To further secure your Dataplex services, you can protect them using VPC Service Controls (VPC-SC).
VPC Service Controls provides additional security for your Dataplex services to help mitigate the risk of data exfiltration. Using VPC Service Controls, you can add projects to service perimeters that protect resources and services from requests that cross the perimeter.
To learn more about VPC Service Controls, see the Overview of VPC Service Controls.
Dataplex resources are exposed on the
dataplex.googleapis.com API, which allows you to perform service-level
operations, such as the creation and deletion of services.
You set up VPC Service Controls with Dataplex by restricting connectivity to this API surface.
- Before creating your Dataplex lake, set up the VPC Service Controls security perimeter. Otherwise, your lake will not have perimeter protection.
Configuring the Virtual Private Cloud (VPC) network
You can configure the VPC network to restrict Private Google Access with respect to a service perimeter. This ensures that hosts on your VPC or on-premises network can only communicate with Google APIs and services that are supported by VPC Service Controls in ways which conform to the associated perimeter's policy.
For more information, see Setting up private connectivity to Google APIs and services.
Creating a service perimeter
During this procedure, you select the Dataplex projects that you want the VPC service perimeter to protect.
To create a service perimeter, follow the instructions in Creating a service perimeter.
Adding more projects to the service perimeter
To add existing Dataplex projects to the perimeter, follow the instructions in Updating a service perimeter.
Adding the Dataplex API to the service perimeter
To mitigate the risk of your data being exfiltrated from Dataplex, for example, using Dataplex APIs, you must restrict the Dataplex API.
To add Dataplex API as a restricted service:
In the Google Cloud console, open the VPC Service Controls page:
Go to the VPC Service Controls page in the Google Cloud console
On the VPC Service Controls page, in the table, click the name of the service perimeter that you want to modify.
Click Edit Perimeter.
On the Edit VPC Service Perimeter page, click Add Services.
Add Dataplex API.
Use the following
gcloud access-context-manager perimeters updatecommand:
gcloud access-context-manager perimeters update PERIMETER_ID \ --policy=POLICY_ID \ --add-restricted-services=dataplex.googleapis.com
Replace the following:
PERIMETER_ID: The ID of the perimeter or the fully qualifed identifier for the perimeter.
POLICY_ID: The ID of the access policy.
Creating an access level
Optionally, to permit external access to protected resources inside a perimeter, you can use access levels. Access levels apply only to requests for protected resources coming from outside the service perimeter. You can't use access levels to give protected resources permission to access data and services outside the perimeter.
See Allowing access to protected resources from outside a perimeter.
- Learn more about VPC Service Controls.
- Learn more about Dataplex IAM and access control.
- Learn more about Dataplex security.