本文說明如何使用 VPC Service Controls (VPC-SC) 保護 Dataplex Universal Catalog 服務。
VPC Service Controls 為您的 Dataplex Universal Catalog 服務提供額外的安全性，以降低資料遭到竊取的風險。您可以透過 VPC Service Controls 將專案加入服務範圍內，如此一來，跨越範圍的要求就無法存取相關資源及服務。詳情請參閱「VPC Service Controls 總覽」。
Dataplex Universal Catalog 資源會顯示在 dataplex.googleapis.com API 上，方便您執行服務層級的作業，例如建立及刪除服務。
如要透過 Dataplex Universal Catalog 設定 VPC Service Controls，請限制與這個 API 介面的連線。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-10 (世界標準時間)。"],[[["\u003cp\u003eVPC Service Controls enhances Dataplex security by mitigating data exfiltration risks through the creation of service perimeters.\u003c/p\u003e\n"],["\u003cp\u003eDataplex resources, such as Lakes, Assets, data profile scans, and data quality scans, are protected by restricting connectivity to the \u003ccode\u003edataplex.googleapis.com\u003c/code\u003e API within a service perimeter.\u003c/p\u003e\n"],["\u003cp\u003eSetting up the VPC Service Controls security perimeter before creating Dataplex resources is crucial, as resources created prior to setting up will not be protected.\u003c/p\u003e\n"],["\u003cp\u003eTo add the Dataplex API as a restricted service, users must navigate to the VPC Service Controls page in the Google Cloud console and add it to the relevant service perimeter.\u003c/p\u003e\n"],["\u003cp\u003eAccess levels can be configured to permit external access to resources within the perimeter, but they cannot be used to give protected resources permission to access data and services outside the perimeter.\u003c/p\u003e\n"]]],[],null,["# VPC Service Controls with Dataplex Universal Catalog\n\nThis document describes how to secure your Dataplex Universal Catalog services using\nVPC Service Controls (VPC-SC).\n\nVPC Service Controls provides additional security for your\nDataplex Universal Catalog services to help mitigate the risk of data\nexfiltration. Using VPC Service Controls, you can add projects to service\nperimeters that protect resources and services from requests that cross the\nperimeter. For more information, see\n[Overview of VPC Service Controls](/vpc-service-controls/docs/overview).\n\nDataplex Universal Catalog resources are exposed on the\n`dataplex.googleapis.com` API, which lets you perform service-level\noperations, such as creation and deletion of services.\n\nYou set up VPC Service Controls with Dataplex Universal Catalog by\nrestricting connectivity to this API surface.\n\nLimitations\n-----------\n\nBefore you create Dataplex Universal Catalog resources, set up the\nVPC Service Controls security perimeter. Otherwise, your resources don't\nhave perimeter protection. Dataplex Universal Catalog supports the following resource\ntypes:\n\n- Lake\n- Assets\n- Data profile scan\n- Data quality scan\n\nConfigure the Virtual Private Cloud (VPC) network\n-------------------------------------------------\n\nYou can configure the VPC network to restrict\nPrivate Google Access with respect to a service perimeter. This ensures that\nhosts on your VPC or on-premises network can only communicate\nwith Google APIs and services that are supported by VPC Service Controls\nin ways which conform to the associated perimeter's policy.\n\nFor more information, see [Setting up private connectivity to Google APIs and services](/vpc-service-controls/docs/set-up-private-connectivity).\n\nCreate a service perimeter\n--------------------------\n\nWhen you create a service perimeter, you select the Dataplex Universal Catalog\nprojects that you want the VPC Service Controls service perimeter to protect.\n\nTo create a service perimeter, follow the instructions in [Create a service perimeter](/vpc-service-controls/docs/create-service-perimeters).\n\n### Add more projects to the service perimeter\n\nTo add existing Dataplex Universal Catalog projects to the perimeter,\nfollow the instructions in [Update a service perimeter](/vpc-service-controls/docs/manage-service-perimeters#update).\n\n### Add the Dataplex API to the service perimeter\n\nTo mitigate the risk of your data being exfiltrated from Dataplex Universal Catalog,\nfor example, using Dataplex API methods, you\nmust restrict the Dataplex API.\n\nTo add the Dataplex API as a restricted service, follow these steps: \n\n### Console\n\n1. In the Google Cloud console, go to the **VPC Service Controls** page.\n\n [Go to VPC Service Controls](https://console.cloud.google.com/security/service-perimeter)\n2. On the **VPC Service Controls** page, in the table, click the name of\n the service perimeter that you want to modify.\n\n3. Click **Edit Perimeter**.\n\n4. On the **Edit Service Perimeter** page,\n click **Add Services**.\n\n5. Add **Dataplex API**.\n\n6. Click **Save**.\n\n### gcloud\n\n- Use the `gcloud access-context-manager perimeters update` command:\n\n ```\n gcloud access-context-manager perimeters update PERIMETER_ID \\\n --policy=POLICY_ID \\\n --add-restricted-services=dataplex.googleapis.com\n ```\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003ePERIMETER_ID\u003c/var\u003e: the ID of the perimeter or the fully qualified identifier for the perimeter\n - \u003cvar translate=\"no\"\u003ePOLICY_ID\u003c/var\u003e: the ID of the access policy\n\nOptional: Create an access level\n--------------------------------\n\nTo permit external access to protected resources inside a perimeter,\nyou can use access levels. Access levels apply only to requests for protected\nresources coming from outside the service perimeter. You can't use access levels\nto give protected resources permission to access data and services outside the\nperimeter.\n\nFor more information, see\n[Allow access to protected resources from outside a perimeter](/vpc-service-controls/docs/use-access-levels).\n\nData lineage support\n--------------------\n\nData lineage is supported by restricted Virtual IP (VIP).\nFor more information, see\n[Services supported by the restricted VIP](/vpc-service-controls/docs/restricted-vip-services).\n\nWhat's next\n-----------\n\n- Learn more about [VPC Service Controls](/vpc-service-controls/docs).\n- Learn more about [Dataplex Universal Catalog access control with IAM](/dataplex/docs/iam-and-access-control).\n- Learn more about [Dataplex Universal Catalog security](/dataplex/docs/lake-security)."]]
