VPC 네트워크의 프록시 서버를 사용하여 공개 인터넷의 PyPI 저장소에 연결합니다. Cloud Storage 버킷의 /config/pip/pip.conf 파일에 프록시 주소를 지정합니다.
보안 정책이 외부 IP 주소에서 VPC 네트워크에 액세스할 수 있도록 허용하는 경우 Cloud NAT를 구성할 수 있습니다.
Cloud Storage 버킷에서 dags 폴더에 Python 종속 항목을 저장하여 이를 로컬 바이너리로 설치합니다.
종속 항목 트리가 클 때는 좋은 방법이 아닐 수 있습니다.
Cloud Composer 로그의 위치 제한
Cloud Composer 로그에 민감한 정보가 포함된 경우 Cloud Composer 로그를 리전별 Cloud Storage 버킷으로 리디렉션해야 할 수 있습니다. 이렇게 하려면 로그 싱크를 사용합니다. 로그를 Cloud Storage 버킷으로 리디렉션한 후에는 로그가 Cloud Logging으로 전송되지 않습니다.
BUCKET_NAME을 버킷 이름으로 대체합니다. 예를 들면 composer-logs-us-central1-example-environment입니다.
새 로그 싱크를 만듭니다.
gcloudloggingsinkscreate\
composer-log-sink-ENVIRONMENT_NAME\
storage.googleapis.com/BUCKET_NAME\
--log-filter"resource.type=cloud_composer_environment AND \resource.labels.environment_name=ENVIRONMENT_NAME AND \resource.labels.location=LOCATION"
다음과 같이 바꿉니다.
ENVIRONMENT_NAME을 환경 이름으로 바꿉니다.
BUCKET_NAME을 버킷 이름으로 대체합니다.
LOCATION을 환경이 위치한 리전으로 바꿉니다.
이전 명령어의 결과에 서비스 계정 번호가 포함됩니다. 이 서비스 계정에 스토리지 객체 생성자 역할을 부여합니다.
SA_NUMBER를 이전 단계에서 gcloud logging sinks create 명령어로 제공된 서비스 계정 번호로 바꿉니다.
Logging에서 환경의 로그를 제외합니다.
gcloudloggingsinksupdate_Default\
--add-exclusionname=ENVIRONMENT_NAME-exclusion,filter=\"resource.type=cloud_composer_environment AND \resource.labels.environment_name=ENVIRONMENT_NAME AND \resource.labels.location=LOCATION"
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-08-29(UTC)"],[[["\u003cp\u003eCloud Composer environments' location restrictions are managed through organizational policies applied to the project, either directly or inherited.\u003c/p\u003e\n"],["\u003cp\u003eCreating environments in a region is only allowed if the entire region is listed in the policy's "Allow" list or not listed in the "Deny" list.\u003c/p\u003e\n"],["\u003cp\u003eWhen location restrictions prevent the use of the \u003ccode\u003eUS\u003c/code\u003e multi-region, Cloud Build cannot be utilized, therefore requiring alternative methods such as private PyPI repositories, proxy servers, or local libraries for installing Python dependencies in Private IP environments.\u003c/p\u003e\n"],["\u003cp\u003eCloud Composer logs, if containing sensitive information, can be redirected to a regional Cloud Storage bucket using a log sink, which will stop the logs from being sent to Cloud Logging.\u003c/p\u003e\n"]]],[],null,["\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\n[Cloud Composer 3](/composer/docs/composer-3/configure-resource-location-restrictions \"View this page for Cloud Composer 3\") \\| [Cloud Composer 2](/composer/docs/composer-2/configure-resource-location-restrictions \"View this page for Cloud Composer 2\") \\| **Cloud Composer 1**\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\nThis page shows how to configure\n[resource location restrictions](/resource-manager/docs/organization-policy/defining-locations)\nso that your data stored by Cloud Composer is kept within\nthe locations you specify.\n\nHow location restrictions work\n\nLocation restrictions for Cloud Composer are determined based\non the organizational policy that is applied to the project where\nthe Cloud Composer environment is created. This policy is assigned\neither within the project or is inherited from the organization.\n\nWith location restrictions enabled, it is not possible to create\nan environment in a region that is prohibited by the policy. If a region\nis listed in the Deny list, or is not listed in the Allow list, then you\ncannot create environments in this region.\n\nTo enable the creation of environments, the policy must allow the whole region\nand not a specific zone within this region. For example, the `europe-west3`\nregion must be allowed by the policy in order to create\nCloud Composer environments in this region.\n\nCloud Composer checks location restrictions at:\n\n- Environment creation.\n- Environment upgrade, if any additional resources are created during the operation.\n- Environment update, for older environments that do not enforce location restrictions on Cloud Composer dependencies.\n\nIn addition to checking the location restrictions, Cloud Composer\ndoes the following:\n\n- Stores user-customized Airflow images in regional Artifact Registry repositories. As an example, such images are created when you install custom PyPI images in your environment.\n- If the [`US` multi-region](/storage/docs/locations#location-mr) is explicitly prohibited by the policy, Cloud Build use is disabled. In this case, user-customized Airflow images are built in your environment's cluster.\n\nInstall a Python dependency to a private IP environment with resource location restrictions\n\nIf you set resource location restrictions for your project, then\nCloud Build can't be used to install Python packages. As a consequence,\ndirect access to repositories on the public internet is disabled.\n\nTo install Python dependencies in a Private IP environment when your\nlocation restrictions don't allow the [`US` multi-region](/storage/docs/locations#location-mr), use\none of the following options:\n\n- Use a private\n [PyPI repository hosted in your VPC network](/composer/docs/composer-1/install-python-dependencies#install-private-repo).\n\n- Use a\n [proxy server](https://pip.pypa.io/en/stable/user_guide/#using-a-proxy-server)\n in your VPC network to connect to a PyPI repository on the public\n internet. Specify the proxy address in the `/config/pip/pip.conf` file in\n the Cloud Storage bucket.\n\n- If your security policy permits access to your VPC network from external\n IP addresses, you can configure [Cloud NAT](/nat/docs/overview).\n\n- Store the Python dependencies in the `dags` folder in\n the Cloud Storage bucket, to\n [install them as local libraries](/composer/docs/composer-1/install-python-dependencies#install-local).\n This might not be a good option if the dependency tree is large.\n\nRestrict locations for Cloud Composer logs\n\nIf your Cloud Composer logs contain sensitive data, you might want\nto redirect Cloud Composer logs to a regional\nCloud Storage bucket. To do so, use\na [log sink](/logging/docs/export/configure_export_v2). After you redirect logs to\na Cloud Storage bucket, your logs are not sent to Cloud Logging.\n**Caution:** To get support from Cloud Customer Care, you might need to grant Google support engineers access to the Cloud Composer logs stored in Cloud Storage. \n\ngcloud\n\n1. Create a new Cloud Storage bucket.\n\n gcloud storage buckets create gs://\u003cvar translate=\"no\"\u003eBUCKET_NAME\u003c/var\u003e --location=\u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e\n\n Replace:\n - `LOCATION` with the region where the environment is located.\n - `BUCKET_NAME` with the name of the bucket. For example, `composer-logs-us-central1-example-environment`.\n2. Create a new log sink.\n\n gcloud logging sinks create \\\n composer-log-sink-\u003cvar translate=\"no\"\u003eENVIRONMENT_NAME\u003c/var\u003e \\\n storage.googleapis.com/\u003cvar translate=\"no\"\u003eBUCKET_NAME\u003c/var\u003e \\\n --log-filter \"resource.type=cloud_composer_environment AND \\\n resource.labels.environment_name=\u003cvar translate=\"no\"\u003eENVIRONMENT_NAME\u003c/var\u003e AND \\\n resource.labels.location=\u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e\"\n\n Replace:\n - `ENVIRONMENT_NAME` with the name of the environment.\n - `BUCKET_NAME` with the name of the bucket.\n - `LOCATION` with the region where the environment is located.\n3. The output of the previous command contains the service\n account number. Grant the **Storage Object Creator** role to this\n service account:\n\n gcloud projects add-iam-policy-binding \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e \\\n --member=\"serviceAccount:\u003cvar translate=\"no\"\u003eSA_NUMBER\u003c/var\u003e@gcp-sa-logging.iam.gserviceaccount.com\" \\\n --role='roles/storage.objectCreator' \\\n --condition=None\n\n Replace:\n - `PROJECT_ID` with the [Project ID](/resource-manager/docs/creating-managing-projects).\n - `SA_NUMBER` with the service account number provided by the `gcloud logging sinks create` command on the previous step.\n4. Exclude the logs for your environment from Logging.\n\n **Caution:** [Audit logs](/logging/docs/audit) cannot be excluded. They are always sent to the default storage. \n\n gcloud logging sinks update _Default \\\n --add-exclusion name=\u003cvar translate=\"no\"\u003eENVIRONMENT_NAME\u003c/var\u003e-exclusion,filter=\\\n \"resource.type=cloud_composer_environment AND \\\n resource.labels.environment_name=\u003cvar translate=\"no\"\u003eENVIRONMENT_NAME\u003c/var\u003e AND \\\n resource.labels.location=\u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e\"\n\n Replace:\n - `ENVIRONMENT_NAME` with the name of the environment.\n - `LOCATION` with the region where the environment is located.\n\nWhat's next\n\n- [Cloud Composer security overview](/composer/docs/composer-1/composer-security-overview)\n- [Access control](/composer/docs/composer-1/access-control)"]]
