[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-05 (世界標準時間)。"],[],[],null,["| Premium and Enterprise [service tiers](/security-command-center/docs/service-tiers) (requires [organization-level activation](/security-command-center/docs/activate-scc-overview#overview_of_organization-level_activation))\n\nThis page describes the preventative and detective policies that are included in\nthe v.1.0 version of the predefined posture for Virtual Private Cloud (VPC)\nnetworking, extended. This posture includes two policy sets:\n\n- A policy set that includes organization policy constraints that apply to\n VPC networking.\n\n- A policy set that includes Security Health Analytics detectors that apply to\n VPC networking.\n\nYou can use this predefined posture to configure a security posture that helps\nprotect VPC networking. If you want to deploy this predefined\nposture, you must customize some of the policies so that they apply to your\nenvironment.\n\nOrganization policy constraints\n\nThe following table describes the organization policy constraints that are\nincluded in this posture.\n\n| Policy | Description | Compliance standard |\n|---------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------|\n| `compute.skipDefaultNetworkCreation` | This boolean constraint disables the automatic creation of a default VPC network and default firewall rules in each new project, ensuring that network and firewall rules are intentionally created. The value is `true` to avoid creating the default VPC network. | NIST SP 800-53 control: SC-7 and SC-8 |\n| `ainotebooks.restrictPublicIp` | This boolean constraint restricts public IP access to newly created Vertex AI Workbench notebooks and instances. By default, public IP addresses can access Vertex AI Workbench notebooks and instances. The value is `true` to restrict public IP access on new Vertex AI Workbench notebooks and instances. | NIST SP 800-53 control: SC-7 and SC-8 |\n| `compute.disableNestedVirtualization` | This boolean constraint disables nested virtualization for all Compute Engine VMs to decrease the security risk related to unmonitored nested instances. The value is `true` to turn off VM nested virtualization. | NIST SP 800-53 control: SC-7 and SC-8 |\n| `compute.vmExternalIpAccess` | This list constraint defines the Compute Engine VM instances that are allowed to use external IP addresses. By default, all VM instances are allowed to use external IP addresses. The constraint uses the format `projects/`\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e`/zones/`\u003cvar translate=\"no\"\u003eZONE\u003c/var\u003e`/instances/`\u003cvar translate=\"no\"\u003eINSTANCE\u003c/var\u003e. You must configure this value when you adopt this predefined posture. | NIST SP 800-53 control: SC-7 and SC-8 |\n| `ainotebooks.restrictVpcNetworks` | This list constraint defines the VPC networks a user can select when creating new Vertex AI Workbench instances where this constraint is enforced. You must configure this value when you adopt this predefined posture. | NIST SP 800-53 control: SC-7 and SC-8 |\n| `compute.vmCanIpForward` | This list constraint defines the VPC networks that a user can select when creating new Vertex AI Workbench instances. By default, you can create a Vertex AI Workbench instance with any VPC network. You must configure this value when you adopt this predefined posture. | NIST SP 800-53 control: SC-7 and SC-8 |\n\nSecurity Health Analytics detectors\n\nThe following table describes the Security Health Analytics detectors that are included in\nthe predefined posture. For more information about these detectors, see\n[Vulnerability findings](/security-command-center/docs/concepts-vulnerabilities-findings).\n\n| Detector name | Description |\n|------------------------------------------|-------------------------------------------------------------------------------------------------------------|\n| `FIREWALL_NOT_MONITORED` | This detector checks whether log metrics and alerts aren't configured to monitor VPC firewall rule changes. |\n| `NETWORK_NOT_MONITORED` | This detector checks whether log metrics and alerts aren't configured to monitor VPC network changes. |\n| `ROUTE_NOT_MONITORED` | This detector checks whether log metrics and alerts aren't configured to monitor VPC network route changes. |\n| `DNS_LOGGING_DISABLED` | This detector checks whether DNS logging is enabled on the VPC network. |\n| `FLOW_LOGS_DISABLED` | This detector checks whether flow logs are enabled on the VPC subnetwork. |\n| `VPC_FLOW_LOGS_SETTINGS_NOT_RECOMMENDED` | This detector checks whether the `enableFlowLogs` property of VPC subnetworks is missing or set to `false`. |\n\nView the posture template\n\n\nTo view the posture template for VPC networking, extended, do the following: \n\ngcloud\n\n\nBefore using any of the command data below,\nmake the following replacements:\n\n- \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e: the numeric ID of the organization\n\n\nExecute the\n\n\n[`gcloud scc posture-templates\ndescribe`](/sdk/gcloud/reference/scc/posture-templates/describe)\n\n\ncommand:\n\nLinux, macOS, or Cloud Shell \n\n```bash\ngcloud scc posture-templates describe \\\n organizations/ORGANIZATION_ID/locations/global/postureTemplates/vpc_networking_extended\n```\n\nWindows (PowerShell) \n\n```bash\ngcloud scc posture-templates describe `\n organizations/ORGANIZATION_ID/locations/global/postureTemplates/vpc_networking_extended\n```\n\nWindows (cmd.exe) \n\n```bash\ngcloud scc posture-templates describe ^\n organizations/ORGANIZATION_ID/locations/global/postureTemplates/vpc_networking_extended\n```\n\nThe response contains the posture template.\n\nREST\n\n\nBefore using any of the request data,\nmake the following replacements:\n\n- \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e: the numeric ID of the organization\n\n\nHTTP method and URL:\n\n```\nGET https://securityposture.googleapis.com/v1/organizations/ORGANIZATION_ID/locations/global/postureTemplates/vpc_networking_extended\n```\n\nTo send your request, expand one of these options:\n\ncurl (Linux, macOS, or Cloud Shell) **Note:** The following command assumes that you have logged in to the `gcloud` CLI with your user account by running [`gcloud init`](/sdk/gcloud/reference/init) or [`gcloud auth login`](/sdk/gcloud/reference/auth/login) , or by using [Cloud Shell](/shell/docs), which automatically logs you into the `gcloud` CLI . You can check the currently active account by running [`gcloud auth list`](/sdk/gcloud/reference/auth/list).\n\n\nExecute the following command:\n\n```\ncurl -X GET \\\n -H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n \"https://securityposture.googleapis.com/v1/organizations/ORGANIZATION_ID/locations/global/postureTemplates/vpc_networking_extended\"\n```\n\nPowerShell (Windows) **Note:** The following command assumes that you have logged in to the `gcloud` CLI with your user account by running [`gcloud init`](/sdk/gcloud/reference/init) or [`gcloud auth login`](/sdk/gcloud/reference/auth/login) . You can check the currently active account by running [`gcloud auth list`](/sdk/gcloud/reference/auth/list).\n\n\nExecute the following command:\n\n```\n$cred = gcloud auth print-access-token\n$headers = @{ \"Authorization\" = \"Bearer $cred\" }\n\nInvoke-WebRequest `\n -Method GET `\n -Headers $headers `\n -Uri \"https://securityposture.googleapis.com/v1/organizations/ORGANIZATION_ID/locations/global/postureTemplates/vpc_networking_extended\" | Select-Object -Expand Content\n```\n\nThe response contains the posture template.\n\nWhat's next\n\n- [Create a security posture using this predefined posture](/security-command-center/docs/how-to-use-security-posture)."]]
