Configure conetores em projetos de serviço de VPC partilhada
Mantenha tudo organizado com as coleções
Salve e categorize o conteúdo com base nas suas preferências.
Se a sua organização usar a VPC partilhada, pode configurar um conetor do Acesso a VPC sem servidor no projeto de serviço ou no projeto anfitrião. Este guia mostra como configurar um conector no projeto de serviço.
Conceda autorizações a contas de serviço nos seus projetos de serviço
Para cada projeto de serviço que vai usar os conetores de VPC, um administrador de VPC partilhada tem de conceder a função de utilizador da rede de computação (compute.networkUser) no projeto anfitrião às contas de serviço cloudservices e vpcaccess do projeto de serviço.
Quando usa a VPC partilhada, o administrador da VPC partilhada tem de criar uma sub-rede para cada conector. Siga a documentação para adicionar uma sub-rede e adicionar uma /28
sub-rede à rede VPC partilhada. Esta sub-rede tem de estar na mesma região que os serviços sem servidor que vão usar o conector.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-08-21 UTC."],[],[],null,["# Configure connectors in Shared VPC service projects\n\nIf your organization uses Shared VPC, you can set up a\nServerless VPC Access connector in either the service project or the\nhost project. This guide shows how to set up a connector in the service project.\n\nIf you need to set up a connector in the host project, see\n[Configure connectors in the host project](/run/docs/configuring/shared-vpc-host-project).\nTo learn about the advantages of each method, see\n[Connecting to a Shared VPC network](/run/docs/configuring/connecting-shared-vpc).\n\nAt a high level, you must take the following steps:\n\n1. [Grant permissions](#grant-permissions)\n2. [Create a subnet](#subnet)\n3. In the page [Configuring Serverless VPC Access](/vpc/docs/configure-serverless-vpc-access), complete the steps in the following sections:\n - [Create a Serverless VPC Access connector](/vpc/docs/configure-serverless-vpc-access#create-connector)\n - [Configure your serverless environment to use a connector](/vpc/docs/configure-serverless-vpc-access#configure-environment)\n - [Configure firewall rules for connectors](/vpc/docs/configure-serverless-vpc-access#restrict-access)\n\nGrant permissions to service accounts in your service projects\n--------------------------------------------------------------\n\nFor each service project that will use VPC Connectors, a Shared VPC\nAdmin must grant the Compute Network User\nrole ([`compute.networkUser`](/compute/docs/access/iam#compute.networkUser)) in the\nhost project to the service project `cloudservices` and `vpcaccess` service\naccounts.\n\nTo grant the role:\n\n1. Use these commands:\n\n ```bash\n gcloud projects add-iam-policy-binding HOST_PROJECT_ID \\\n --role \"roles/compute.networkUser\" \\\n --member \"serviceAccount:service-\u003cvar translate=\"no\"\u003eSERVICE_PROJECT_NUMBER\u003c/var\u003e@gcp-sa-vpcaccess.iam.gserviceaccount.com\"\n ``` \n\n ```bash\n gcloud projects add-iam-policy-binding HOST_PROJECT_ID \\\n --role \"roles/compute.networkUser\" \\\n --member \"serviceAccount:\u003cvar translate=\"no\"\u003eSERVICE_PROJECT_NUMBER\u003c/var\u003e@cloudservices.gserviceaccount.com\"\n ```\n2. If the `@gcp-sa-vpcaccess` service account does not exist, turn on the\n Serverless VPC Access API in the service project and try again:\n\n ```bash\n gcloud services enable vpcaccess.googleapis.com\n ```\n\n \u003cbr /\u003e\n\nIf you prefer not to grant these service accounts access to the entire\nShared VPC network and would rather only grant access to specific subnets, you\ncan instead [grant these roles to these service accounts on specific subnets only](/vpc/docs/shared-vpc#svc_proj_admins).\n\nCreate a subnet\n---------------\n\nWhen using Shared VPC, the Shared VPC Admin must create a subnet\nfor each connector. Follow the documentation in\n[adding a subnet](/vpc/docs/create-modify-vpc-networks#add-subnets) to add a `/28`\nsubnet to the Shared VPC network. This subnet must be in the same region\nas the serverless services that will use the connector.\n\nNext steps\n----------\n\n- In the page [Configuring Serverless VPC Access](/vpc/docs/configure-serverless-vpc-access), complete the steps in the following sections:\n - [Create a Serverless VPC Access connector](/vpc/docs/configure-serverless-vpc-access#create-connector).\n - [Configure your serverless environment to use a connector](/vpc/docs/configure-serverless-vpc-access#configure-environment).\n- Use network tags to [restrict connector VM access to VPC resources](/run/docs/configuring/vpc-connectors#connector-to-resource)."]]
