VPC Service Controls 是一項 Google Cloud 功能，可讓您設定安全範圍，防範資料竊取。本指南說明如何在 VPC Service Controls 範圍中納入 Cloud Scheduler 工作。
限制
VPC Service Controls 支援 Cloud Scheduler 時，有下列限制。
強制執行的動作
VPC Service Controls 只會對下列動作強制執行：
建立 Cloud Scheduler 工作
Cloud Scheduler 工作更新
為什麼這一點很重要？
由於 VPC Service Controls 只會在建立及更新作業時強制執行，因此如果您在將 Cloud Scheduler 新增至 VPC Service Controls 範圍前建立作業，VPC Service Controls 不會自動強制執行。即使作業目標不屬於 VPC Service Controls 範圍，或不是支援的目標，作業仍會繼續執行。如要對所有 Cloud Scheduler 工作強制執行 VPC Service Controls，請按照下列步驟操作：
如果您未在將 Cloud Scheduler 新增至 VPC Service Controls 範圍前刪除這些工作，工作會繼續執行，但不會強制執行 VPC Service Controls。請參閱本文的「強制執行的動作」。
舉例來說，如果您有以不支援的目標 (例如 Cloud Run 自訂網域) 為目標的 Cloud Scheduler 工作，在您將 Cloud Scheduler 新增至 VPC Service Controls 範圍後，該工作會繼續執行，但不會受到 VPC Service Controls 保護。如果現有作業的目標位於 VPC Service Controls 範圍外，也會發生相同情況。
新增必要的 IAM 角色
這是必要旗標，如要使用 VPC Service Controls，Cloud Scheduler 服務帳戶必須具備 Cloud Scheduler Service Agent IAM 角色。系統會自動為您的專案建立 Cloud Scheduler 服務帳戶。如要確認或授予 Cloud Scheduler 服務代理 IAM 角色，請按照下列步驟操作：
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[],[],null,["# Secure cron jobs with VPC Service Controls\n\n[VPC Service Controls](/vpc-service-controls/docs/overview) is a Google Cloud feature\nthat lets you set up a secure perimeter to guard against data exfiltration.\nThis guide shows how to include Cloud Scheduler jobs in a\nVPC Service Controls perimeter.\n\nLimitations\n-----------\n\nThe following limitations apply to VPC Service Controls support for\nCloud Scheduler.\n\n### Enforced actions\n\nVPC Service Controls is only enforced on the following actions:\n\n- Cloud Scheduler job creation\n- Cloud Scheduler job updates\n\n#### Why does this matter?\n\nBecause VPC Service Controls is only enforced on job creation and job updates,\nVPC Service Controls is not automatically enforced for jobs that were\ncreated before you added Cloud Scheduler to your VPC Service Controls\nperimeter. Jobs continue to execute even if the job targets aren't part of your\nVPC Service Controls perimeter or are not [supported targets](#targets). To\nenforce VPC Service Controls for all Cloud Scheduler jobs:\n\n- **Jobs with targets that are either unsupported or are outside your\n perimeter:** Delete the jobs. In this document, see [Delete non-compliant jobs](#non-compliant).\n- **Jobs with targets that are both supported and inside your perimeter:** Run an update on each job after adding Cloud Scheduler to your perimeter. In this document, see [Enforce VPC Service Controls on pre-existing jobs](#preexisting).\n\n### Supported targets\n\nThe Cloud Scheduler integration with VPC Service Controls supports\nthe following targets. HTTP endpoints are supported if listed; however,\narbitrary HTTP endpoints are *not* supported.\n\n- Cloud Run functions---on the `functions.net` URL\n- Cloud Run---on the `run.app` URL for Cloud Run services. Cloud Run job targets are not supported. To learn about the difference between Cloud Run service and job resources, see [Services and jobs: two ways to run your code](/run/docs/overview/what-is-cloud-run#services-and-jobs).\n- Dataflow API---must be in the same Google Cloud project as your Cloud Scheduler job\n- Data Pipelines---must be in the same Google Cloud project as your Cloud Scheduler job\n- Pub/Sub---must be in the same Google Cloud project as your Cloud Scheduler job\n\nDelete non-compliant jobs\n-------------------------\n\nRecommended. Delete Cloud Scheduler jobs with targets that are\neither:\n\n- Unsupported (see [Supported targets](#targets))\n- Outside of the VPC Service Controls perimeter you plan to use\n\nFor instructions on deleting jobs, see\n[Delete a job](/scheduler/docs/creating#delete).\n\nIf you don't delete these jobs before adding Cloud Scheduler to\nyour VPC Service Controls perimeter, the jobs continue to run, but\nVPC Service Controls is not enforced on them. In this document, see\n[Enforced actions](#enforced-actions).\n\nFor example, if you have a Cloud Scheduler job that targets an\nunsupported target (such as a Cloud Run custom domain), the job\ncontinues to run after you add Cloud Scheduler to your\nVPC Service Controls perimeter, but it is not protected by VPC Service Controls. The\nsame is true for a pre-existing job with a target outside of your\nVPC Service Controls perimeter.\n\nAdd required IAM roles\n----------------------\n\nRequired. In order to use VPC Service Controls, the Cloud Scheduler\nservice account must have the **Cloud Scheduler Service Agent**\nIAM role. The Cloud Scheduler service account is created\nfor your project automatically. To verify that it has the Cloud Scheduler\nService Agent IAM role, or to grant this role, take the following\nsteps:\n\n1. In the Google Cloud console, go to **IAM**.\n\n [Go to IAM](https://console.cloud.google.com/iam-admin)\n2. Select the **Include Google-provided role grants** checkbox.\n\n3. In the filter, type **Cloud Scheduler Service Account**, and select this\n principal.\n\n4. Look at the **Role** column for the **Cloud Scheduler Service Account**\n principal. You can proceed if the following role is listed:\n\n - **Cloud Scheduler Service Agent**\n\n If the Cloud Scheduler Service Account role is not listed, click the\n **Edit** icon and grant the **Cloud Scheduler Service Agent** role to the\n Cloud Scheduler Service Account principal.\n\nSpecify a VPC Service Controls perimeter\n----------------------------------------\n\nRequired. You can use an existing perimeter or create a new perimeter to\nprotect your Cloud Scheduler jobs that have supported\ntargets. Both approaches give you the chance to specify services to restrict.\nSpecify the **Cloud Scheduler API**.\n\n- **Existing perimeters:** To update an existing VPC Service Controls perimeter\n to include Cloud Scheduler, follow the steps for\n [updating a service perimeter](/vpc-service-controls/docs/manage-service-perimeters#update).\n\n- **New perimeters:** To create a new perimeter for Cloud Scheduler,\n follow the steps to\n [create a service perimeter](/vpc-service-controls/docs/create-service-perimeters).\n\nEnforce VPC Service Controls on pre-existing jobs\n-------------------------------------------------\n\nRecommended. To enforce VPC Service Controls on Cloud Scheduler jobs\nthat you created before you added Cloud Scheduler to your\nVPC Service Controls perimeter, run an `update` on the job. You don't have to\nchange the job, but you must run the update in order for VPC Service Controls to\napply to the job and its future executions.\n\nYou can run an update for the job from the Google Cloud console (select\nthe job and use the **Edit** button), using the API, or with the\ngcloud CLI.\n\nTo enforce VPC Service Controls on a pre-existing job by using the\ngcloud CLI, run the following: \n\n### HTTP targets\n\n```bash\ngcloud scheduler jobs update http JOB_ID\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eJOB_ID\u003c/var\u003e: the ID of your job\n\n### Pub/Sub targets\n\n```bash\ngcloud scheduler jobs update pubsub JOB_ID\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eJOB_ID\u003c/var\u003e: the ID of your job"]]
