Los Controles del servicio de VPC son una Google Cloud función que te permite configurar un perímetro de servicio y crear un límite de transferencia de datos. Puedes usar los Controles del servicio de VPC con Eventarc para ayudar a proteger tus servicios.
Te recomendamos que protejas todos los servicios cuando crees un perímetro de servicio.
Eventarc Advanced
Un bus de Eventarc Advanced fuera de un perímetro de servicio no puede recibir eventos de proyectos Google Cloud dentro del perímetro. Un bus de Eventarc Advanced dentro de un perímetro no puede enrutar eventos a un consumidor fuera del perímetro.
Para publicar en un bus de Eventarc Advanced, la fuente de un evento debe estar dentro del mismo perímetro de servicio que el bus.
Para consumir un mensaje, un consumidor de eventos debe estar dentro del mismo perímetro de servicio que el bus.
Puedes verificar la compatibilidad de los Controles del servicio de VPC con los recursos Enrollment, GoogleApiSource, MessageBus y Pipeline consultando los registros de la plataforma en la entrada.
Eventarc Standard
En los proyectos protegidos por un perímetro de servicio, Eventarc Standard tiene las mismas limitaciones que Pub/Sub:
Cuando enrutas eventos a destinos de Cloud Run, solo puedes crear suscripciones de envío nuevas de Pub/Sub cuando los extremos de envío están configurados en servicios de Cloud Run con URLs run.app predeterminadas. Los dominios personalizados no funcionan.
Cuando enrutas eventos a destinos de Workflows para los que el extremo de envío de Pub/Sub está configurado en una ejecución de Workflows, solo puedes crear suscripciones de envío de Pub/Sub nuevas a través de Eventarc.
Ten en cuenta que la cuenta de servicio que se usa para la autenticación de envío para el extremo de Workflows debe incluirse en el perímetro de servicio.
Los Controles del servicio de VPC bloquean la creación de activadores de Eventarc para extremos HTTP internos.
La protección de los Controles del servicio de VPC no se aplica cuando se enrutan eventos a esos destinos.
[[["Fácil de comprender","easyToUnderstand","thumb-up"],["Resolvió mi problema","solvedMyProblem","thumb-up"],["Otro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Información o código de muestra incorrectos","incorrectInformationOrSampleCode","thumb-down"],["Faltan la información o los ejemplos que necesito","missingTheInformationSamplesINeed","thumb-down"],["Problema de traducción","translationIssue","thumb-down"],["Otro","otherDown","thumb-down"]],["Última actualización: 2025-09-04 (UTC)"],[[["\u003cp\u003eEventarc, in both its Advanced and Standard versions, can be used with VPC Service Controls to enhance service security by establishing a service perimeter and data transfer boundary.\u003c/p\u003e\n"],["\u003cp\u003eEventarc Advanced has limitations within service perimeters, preventing buses outside a perimeter from receiving events from inside and vice-versa, and event sources and consumers must be in the same perimeter as the bus.\u003c/p\u003e\n"],["\u003cp\u003eEventarc Advanced does not currently support the creation of pipelines inside of a service perimeter for full end-to-end event delivery.\u003c/p\u003e\n"],["\u003cp\u003eEventarc Standard shares limitations with Pub/Sub, such as only allowing new push subscriptions with default \u003ccode\u003erun.app\u003c/code\u003e URLs for Cloud Run destinations and only allowing creation of new push subscriptions through Eventarc when using Workflows destinations.\u003c/p\u003e\n"],["\u003cp\u003eVPC Service Controls will block the creation of triggers for internal http endpoints for Eventarc Standard.\u003c/p\u003e\n"]]],[],null,["# Set up a service perimeter using VPC Service Controls\n\n[Advanced](/eventarc/advanced/docs/overview) [Standard](/eventarc/standard/docs/overview)\n\nVPC Service Controls is a Google Cloud feature that lets you set up a\nservice perimeter and create a data transfer boundary. You can use\nVPC Service Controls with Eventarc to help protect your\nservices.\n| **Note:** Eventarc Standard handles event delivery using Pub/Sub topics and push subscriptions. To access the Pub/Sub API and manage event triggers, the Eventarc API must be protected within the same VPC Service Controls service perimeter as the Pub/Sub API.\n\nWe recommend that you protect all services when creating a service perimeter.\n\nEventarc Advanced\n-----------------\n\n- An Eventarc Advanced bus outside of a service perimeter can't\n receive events from Google Cloud projects inside the perimeter. An\n Eventarc Advanced bus inside of a perimeter can't route events to\n a consumer outside of the perimeter.\n\n - To publish to an Eventarc Advanced bus, the source of an event must be inside the same service perimeter as the bus.\n - To consume a message, an event consumer must be inside the same service perimeter as the bus.\n- You can verify VPC Service Controls support for the `Enrollment`,\n `GoogleApiSource`, `MessageBus`, and `Pipeline` resources by viewing platform\n logs on ingress.\n\nEventarc Standard\n-----------------\n\n- In projects protected by a service perimeter, Eventarc Standard\n is bound by the same limitations as Pub/Sub:\n\n - When routing events to Cloud Run destinations, you can only\n create new Pub/Sub push subscriptions when the push\n endpoints are set to Cloud Run services with default\n `run.app` URLs. [Custom domains](/run/docs/mapping-custom-domains) don't\n work.\n\n - When [routing events to Workflows destinations](/workflows/docs/trigger-workflow-eventarc)\n for which the Pub/Sub push endpoint is set to a\n Workflows execution, you can only create new\n Pub/Sub push subscriptions through Eventarc.\n Note that the service account used for push authentication for the\n Workflows endpoint must be included in the service\n perimeter.\n\n- VPC Service Controls blocks the creation of Eventarc\n triggers for\n [internal HTTP endpoints](/eventarc/standard/docs/vpc-endpoints/route-vpc-internal-endpoint-events).\n VPC Service Controls protection does not apply when routing events to\n such destinations.\n\nWhat's next\n-----------\n\n- To learn more about VPC Service Controls, see the\n [overview](/vpc-service-controls/docs/overview) and\n [supported products and limitations](/vpc-service-controls/docs/supported-products).\n\n- For best practices for enabling VPC Service Controls, see\n [Best practices for enabling VPC Service Controls](/vpc-service-controls/docs/enable).\n\n- For best practices for designing service perimeters, see\n [Design and architect service perimeters](/vpc-service-controls/docs/architect-perimeters).\n\n- To set up a service perimeter, see\n [Create a service perimeter](/vpc-service-controls/docs/create-service-perimeters)."]]
