借助 VPC Service Controls，您可以为您的 Google Cloud 资源创建边界。然后，您可以定义安全政策，以防止从边界外访问受支持的服务。如需详细了解 VPC Service Controls，请参阅 VPC Service Controls 概览。
您可以使用 VPC Service Controls 来帮助保护以下与 IAM 相关的 API：
IAM API
Security Token Service API
Privileged Access Manager API
帮助保护 IAM API
您可以使用 VPC Service Controls 来帮助保护您的 Identity and Access Management (IAM) 资源。IAM 资源包括：
自定义角色
服务账号密钥
服务账号
工作负载身份池
VPC Service Controls 如何与 IAM 搭配使用
使用边界限制 IAM 时，只有使用 IAM API 的操作会受到限制。这些操作包括管理自定义 IAM 角色、管理工作负载身份池以及管理服务账号和密钥。边界不会限制员工池操作，因为员工池是组织级层资源。
IAM 的边界不会限制其他服务拥有的资源（例如 Resource Manager 项目、文件夹和组织或 Compute Engine 虚拟机实例）的访问权限管理（即获取或设置 IAM 政策）。如需限制这些资源的访问权限管理，请创建限制这些资源所属服务的边界。如需查看接受 IAM 政策的资源及其所属服务的列表，请参阅接受允许政策的资源类型。
此外，边界不会限制使用其他 API 的操作，包括：
IAM Policy Simulator API
IAM Policy Troubleshooter API
Security Token Service API
Service Account Credentials API（包括 IAM API 中的旧版 signBlob 和 signJwt 方法）
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[[["\u003cp\u003eVPC Service Controls allow you to create perimeters around your Google Cloud resources to define security policies and prevent access to supported services from outside of the perimeter.\u003c/p\u003e\n"],["\u003cp\u003eUsing VPC Service Controls, you can secure IAM resources, which include custom roles, service account keys, service accounts, and workload identity pools, by restricting actions that use the IAM API.\u003c/p\u003e\n"],["\u003cp\u003eVPC Service Controls can also help secure token exchanges by restricting the Security Token Service API, only allowing resources within the same perimeter or principals with defined attributes to exchange tokens.\u003c/p\u003e\n"],["\u003cp\u003ePrivileged Access Manager resources, such as entitlements and grants, can be secured with VPC Service Controls, but only at the project level, as folder-level and organization-level resources are not supported within a service perimeter.\u003c/p\u003e\n"],["\u003cp\u003eThe perimeter placed around resources does not restrict actions from other APIs like the IAM Policy Simulator API, the IAM Policy Troubleshooter API or workforce pools actions.\u003c/p\u003e\n"]]],[],null,["# Help secure IAM with VPC Service Controls\n\nWith VPC Service Controls, you can create *perimeters* , which are boundaries\naround your Google Cloud resources. You can then define security policies\nthat help prevent access to supported services from outside of the perimeter.\nFor more information about VPC Service Controls, see the [VPC Service Controls\noverview](/vpc-service-controls/docs/overview).\n\nYou can use VPC Service Controls to help secure the following\nIAM-related APIs:\n\n- Identity and Access Management API\n- Security Token Service API\n- Privileged Access Manager API\n\nHelp secure the Identity and Access Management API\n--------------------------------------------------\n\n\n| **Beta\n| --- Using VPC Service Controls with IAM**\n|\n|\n| This feature is subject to the \"Pre-GA Offerings Terms\" in the General Service Terms section\n| of the [Service Specific Terms](/terms/service-terms#1).\n|\n| Pre-GA features are available \"as is\" and might have limited support.\n|\n| For more information, see the\n| [launch stage descriptions](/products#product-launch-stages).\n\n\u003cbr /\u003e\n\nYou can help secure the following Identity and Access Management (IAM) resources by using\nVPC Service Controls:\n\n- Custom roles\n- Service account keys\n- Service accounts\n- Workload identity pools\n- Deny policies\n- Policy bindings for principal access boundary policies\n\n### How VPC Service Controls works with IAM\n\nWhen you restrict IAM with a perimeter, only actions\nthat use the IAM API are restricted. These actions\ninclude the following:\n\n- Managing custom IAM roles\n- Managing workload identity pools\n- Managing service accounts and keys\n- Managing deny policies\n- Managing policy bindings for principal access boundary policies\n\nThe perimeter *doesn't* restrict actions related to workforce\npools and principal access boundary policies because those resources\nare created at the organization level.\n\nThe perimeter also *doesn't* restrict allow policy management for resources\nowned by other services, like Resource Manager projects, folders, and organizations\nor Compute Engine virtual machine instances. To restrict allow policy\nmanagement for these resources, create a perimeter that restricts the service\nthat owns the resources. For a list of resources that accept allow policies and\nthe services that own them, see [Resource types that accept allow\npolicies](/iam/docs/resource-types-with-policies).\n\nAdditionally, the perimeter *doesn't* restrict actions that use other APIs,\nincluding the following:\n\n- IAM Policy Simulator API\n- IAM Policy Troubleshooter API\n\n\u003c!-- --\u003e\n\n- Security Token Service API\n- Service Account Credentials API (including the legacy `signBlob` and `signJwt` methods in the IAM API)\n\nFor more details about how VPC Service Controls works with\nIAM, see the [IAM entry in the\nVPC Service Controls supported products table](/vpc-service-controls/docs/supported-products#table_iam).\n\nHelp secure the Security Token Service API\n------------------------------------------\n\nYou can help secure token exchanges by using VPC Service Controls.\n| **Note:** VPC Service Controls only restricts token exchanges if the [audience](/iam/docs/reference/sts/rest/v1/TopLevel/token#body.request_body.FIELDS.audience) in the request is a project-level resource. For example, it does not restrict requests for [downscoped tokens](/iam/docs/downscoping-short-lived-credentials), because those requests have no audience.\n\nWhen you restrict the Security Token Service API with a perimeter, only the\nfollowing entities can exchange tokens:\n\n- Resources within the same perimeter as the workload identity pool you're using to exchange the token\n- Principals with the attributes defined in the service perimeter\n\nWhen you create an [ingress\nor egress rule](/vpc-service-controls/docs/ingress-egress-rules) to allow token exchanges, you must set the identity type to\n`ANY_IDENTITY` because the [token](/iam/docs/reference/sts/rest/v1/TopLevel/token)\nmethod has no authorization.\n\nFor more details about how VPC Service Controls works with\nIAM, see the [Security Token Service entry in the\nVPC Service Controls supported products table](/vpc-service-controls/docs/supported-products#table_sts).\n\nHelp secure the Privileged Access Manager API\n---------------------------------------------\n\n\n| **Preview\n| --- Using VPC Service Controls with Privileged Access Manager**\n|\n|\n| This feature is subject to the \"Pre-GA Offerings Terms\" in the General Service Terms section\n| of the [Service Specific Terms](/terms/service-terms#1).\n|\n| Pre-GA features are available \"as is\" and might have limited support.\n|\n| For more information, see the\n| [launch stage descriptions](/products#product-launch-stages).\n\n\u003cbr /\u003e\n\nYou can help secure your Privileged Access Manager resources by using\nVPC Service Controls. Privileged Access Manager resources include the following:\n\n- Entitlements\n- Grants\n\nVPC Service Controls doesn't support adding folder-level or organization-level\nresources into a service perimeter. You can't use a perimeter to protect\nfolder-level or organization-level Privileged Access Manager resources. VPC Service Controls\nprotects project-level Privileged Access Manager resources.\n\nFor more details about how VPC Service Controls works with\nPrivileged Access Manager, see the [Privileged Access Manager entry in the\nVPC Service Controls supported products table](/vpc-service-controls/docs/supported-products#table_pam).\n\nWhat's next\n-----------\n\n- Learn how to [create a service perimeter](/vpc-service-controls/docs/create-service-perimeters)."]]
