Mengonfigurasi Secure Source Manager di perimeter Kontrol Layanan VPC
Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Panduan ini menunjukkan cara menggunakan Secure Source Manager Private Service Connect dalam perimeter Kontrol Layanan VPC untuk melindungi dari pemindahan data yang tidak sah.
Panduan ini ditujukan untuk administrator jaringan, arsitek keamanan, dan
tenaga profesional operasi cloud yang ingin memitigasi risiko kehilangan data
sensitif.
Untuk mendapatkan izin yang diperlukan untuk mengonfigurasi Secure Source Manager dalam perimeter Kontrol Layanan VPC, minta administrator Anda untuk memberi Anda peran IAM berikut di organisasi:
Pengaktifan Kontrol Layanan VPC yang tidak hati-hati dapat menyebabkan masalah pada aplikasi yang ada dan berpotensi menyebabkan gangguan. Sebaiknya rencanakan pengaktifan dengan cermat dan berikan waktu yang cukup untuk mengumpulkan data, melakukan pengujian, dan menganalisis log pelanggaran. Pastikan pemangku kepentingan dari tim operasi Kontrol Layanan VPC dan tim aplikasi Anda tersedia untuk tugas ini.
Di halaman Kontrol Layanan VPC, pilih perimeter yang Anda tambahkan project Anda ke dalamnya.
Di halaman Detail konfigurasi yang diterapkan Kontrol Layanan VPC, klik Edit
di bagian Layanan yang dibatasi.
Klik Tambahkan layanan.
Dalam dialog Tentukan layanan yang akan dibatasi, pilih kotak centang di samping
Secure Source Manager. Anda dapat menggunakan kueri filter untuk menemukan Secure Source Manager dalam daftar.
Klik Simpan.
Setelah Anda memperbarui perimeter layanan, perlu waktu hingga 30 menit agar perubahan dapat diterapkan dan berlaku. Selama waktu ini, perimeter dapat memblokir permintaan dengan pesan error berikut:
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[],[],null,["# Configure Secure Source Manager in a VPC Service Controls perimeter\n\nThis guide shows how to use a Private Service Connect\nSecure Source Manager in a [VPC Service Controls](/vpc-service-controls/docs/overview)\nperimeter to guard against data exfiltration.\n\nThis guide is intended for network administrators, security architects, and\ncloud operations professionals who want to mitigate the risk of sensitive\ndata loss.\n\nBefore you begin\n----------------\n\n1. [Create a Private Service Connect Secure Source Manager instance](/secure-source-manager/docs/create-private-service-connect-instance).\n2. [Create a VPC Service Controls perimeter](/vpc-service-controls/docs/create-service-perimeters).\n\n### Required roles\n\n\nTo get the permissions that\nyou need to configure Secure Source Manager in a VPC Service Controls perimeter,\n\nask your administrator to grant you the\nfollowing IAM roles on the organization:\n\n- [Access Context Manager Admin role](/iam/docs/roles-permissions/accesscontextmanager#accesscontextmanager.policyAdmin) (`roles/accesscontextmanager.policyAdmin`)\n- [Project Creator](/iam/docs/roles-permissions/resourcemanager#resourcemanager.projectCreator) (`roles/resourcemanager.projectCreator`)\n\n\nFollow best practices\n---------------------\n\nCareless enablement of VPC Service Controls can cause problems with existing\napplications and could potentially cause an outage. We recommend that you plan\nenablement carefully and allow ample time to gather data, conduct tests, and\nanalyze violation logs. Make sure that stakeholders from your\nVPC Service Controls operations team and your applications team are available for\nthe task.\n\nFor more information on best practices, see\n[Best practices for enabling VPC Service Controls](/vpc-service-controls/docs/enable)\n\nAdd your project to the perimeter\n---------------------------------\n\n1. In the Google Cloud console, go to the **VPC Service Controls** page.\n\n [Go to VPC Service Controls](https://console.cloud.google.com/security/service-perimeter)\n2. On the **VPC Service Controls** page, select the perimeter you want to use\n to protect your project.\n\n3. On the **VPC Service Control enforced config detail** page, click **Edit**\n in the **resources to protect** section.\n\n4. Click **Resources to protect** and add your project ID.\n\n5. Click **Save**.\n\nAdd Secure Source Manager as a restricted service\n-------------------------------------------------\n\n1. In the Google Cloud console, go to the **VPC Service Controls** page.\n\n [Go to VPC Service Controls](https://console.cloud.google.com/security/service-perimeter)\n2. On the **VPC Service Controls** page, select the perimeter you added your\n project to.\n\n3. On the **VPC Service Control enforced config detail** page, click **Edit**\n in the **Restricted services** section.\n\n4. Click **Add services**.\n\n5. In the **Specify services to restrict** dialog, select the checkbox next to\n Secure Source Manager. You can use the filter query to locate Secure Source Manager in\n the list.\n\n6. Click **Save**.\n\nAfter you update a service perimeter, it can take up to 30 minutes for the\nchanges to propagate and take effect. During this time, the perimeter might\nblock requests with the following error message: \n\n Error 403: Request is prohibited by organization's policy.\n\nWhat's next\n-----------\n\n- Learn more about [Private Service Connect](/vpc/docs/private-service-connect).\n- Learn more about [Connecting to VMs without external IP addresses](/solutions/connecting-securely#external)."]]
