如果您打算建立具備私人 IP 位址的 Cloud Data Fusion 執行個體，請先使用 VPC Service Controls (VPC-SC) 為執行個體建立安全邊界，以提供額外安全防護。在私人 Cloud Data Fusion 執行個體和其他 Google Cloud 資源周圍建立 VPC-SC 安全範圍，有助於降低資料竊取風險。舉例來說，如果使用 VPC Service Controls，當 Cloud Data Fusion 管道從位於安全範圍內的支援的資源 (例如 BigQuery 資料集) 讀取資料，然後嘗試將輸出內容寫入安全範圍外的資源，管道就會失敗。
Cloud Data Fusion 資源會公開在兩個 API 途徑：
datafusion.googleapis.com 控制層 API 介面，可讓您執行執行個體層級作業，例如建立及刪除執行個體。
datafusion.googleusercontent.com 資料層 API 介面 ( Google Cloud 控制台中的 Cloud Data Fusion Web UI)，會在 Cloud Data Fusion 執行個體上執行，以建立及執行資料管道。
您可以限制與這兩個 API 途徑的連線，藉此設定 Cloud Data Fusion 的 VPC Service Controls。
策略：
Cloud Data Fusion 管道會在 Dataproc 叢集中執行。如要使用服務範圍保護 Dataproc 叢集，請按照設定私人連線一文的指示操作，讓叢集可在範圍內運作。
在「Cloud DNS」頁面中，按一下 datafusiongoogleusercontent DNS 區域名稱，開啟「區域詳細資料」頁面。系統會列出兩個記錄：NS 和 SOA 記錄。使用「Add Standard」，將下列兩個記錄組新增至 datafusiongoogleusercontent DNS 區域。
新增 CNAME 記錄：在「Create record set」對話方塊中填入下列欄位，將 DNS 名稱 *.datafusion.googleusercontent.com. 對應至正規名稱 datafusion.googleusercontent.com：
DNS 名稱："*.datafusion.googleusercontent.com"
標準名稱：「datafusion.googleusercontent.com」
新增 A 記錄：在新的「Create record set」對話方塊中，填入下列欄位，將 DNS 名稱 datafusion.googleusercontent.com. 對應至 IP 位址 199.36.153.4 - 199.36.153.7：
DNS 名稱：".datafusion.googleusercontent.com"
IPv4 位址：
199.36.153.4
199.36.153.5
199.36.153.6
199.36.153.7
datafusiongoogleusercontent「可用區詳細資料」頁面會顯示下列記錄集：
請按照上述步驟建立私人 DNS 區域，並為 *.datafusion.cloud.google.com 網域新增記錄集。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eVPC Service Controls enhances security for private Cloud Data Fusion instances by creating a security perimeter to mitigate data exfiltration risks.\u003c/p\u003e\n"],["\u003cp\u003eTo utilize VPC Service Controls with Cloud Data Fusion, it is necessary to restrict connectivity to both the \u003ccode\u003edatafusion.googleapis.com\u003c/code\u003e control plane API surface and the \u003ccode\u003edatafusion.googleusercontent.com\u003c/code\u003e data plane API surface.\u003c/p\u003e\n"],["\u003cp\u003eCloud Data Fusion's service perimeter can be configured by setting up private connectivity for Dataproc clusters and avoiding unsupported plugins.\u003c/p\u003e\n"],["\u003cp\u003eSetting up VPC Service Controls for Cloud Data Fusion instances involves configuring DNS entries to point \u003ccode\u003edatafusion.googleapis.com\u003c/code\u003e, \u003ccode\u003e*.datafusion.googleusercontent.com\u003c/code\u003e, and \u003ccode\u003e*.datafusion.cloud.google.com\u003c/code\u003e domains to the restricted VIP.\u003c/p\u003e\n"],["\u003cp\u003eVPC Service Control perimeters should be established before creating a private Cloud Data Fusion instance, as protecting existing instances created before the perimeter is set up is unsupported.\u003c/p\u003e\n"]]],[],null,["# Use VPC Service Controls with Cloud Data Fusion\n\nIf you plan to create a [Cloud Data Fusion instance with a private IP address](/data-fusion/docs/how-to/create-private-ip),\nyou can provide additional security by first establishing a security perimeter\nfor the instance using [VPC Service Controls (VPC-SC)](/vpc-service-controls/docs/overview).\nThe VPC-SC security perimeter around the private\nCloud Data Fusion instance and other Google Cloud resources helps\nmitigate the risk of data exfiltration. For example, with\nVPC Service Controls, if a Cloud Data Fusion pipeline reads data\nfrom a [supported resource](/vpc-service-controls/docs/supported-products),\nsuch as a BigQuery dataset, located within the perimeter,\nthen tries to write the output to a resource outside the perimeter, the pipeline\nwill fail.\n\nCloud Data Fusion resources are exposed on two API surfaces:\n\n1. The `datafusion.googleapis.com` control plane API surface, which\n allows you to perform instance-level operations, such as the creation and\n deletion of instances.\n\n2. The `datafusion.googleusercontent.com` data plane API surface (the\n [Cloud Data Fusion Web UI](/data-fusion/docs/concepts/overview#using_the_code-free_web_ui)\n in the Google Cloud console), which executes on a Cloud Data Fusion\n instance to create and execute data pipelines.\n\nYou set up VPC Service Controls with Cloud Data Fusion by\nrestricting connectivity to both of these API surfaces.\n\nStrategies:\n\n- Cloud Data Fusion pipelines are executed on Dataproc clusters.\n To protect a Dataproc cluster with a service perimeter,\n follow the instructions for\n [setting up private connectivity](/vpc-service-controls/docs/set-up-private-connectivity)\n to allow the cluster to function inside the perimeter.\n\n- Don't use plugins that use Google Cloud APIs that are not [supported by\n VPC Service Controls](/vpc-service-controls/docs/supported-products).\n If you use unsupported plugins, Cloud Data Fusion will block the API calls,\n resulting in pipeline preview and execution failure.\n\n- To use Cloud Data Fusion within a VPC Service Controls service\n perimeter, add or configure several DNS entries to point the\n following domains to the restricted VIP (Virtual IP address):\n\n - `datafusion.googleapis.com`\n - `*.datafusion.googleusercontent.com`\n - `*.datafusion.cloud.google.com`\n\nLimitations:\n\n- Establish the VPC Service Controls security perimeter before creating your\n Cloud Data Fusion private instance. Perimeter protection for\n instances created prior to setting up VPC Service Controls is not\n supported.\n\n- Currently, the Cloud Data Fusion data plane UI does not support\n specifying access levels using [identity based access](/access-context-manager/docs/create-basic-access-level#members-example).\n\nRestricting Cloud Data Fusion API surfaces\n------------------------------------------\n\n### Restricting the control plane surface\n\nSee [Setting up private connectivity to Google APIs and services](/vpc-service-controls/docs/set-up-private-connectivity)\nto restrict connectivity to the `datafusion.googleapis.com` API control plane\nsurface.\n\n### Restricting the data plane surface\n\nTo set up private connectivity to the API data plane,\nconfigure DNS by completing the following steps for both the `*.datafusion.googleusercontent.com` and `*.datafusion.cloud.google.com` domains.\n\n1. Create a new private [zone using Cloud DNS](https://console.cloud.google.com/net-services/dns/zones):\n\n 1. Zone type: Check **private**\n 2. Zone name: datafusiongoogleusercontentcom\n 3. DNS name: datafusion.googleusercontent.com\n 4. Network: Select the private IP network you chose when you created your\n Cloud Data Fusion instance.\n\n2. From the [Cloud DNS](https://console.cloud.google.com/net-services/dns/zones) page, click your\n `datafusiongoogleusercontent` DNS zone name to open the\n **Zone details** page. Two records are listed: an NS and an SOA record.\n Use **Add Standard** to add the following two record sets to your\n datafusiongoogleusercontent DNS zone.\n\n 1. Add a CNAME record: In the **Create record set** dialog, fill\n in the following fields to map DNS name `*.datafusion.googleusercontent.com.`\n to the canonical name `datafusion.googleusercontent.com`:\n\n - DNS name: \"\\*.datafusion.googleusercontent.com\"\n - Canonical name: \"datafusion.googleusercontent.com\"\n\n 2. Add an A record: In a new **Create record set** dialog, fill\n in the following fields to map DNS name `datafusion.googleusercontent.com.`\n to IP addresses `199.36.153.4` - `199.36.153.7`:\n\n - DNS name: \".datafusion.googleusercontent.com\"\n - IPv4 address:\n\n - 199.36.153.4\n - 199.36.153.5\n - 199.36.153.6\n - 199.36.153.7\n\n The `datafusiongoogleusercontent` **Zone details** page shows the\n following record sets:\n3. Follow the above steps to create a private DNS zone and add a record set\n for the `*.datafusion.cloud.google.com` domain.\n\nWhat's next\n-----------\n\n- Learn about [Creating a private instance](/data-fusion/docs/how-to/create-private-ip).\n- Learn more about [VPC Service Controls](/vpc-service-controls/docs)."]]
