Configura la compatibilidad con Assured OSS para los Controles del servicio de VPC
Organiza tus páginas con colecciones
Guarda y categoriza el contenido según tus preferencias.
Si habilitas Assured Open Source Software (Assured OSS) dentro de un perímetro de servicio de Controles del servicio de VPC, debes configurar reglas de salida.
Este documento solo se aplica al nivel premium del software de código abierto garantizado.
ASSURED_OSS_EMAIL_ADDRESS: La dirección de correo electrónico de la cuenta de servicio que especificaste cuando configuraste Assured OSS.
ARTIFACT_REGISTRY_EMAIL_ADDRESS: Es la dirección de correo electrónico del agente de servicio de Artifact Registry.
OTHER_SERVICE_ACCOUNT_EMAIL_ADDRESS: Las direcciones de correo electrónico de otras cuentas de servicio que requieren acceso a los paquetes de código abierto.
USER_GROUP: Son los grupos que requieren acceso a los paquetes de código abierto. Por ejemplo, group:my-group@example.com o user:alex@example.com.
Configura la regla de salida cuando accedas a los metadatos de seguridad desde el bucket de Assured OSS
Completa esta tarea para la cuenta de usuario y la cuenta de servicio que usaste para configurar Assured OSS.
[[["Fácil de comprender","easyToUnderstand","thumb-up"],["Resolvió mi problema","solvedMyProblem","thumb-up"],["Otro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Información o código de muestra incorrectos","incorrectInformationOrSampleCode","thumb-down"],["Faltan la información o los ejemplos que necesito","missingTheInformationSamplesINeed","thumb-down"],["Problema de traducción","translationIssue","thumb-down"],["Otro","otherDown","thumb-down"]],["Última actualización: 2025-09-05 (UTC)"],[],[],null,["| Enterprise [service tier](/security-command-center/docs/service-tiers)\n\nIf you enable Assured Open Source Software (Assured OSS) within a VPC Service Controls service\nperimeter, you must configure egress rules.\n\nThis document applies to the premium tier of\nAssured Open Source Software only.\n\nFor more information, see [Configuring egress\npolicies](/vpc-service-controls/docs/configuring-ingress-egress-policies).\n\nBefore you begin\n\n1. Make sure that you have the [required roles to configure\n VPC Service Controls](/vpc-service-controls/docs/access-control) at the\n organization level.\n\n2. Make sure that you know the following information:\n\n - The service account that you used to set up Assured OSS.\n - The [Artifact Registry service agent](/artifact-registry/docs/ar-service-account) that was created automatically when you set up Assured OSS.\n - The user account that set up Assured OSS.\n\nConfigure the egress rule when downloading binaries from Assured OSS repositories\n\nComplete this task for your Artifact Registry repositories.\n\nConfigure the following egress rule: \n\n - egressFrom:\n identities:\n - serviceAccount: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eASSURED_OSS_EMAIL_ADDRESS\u003c/span\u003e\u003c/var\u003e\n - serviceAccount: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eARTIFACT_REPOSITORY_EMAIL_ADDRESS\u003c/span\u003e\u003c/var\u003e\n - serviceAccount: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eOTHER_SERVICE_ACCOUNT_EMAIL_ADDRESS\u003c/span\u003e\u003c/var\u003e\n - \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eUSER_GROUP\u003c/span\u003e\u003c/var\u003e\n egressTo:\n operations:\n - methodSelectors:\n - method: artifactregistry.googleapis.com/MavenRead\n - method: artifactregistry.googleapis.com/NPMRead\n - method: artifactregistry.googleapis.com/PythonRead\n serviceName: artifactregistry.googleapis.com\n resources:\n - projects/855934472549\n - projects/107114433875\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eASSURED_OSS_EMAIL_ADDRESS\u003c/var\u003e: the email address of the\n service account that you specified when you set up Assured OSS.\n\n- \u003cvar translate=\"no\"\u003eARTIFACT_REGISTRY_EMAIL_ADDRESS\u003c/var\u003e: the email\n address of the Artifact Registry service agent.\n\n- \u003cvar translate=\"no\"\u003eOTHER_SERVICE_ACCOUNT_EMAIL_ADDRESS\u003c/var\u003e: the email\n addresses of other service accounts that require access to the open source\n packages.\n\n- \u003cvar translate=\"no\"\u003eUSER_GROUP\u003c/var\u003e: the groups that require\n access to the open source packages. For example, `group:my-group@example.com`\n or `user:alex@example.com`.\n\nConfigure the egress rule when accessing security metadata from the Assured OSS bucket\n\nComplete this task for the user account and service account that you used to\nset up Assured OSS.\n\nConfigure the following egress rule: \n\n - egressFrom:\n identities:\n - serviceAccount: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eASSURED_OSS_EMAIL_ADDRESS\u003c/span\u003e\u003c/var\u003e\n - user: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eASSURED_OSS_USER_EMAIL_ADDRESS\u003c/span\u003e\u003c/var\u003e\n egressTo:\n operations:\n - methodSelectors:\n - method: google.storage.objects.get\n - method: google.storage.objects.list\n serviceName: storage.googleapis.com\n resources:\n - projects/107114433875\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eASSURED_OSS_EMAIL_ADDRESS\u003c/var\u003e: the email address of the\n service account that you specified when you set up Assured OSS.\n\n- \u003cvar translate=\"no\"\u003eASSURED_OSS_USER_EMAIL_ADDRESS\u003c/var\u003e: the email\n address of the user account that you used to set up Assured OSS.\n\nConfigure the egress rule when setting up Pub/Sub notifications\n\nComplete this task to set up [Pub/Sub notifications for\nAssured OSS](/assured-open-source-software/docs/use-notifications).\n\nCreate the following egress rule: \n\n - egressFrom:\n - serviceAccount: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eASSURED_OSS_EMAIL_ADDRESS\u003c/span\u003e\u003c/var\u003e\n - user: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eASSURED_OSS_USER_EMAIL_ADDRESS\u003c/span\u003e\u003c/var\u003e\n egressTo:\n operations:\n - methodSelectors:\n - method: Subscriber.CreateSubscription\n serviceName: pubsub.googleapis.com\n resources:\n - projects/107114433875\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eASSURED_OSS_EMAIL_ADDRESS\u003c/var\u003e: the email address of the\n service account that you specified when you set up Assured OSS.\n\n- \u003cvar translate=\"no\"\u003eASSURED_OSS_USER_EMAIL_ADDRESS\u003c/var\u003e: the email\n address of the user account that you used to set up Assured OSS.\n\nAfter you configure the subscription, you can remove this egress rule.\n\nWhat's next\n\n- Learn more about [configuring egress policies](/vpc-service-controls/docs/configuring-ingress-egress-policies).\n\n- [Enable Security Command Center with VPC Service Controls](/vpc-service-controls/docs/supported-products#table_security_command_center)."]]
