[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eVPC Service Controls allow you to create perimeters around your Google Cloud resources to define security policies and prevent access to supported services from outside of the perimeter.\u003c/p\u003e\n"],["\u003cp\u003eUsing VPC Service Controls, you can secure IAM resources, which include custom roles, service account keys, service accounts, and workload identity pools, by restricting actions that use the IAM API.\u003c/p\u003e\n"],["\u003cp\u003eVPC Service Controls can also help secure token exchanges by restricting the Security Token Service API, only allowing resources within the same perimeter or principals with defined attributes to exchange tokens.\u003c/p\u003e\n"],["\u003cp\u003ePrivileged Access Manager resources, such as entitlements and grants, can be secured with VPC Service Controls, but only at the project level, as folder-level and organization-level resources are not supported within a service perimeter.\u003c/p\u003e\n"],["\u003cp\u003eThe perimeter placed around resources does not restrict actions from other APIs like the IAM Policy Simulator API, the IAM Policy Troubleshooter API or workforce pools actions.\u003c/p\u003e\n"]]],[],null,["# Help secure IAM with VPC Service Controls\n\nWith VPC Service Controls, you can create *perimeters* , which are boundaries\naround your Google Cloud resources. You can then define security policies\nthat help prevent access to supported services from outside of the perimeter.\nFor more information about VPC Service Controls, see the [VPC Service Controls\noverview](/vpc-service-controls/docs/overview).\n\nYou can use VPC Service Controls to help secure the following\nIAM-related APIs:\n\n- Identity and Access Management API\n- Security Token Service API\n- Privileged Access Manager API\n\nHelp secure the Identity and Access Management API\n--------------------------------------------------\n\n\n| **Beta\n| --- Using VPC Service Controls with IAM**\n|\n|\n| This feature is subject to the \"Pre-GA Offerings Terms\" in the General Service Terms section\n| of the [Service Specific Terms](/terms/service-terms#1).\n|\n| Pre-GA features are available \"as is\" and might have limited support.\n|\n| For more information, see the\n| [launch stage descriptions](/products#product-launch-stages).\n\n\u003cbr /\u003e\n\nYou can help secure the following Identity and Access Management (IAM) resources by using\nVPC Service Controls:\n\n- Custom roles\n- Service account keys\n- Service accounts\n- Workload identity pools\n- Deny policies\n- Policy bindings for principal access boundary policies\n\n### How VPC Service Controls works with IAM\n\nWhen you restrict IAM with a perimeter, only actions\nthat use the IAM API are restricted. These actions\ninclude the following:\n\n- Managing custom IAM roles\n- Managing workload identity pools\n- Managing service accounts and keys\n- Managing deny policies\n- Managing policy bindings for principal access boundary policies\n\nThe perimeter *doesn't* restrict actions related to workforce\npools and principal access boundary policies because those resources\nare created at the organization level.\n\nThe perimeter also *doesn't* restrict allow policy management for resources\nowned by other services, like Resource Manager projects, folders, and organizations\nor Compute Engine virtual machine instances. To restrict allow policy\nmanagement for these resources, create a perimeter that restricts the service\nthat owns the resources. For a list of resources that accept allow policies and\nthe services that own them, see [Resource types that accept allow\npolicies](/iam/docs/resource-types-with-policies).\n\nAdditionally, the perimeter *doesn't* restrict actions that use other APIs,\nincluding the following:\n\n- IAM Policy Simulator API\n- IAM Policy Troubleshooter API\n\n\u003c!-- --\u003e\n\n- Security Token Service API\n- Service Account Credentials API (including the legacy `signBlob` and `signJwt` methods in the IAM API)\n\nFor more details about how VPC Service Controls works with\nIAM, see the [IAM entry in the\nVPC Service Controls supported products table](/vpc-service-controls/docs/supported-products#table_iam).\n\nHelp secure the Security Token Service API\n------------------------------------------\n\nYou can help secure token exchanges by using VPC Service Controls.\n| **Note:** VPC Service Controls only restricts token exchanges if the [audience](/iam/docs/reference/sts/rest/v1/TopLevel/token#body.request_body.FIELDS.audience) in the request is a project-level resource. For example, it does not restrict requests for [downscoped tokens](/iam/docs/downscoping-short-lived-credentials), because those requests have no audience.\n\nWhen you restrict the Security Token Service API with a perimeter, only the\nfollowing entities can exchange tokens:\n\n- Resources within the same perimeter as the workload identity pool you're using to exchange the token\n- Principals with the attributes defined in the service perimeter\n\nWhen you create an [ingress\nor egress rule](/vpc-service-controls/docs/ingress-egress-rules) to allow token exchanges, you must set the identity type to\n`ANY_IDENTITY` because the [token](/iam/docs/reference/sts/rest/v1/TopLevel/token)\nmethod has no authorization.\n\nFor more details about how VPC Service Controls works with\nIAM, see the [Security Token Service entry in the\nVPC Service Controls supported products table](/vpc-service-controls/docs/supported-products#table_sts).\n\nHelp secure the Privileged Access Manager API\n---------------------------------------------\n\n\n| **Preview\n| --- Using VPC Service Controls with Privileged Access Manager**\n|\n|\n| This feature is subject to the \"Pre-GA Offerings Terms\" in the General Service Terms section\n| of the [Service Specific Terms](/terms/service-terms#1).\n|\n| Pre-GA features are available \"as is\" and might have limited support.\n|\n| For more information, see the\n| [launch stage descriptions](/products#product-launch-stages).\n\n\u003cbr /\u003e\n\nYou can help secure your Privileged Access Manager resources by using\nVPC Service Controls. Privileged Access Manager resources include the following:\n\n- Entitlements\n- Grants\n\nVPC Service Controls doesn't support adding folder-level or organization-level\nresources into a service perimeter. You can't use a perimeter to protect\nfolder-level or organization-level Privileged Access Manager resources. VPC Service Controls\nprotects project-level Privileged Access Manager resources.\n\nFor more details about how VPC Service Controls works with\nPrivileged Access Manager, see the [Privileged Access Manager entry in the\nVPC Service Controls supported products table](/vpc-service-controls/docs/supported-products#table_pam).\n\nWhat's next\n-----------\n\n- Learn how to [create a service perimeter](/vpc-service-controls/docs/create-service-perimeters)."]]
