O VPC Service Controls é um Google Cloud recurso que permite configurar um
perímetro de serviço e criar um limite de transferência de dados. É possível usar
o VPC Service Controls com o Eventarc para ajudar a proteger seus
serviços.
Recomendamos que você proteja todos os serviços ao criar um perímetro de serviço.
Eventarc Advanced
Um barramento do Eventarc Advanced fora de um perímetro de serviço não pode
receber eventos de projetos Google Cloud dentro do perímetro. Um barramento do Eventarc Advanced dentro de um perímetro não pode rotear eventos para um consumidor fora dele.
Para publicar em um barramento do Eventarc Advanced, a origem de um
evento precisa estar no mesmo perímetro de serviço que o barramento.
Para consumir uma mensagem, um consumidor de eventos precisa estar no mesmo perímetro de serviço que o barramento.
Para verificar o suporte do VPC Service Controls aos recursos Enrollment, GoogleApiSource, MessageBus e Pipeline, consulte os registros da plataforma no ingresso.
Eventarc Standard
Em projetos protegidos por um perímetro de serviço, o Eventarc Standard
está sujeito às mesmas limitações do Pub/Sub:
Ao rotear eventos para destinos do Cloud Run, só é possível
criar novas assinaturas de push do Pub/Sub quando os endpoints
de push estão configurados para serviços do Cloud Run com URLs
run.app padrão. Domínios personalizados não
funcionam.
Ao rotear eventos para destinos do Workflows
em que o endpoint de push do Pub/Sub está definido como uma
execução do Workflows, só é possível criar novas
assinaturas de push do Pub/Sub por meio do Eventarc.
A conta de serviço usada na autenticação por push do
endpoint do Workflows precisa ser incluída no perímetro
de serviço.
O VPC Service Controls bloqueia a criação de gatilhos
do Eventarc para
endpoints HTTP internos.
A proteção do VPC Service Controls não se aplica ao roteamento de eventos para
esses destinos.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-09-04 UTC."],[[["\u003cp\u003eVPC Service Controls can be used with Eventarc to establish a service perimeter and data transfer boundary, thereby protecting your services.\u003c/p\u003e\n"],["\u003cp\u003eEventarc Advanced has limitations within a service perimeter, including the inability for external Eventarc Advanced buses to communicate with projects inside the perimeter and no support for end-to-end event delivery within it.\u003c/p\u003e\n"],["\u003cp\u003eEventarc Standard is subject to the same constraints as Pub/Sub, particularly concerning push subscriptions to Cloud Run services with default \u003ccode\u003erun.app\u003c/code\u003e URLs and Workflows destinations.\u003c/p\u003e\n"],["\u003cp\u003eVPC Service Controls prevents the creation of Eventarc triggers for internal HTTP endpoints, and protection does not apply to events routed to these destinations.\u003c/p\u003e\n"],["\u003cp\u003eProtecting all services is recommended when creating a new service perimeter, to maintain security.\u003c/p\u003e\n"]]],[],null,["# Set up a service perimeter using VPC Service Controls\n\n[Advanced](/eventarc/advanced/docs/overview) [Standard](/eventarc/standard/docs/overview)\n\nVPC Service Controls is a Google Cloud feature that lets you set up a\nservice perimeter and create a data transfer boundary. You can use\nVPC Service Controls with Eventarc to help protect your\nservices.\n| **Note:** Eventarc Standard handles event delivery using Pub/Sub topics and push subscriptions. To access the Pub/Sub API and manage event triggers, the Eventarc API must be protected within the same VPC Service Controls service perimeter as the Pub/Sub API.\n\nWe recommend that you protect all services when creating a service perimeter.\n\nEventarc Advanced\n-----------------\n\n- An Eventarc Advanced bus outside of a service perimeter can't\n receive events from Google Cloud projects inside the perimeter. An\n Eventarc Advanced bus inside of a perimeter can't route events to\n a consumer outside of the perimeter.\n\n - To publish to an Eventarc Advanced bus, the source of an event must be inside the same service perimeter as the bus.\n - To consume a message, an event consumer must be inside the same service perimeter as the bus.\n- You can verify VPC Service Controls support for the `Enrollment`,\n `GoogleApiSource`, `MessageBus`, and `Pipeline` resources by viewing platform\n logs on ingress.\n\nEventarc Standard\n-----------------\n\n- In projects protected by a service perimeter, Eventarc Standard\n is bound by the same limitations as Pub/Sub:\n\n - When routing events to Cloud Run destinations, you can only\n create new Pub/Sub push subscriptions when the push\n endpoints are set to Cloud Run services with default\n `run.app` URLs. [Custom domains](/run/docs/mapping-custom-domains) don't\n work.\n\n - When [routing events to Workflows destinations](/workflows/docs/trigger-workflow-eventarc)\n for which the Pub/Sub push endpoint is set to a\n Workflows execution, you can only create new\n Pub/Sub push subscriptions through Eventarc.\n Note that the service account used for push authentication for the\n Workflows endpoint must be included in the service\n perimeter.\n\n- VPC Service Controls blocks the creation of Eventarc\n triggers for\n [internal HTTP endpoints](/eventarc/standard/docs/vpc-endpoints/route-vpc-internal-endpoint-events).\n VPC Service Controls protection does not apply when routing events to\n such destinations.\n\nWhat's next\n-----------\n\n- To learn more about VPC Service Controls, see the\n [overview](/vpc-service-controls/docs/overview) and\n [supported products and limitations](/vpc-service-controls/docs/supported-products).\n\n- For best practices for enabling VPC Service Controls, see\n [Best practices for enabling VPC Service Controls](/vpc-service-controls/docs/enable).\n\n- For best practices for designing service perimeters, see\n [Design and architect service perimeters](/vpc-service-controls/docs/architect-perimeters).\n\n- To set up a service perimeter, see\n [Create a service perimeter](/vpc-service-controls/docs/create-service-perimeters)."]]
