VPC 서비스 제어를 사용하면 Google Cloud 리소스 경계인 경계를 만들 수 있습니다. 그런 다음 경계 외부에서 지원되는 서비스에 대한 액세스를 방지하는 보안 정책을 정의할 수 있습니다.
VPC 서비스 제어에 대한 자세한 내용은 VPC 서비스 제어 개요를 참조하세요.
VPC 서비스 제어를 사용하여 다음 IAM 관련 API를 보호할 수 있습니다.
IAM API
보안 토큰 서비스 API
Privileged Access Manager API
IAM API 보호 지원
VPC 서비스 제어를 사용하여 Identity and Access Management(IAM) 리소스를 보호할 수 있습니다. IAM 리소스에는 다음이 포함됩니다.
커스텀 역할
서비스 계정 키
서비스 계정
워크로드 아이덴티티 풀
VPC 서비스 제어가 IAM과 작동하는 방식
경계로 IAM을 제한하는 경우 IAM API를 사용하는 작업만 제한됩니다. 이러한 작업에는 커스텀 IAM 역할 관리, 워크로드 아이덴티티 풀 관리, 서비스 계정 및 키 관리가 포함됩니다. 직원 풀은 조직 수준 리소스이므로 경계는 직원 풀 작업을 제한하지 않습니다.
IAM 주변의 경계는 Resource Manager 프로젝트, 폴더, 조직, 또는 Compute Engine 가상 머신 인스턴 같은 다른 서비스에서 소유한 리소스의 액세스 관리(즉, IAM 정책 가져오기 또는 설정)를 제한하지 않습니다. 이러한 리소스의 액세스 관리를 제한하려면 리소스를 소유한 서비스를 제한하는 경계를 만듭니다. IAM 정책을 허용하는 리소스 목록 및 해당 정책을 소유한 서비스의 목록은 허용 정책을 허용하는 리소스 유형을 참조하세요.
또한 경계는 다음을 포함하여 다른 API를 사용하는 작업을 제한하지 않습니다.
IAM 정책 시뮬레이터 API
IAM 정책 문제 해결 도구 API
보안 토큰 서비스 API
Service Account Credentials API(IAM API의 레거시 signBlob 및 signJwt 메서드 포함)
VPC 서비스 제어를 사용하여 Privileged Access Manager 리소스를 보호할 수 있습니다. Privileged Access Manager 리소스에는 다음이 포함됩니다.
자격
Grants
VPC 서비스 제어에서는 폴더 수준이나 조직 수준의 리소스를 서비스 경계에 추가할 수 없습니다. 경계를 사용하여 폴더 수준이나 조직 수준의 Privileged Access Manager 리소스를 보호할 수 없습니다. VPC 서비스 제어는 프로젝트 수준의 Privileged Access Manager 리소스를 보호합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-08(UTC)"],[[["\u003cp\u003eVPC Service Controls allow you to create perimeters around your Google Cloud resources to define security policies and prevent access to supported services from outside of the perimeter.\u003c/p\u003e\n"],["\u003cp\u003eUsing VPC Service Controls, you can secure IAM resources, which include custom roles, service account keys, service accounts, and workload identity pools, by restricting actions that use the IAM API.\u003c/p\u003e\n"],["\u003cp\u003eVPC Service Controls can also help secure token exchanges by restricting the Security Token Service API, only allowing resources within the same perimeter or principals with defined attributes to exchange tokens.\u003c/p\u003e\n"],["\u003cp\u003ePrivileged Access Manager resources, such as entitlements and grants, can be secured with VPC Service Controls, but only at the project level, as folder-level and organization-level resources are not supported within a service perimeter.\u003c/p\u003e\n"],["\u003cp\u003eThe perimeter placed around resources does not restrict actions from other APIs like the IAM Policy Simulator API, the IAM Policy Troubleshooter API or workforce pools actions.\u003c/p\u003e\n"]]],[],null,["# Help secure IAM with VPC Service Controls\n\nWith VPC Service Controls, you can create *perimeters* , which are boundaries\naround your Google Cloud resources. You can then define security policies\nthat help prevent access to supported services from outside of the perimeter.\nFor more information about VPC Service Controls, see the [VPC Service Controls\noverview](/vpc-service-controls/docs/overview).\n\nYou can use VPC Service Controls to help secure the following\nIAM-related APIs:\n\n- Identity and Access Management API\n- Security Token Service API\n- Privileged Access Manager API\n\nHelp secure the Identity and Access Management API\n--------------------------------------------------\n\n\n| **Beta\n| --- Using VPC Service Controls with IAM**\n|\n|\n| This feature is subject to the \"Pre-GA Offerings Terms\" in the General Service Terms section\n| of the [Service Specific Terms](/terms/service-terms#1).\n|\n| Pre-GA features are available \"as is\" and might have limited support.\n|\n| For more information, see the\n| [launch stage descriptions](/products#product-launch-stages).\n\n\u003cbr /\u003e\n\nYou can help secure the following Identity and Access Management (IAM) resources by using\nVPC Service Controls:\n\n- Custom roles\n- Service account keys\n- Service accounts\n- Workload identity pools\n- Deny policies\n- Policy bindings for principal access boundary policies\n\n### How VPC Service Controls works with IAM\n\nWhen you restrict IAM with a perimeter, only actions\nthat use the IAM API are restricted. These actions\ninclude the following:\n\n- Managing custom IAM roles\n- Managing workload identity pools\n- Managing service accounts and keys\n- Managing deny policies\n- Managing policy bindings for principal access boundary policies\n\nThe perimeter *doesn't* restrict actions related to workforce\npools and principal access boundary policies because those resources\nare created at the organization level.\n\nThe perimeter also *doesn't* restrict allow policy management for resources\nowned by other services, like Resource Manager projects, folders, and organizations\nor Compute Engine virtual machine instances. To restrict allow policy\nmanagement for these resources, create a perimeter that restricts the service\nthat owns the resources. For a list of resources that accept allow policies and\nthe services that own them, see [Resource types that accept allow\npolicies](/iam/docs/resource-types-with-policies).\n\nAdditionally, the perimeter *doesn't* restrict actions that use other APIs,\nincluding the following:\n\n- IAM Policy Simulator API\n- IAM Policy Troubleshooter API\n\n\u003c!-- --\u003e\n\n- Security Token Service API\n- Service Account Credentials API (including the legacy `signBlob` and `signJwt` methods in the IAM API)\n\nFor more details about how VPC Service Controls works with\nIAM, see the [IAM entry in the\nVPC Service Controls supported products table](/vpc-service-controls/docs/supported-products#table_iam).\n\nHelp secure the Security Token Service API\n------------------------------------------\n\nYou can help secure token exchanges by using VPC Service Controls.\n| **Note:** VPC Service Controls only restricts token exchanges if the [audience](/iam/docs/reference/sts/rest/v1/TopLevel/token#body.request_body.FIELDS.audience) in the request is a project-level resource. For example, it does not restrict requests for [downscoped tokens](/iam/docs/downscoping-short-lived-credentials), because those requests have no audience.\n\nWhen you restrict the Security Token Service API with a perimeter, only the\nfollowing entities can exchange tokens:\n\n- Resources within the same perimeter as the workload identity pool you're using to exchange the token\n- Principals with the attributes defined in the service perimeter\n\nWhen you create an [ingress\nor egress rule](/vpc-service-controls/docs/ingress-egress-rules) to allow token exchanges, you must set the identity type to\n`ANY_IDENTITY` because the [token](/iam/docs/reference/sts/rest/v1/TopLevel/token)\nmethod has no authorization.\n\nFor more details about how VPC Service Controls works with\nIAM, see the [Security Token Service entry in the\nVPC Service Controls supported products table](/vpc-service-controls/docs/supported-products#table_sts).\n\nHelp secure the Privileged Access Manager API\n---------------------------------------------\n\n\n| **Preview\n| --- Using VPC Service Controls with Privileged Access Manager**\n|\n|\n| This feature is subject to the \"Pre-GA Offerings Terms\" in the General Service Terms section\n| of the [Service Specific Terms](/terms/service-terms#1).\n|\n| Pre-GA features are available \"as is\" and might have limited support.\n|\n| For more information, see the\n| [launch stage descriptions](/products#product-launch-stages).\n\n\u003cbr /\u003e\n\nYou can help secure your Privileged Access Manager resources by using\nVPC Service Controls. Privileged Access Manager resources include the following:\n\n- Entitlements\n- Grants\n\nVPC Service Controls doesn't support adding folder-level or organization-level\nresources into a service perimeter. You can't use a perimeter to protect\nfolder-level or organization-level Privileged Access Manager resources. VPC Service Controls\nprotects project-level Privileged Access Manager resources.\n\nFor more details about how VPC Service Controls works with\nPrivileged Access Manager, see the [Privileged Access Manager entry in the\nVPC Service Controls supported products table](/vpc-service-controls/docs/supported-products#table_pam).\n\nWhat's next\n-----------\n\n- Learn how to [create a service perimeter](/vpc-service-controls/docs/create-service-perimeters)."]]
