Configura conectores en proyectos de servicio de VPC compartida
Organiza tus páginas con colecciones
Guarda y categoriza el contenido según tus preferencias.
Si tu organización usa una VPC compartida, puedes configurar conectores de Acceso a VPC sin servidores en el proyecto de servicio o en el proyecto host. En esta guía, se muestra cómo configurar un conector en el proyecto de servicio.
Otorga permisos a cuentas de servicio en tus proyectos de servicio
Para cada proyecto de servicio que usará conectores de VPC, un administrador de VPC compartida debe otorgar la función de usuario de la red de Compute (compute.networkUser) en el proyecto host al proyecto de servicio de las cuentas de servicio cloudservices y vpcaccess.
Cuando usas la VPC compartida, el administrador de VPC compartida debe crear una subred para cada conector. Puedes seguir la documentación sobre cómo agregar una subred para agregar una subred /28 a la red de VPC compartida. Esta subred debe estar en la misma región que los servicios sin servidores que usarán el conector.
[[["Fácil de comprender","easyToUnderstand","thumb-up"],["Resolvió mi problema","solvedMyProblem","thumb-up"],["Otro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Información o código de muestra incorrectos","incorrectInformationOrSampleCode","thumb-down"],["Faltan la información o los ejemplos que necesito","missingTheInformationSamplesINeed","thumb-down"],["Problema de traducción","translationIssue","thumb-down"],["Otro","otherDown","thumb-down"]],["Última actualización: 2025-05-30 (UTC)"],[],[],null,["# Configure connectors in Shared VPC service projects\n\nIf your organization uses Shared VPC, you can set up a\nServerless VPC Access connector in either the service project or the\nhost project. This guide shows how to set up a connector in the service project.\n\nIf you need to set up a connector in the host project, see\n[Configure connectors in the host project](/run/docs/configuring/shared-vpc-host-project).\nTo learn about the advantages of each method, see\n[Connecting to a Shared VPC network](/run/docs/configuring/connecting-shared-vpc).\n\nAt a high level, you must take the following steps:\n\n1. [Grant permissions](#grant-permissions)\n2. [Create a subnet](#subnet)\n3. In the page [Configuring Serverless VPC Access](/vpc/docs/configure-serverless-vpc-access), complete the steps in the following sections:\n - [Create a Serverless VPC Access connector](/vpc/docs/configure-serverless-vpc-access#create-connector)\n - [Configure your serverless environment to use a connector](/vpc/docs/configure-serverless-vpc-access#configure-environment)\n - [Configure firewall rules for connectors](/vpc/docs/configure-serverless-vpc-access#restrict-access)\n\nGrant permissions to service accounts in your service projects\n--------------------------------------------------------------\n\nFor each service project that will use VPC Connectors, a Shared VPC\nAdmin must grant the Compute Network User\nrole ([`compute.networkUser`](/compute/docs/access/iam#compute.networkUser)) in the\nhost project to the service project `cloudservices` and `vpcaccess` service\naccounts.\n\nTo grant the role:\n\n1. Use these commands:\n\n ```bash\n gcloud projects add-iam-policy-binding HOST_PROJECT_ID \\\n --role \"roles/compute.networkUser\" \\\n --member \"serviceAccount:service-\u003cvar translate=\"no\"\u003eSERVICE_PROJECT_NUMBER\u003c/var\u003e@gcp-sa-vpcaccess.iam.gserviceaccount.com\"\n ``` \n\n ```bash\n gcloud projects add-iam-policy-binding HOST_PROJECT_ID \\\n --role \"roles/compute.networkUser\" \\\n --member \"serviceAccount:\u003cvar translate=\"no\"\u003eSERVICE_PROJECT_NUMBER\u003c/var\u003e@cloudservices.gserviceaccount.com\"\n ```\n2. If the `@gcp-sa-vpcaccess` service account does not exist, turn on the\n Serverless VPC Access API in the service project and try again:\n\n ```bash\n gcloud services enable vpcaccess.googleapis.com\n ```\n\n \u003cbr /\u003e\n\nIf you prefer not to grant these service accounts access to the entire\nShared VPC network and would rather only grant access to specific subnets, you\ncan instead [grant these roles to these service accounts on specific subnets only](/vpc/docs/shared-vpc#svc_proj_admins).\n\nCreate a subnet\n---------------\n\nWhen using Shared VPC, the Shared VPC Admin must create a subnet\nfor each connector. Follow the documentation in\n[adding a subnet](/vpc/docs/create-modify-vpc-networks#add-subnets) to add a `/28`\nsubnet to the Shared VPC network. This subnet must be in the same region\nas the serverless services that will use the connector.\n\nNext steps\n----------\n\n- In the page [Configuring Serverless VPC Access](/vpc/docs/configure-serverless-vpc-access), complete the steps in the following sections:\n - [Create a Serverless VPC Access connector](/vpc/docs/configure-serverless-vpc-access#create-connector).\n - [Configure your serverless environment to use a connector](/vpc/docs/configure-serverless-vpc-access#configure-environment).\n- Use network tags to [restrict connector VM access to VPC resources](/run/docs/configuring/vpc-connectors#connector-to-resource)."]]
