assured-workloads/docs/restrict-resource-usage)\n as a guardrail to ensure that services scoped to Assured Workloads\n can be deployed within your Assured Workloads folder. If you have\n overridden these controls, then you may need to implement\n *VPC Accessible Services* to restrict non-Assured Workloads\n services from communicating with your workloads.\n\n10. Click **Ingress Policy** to set one or more rules that specify the\n direction of allowed access from different identities and resources.\n [Access levels](/vpc-service-controls/docs/use-access-levels) only apply\n to requests for protected resources coming from outside the service\n perimeter. Access levels cannot be used to permit protected resources or\n VMs to access data and services outside the perimeter. You can to assign\n an identity different service methods to specific services in order to\n transfer regulated data into your workload's service perimeter.\n\n11. (Optional) Click **Egress Policy** to set one or more rules that specify\n the direction of allowed access to different identities and resources.\n [Access levels](/vpc-service-controls/docs/use-access-levels) only apply to\n requests from protected resources to services outside the service\n perimeter.\n\n12. Click **Save**.\n\nUse VPC Service Controls with Terraform\n---------------------------------------\n\nYou can use the Terraform to synchronize your Assured Workloads folder\nwith a VPC Service Controls permit if you want your Assured Workloads\nregulated boundary to be aligned with your VPC Service Controls boundary. For more\ninformation, see the\n[Automatically Secured Folder Terraform example on GitHub](https://github.com/terraform-google-modules/terraform-google-vpc-service-controls/tree/master/examples/automatic_folder).\n\nWhat's next\n-----------\n\n- Learn about the [FedRAMP High control package](/assured-workloads/docs/control-packages#fedramp-high).\n- Learn about the [IL4 control package](/assured-workloads/docs/control-packages#il4)."]]
