Autoriser VM Threat Detection à accéder aux périmètres VPC Service Controls
Restez organisé à l'aide des collections
Enregistrez et classez les contenus selon vos préférences.
Ce document explique comment ajouter des règles d'entrée et de sortie pour permettre à Virtual Machine Threat Detection d'analyser les VM dans vos périmètres VPC Service Controls. Effectuez cette tâche si votre organisation utilise VPC Service Controls pour restreindre les services dans les projets que vous souhaitez que la détection des menaces sur les VM analyse. Pour en savoir plus sur VM Threat Detection, consultez la présentation de VM Threat Detection.
Avant de commencer
Make sure that you have the following role or roles on the organization:
Access Context Manager Editor
(roles/accesscontextmanager.policyEditor).
In the Principal column, find all rows that identify you or a group that
you're included in. To learn which groups you're included in, contact your
administrator.
For all rows that specify or include you, check the Role column to see whether
the list of roles includes the required roles.
Dans le champ Nouveaux comptes principaux, saisissez votre identifiant utilisateur.
Il s'agit généralement de l'adresse e-mail d'un compte Google.
Dans la liste Sélectionner un rôle, sélectionnez un rôle.
Pour attribuer des rôles supplémentaires, cliquez sur addAjouter un autre rôle et ajoutez chaque rôle supplémentaire.
Cliquez sur Enregistrer.
Créer les règles d'entrée et de sortie
Pour autoriser VM Threat Detection à analyser les VM dans les périmètres VPC Service Controls, ajoutez les règles d'entrée et de sortie requises dans ces périmètres. Effectuez ces étapes pour chaque périmètre que vous souhaitez analyser avec VM Threat Detection.
Sauf indication contraire, le contenu de cette page est régi par une licence Creative Commons Attribution 4.0, et les échantillons de code sont régis par une licence Apache 2.0. Pour en savoir plus, consultez les Règles du site Google Developers. Java est une marque déposée d'Oracle et/ou de ses sociétés affiliées.
Dernière mise à jour le 2025/09/05 (UTC).
[[["Facile à comprendre","easyToUnderstand","thumb-up"],["J'ai pu résoudre mon problème","solvedMyProblem","thumb-up"],["Autre","otherUp","thumb-up"]],[["Difficile à comprendre","hardToUnderstand","thumb-down"],["Informations ou exemple de code incorrects","incorrectInformationOrSampleCode","thumb-down"],["Il n'y a pas l'information/les exemples dont j'ai besoin","missingTheInformationSamplesINeed","thumb-down"],["Problème de traduction","translationIssue","thumb-down"],["Autre","otherDown","thumb-down"]],["Dernière mise à jour le 2025/09/05 (UTC)."],[],[],null,["| Premium and Enterprise [service tiers](/security-command-center/docs/service-tiers)\n\nThis document describes how to add ingress and egress rules to allow\nVirtual Machine Threat Detection to scan VMs in your VPC Service Controls perimeters. Perform this task\nif your organization uses VPC Service Controls to restrict services in projects that\nyou want VM Threat Detection to scan. For more information about\nVM Threat Detection, see\n[VM Threat Detection overview](/security-command-center/docs/concepts-vm-threat-detection-overview).\n\nBefore you begin\n\n\nMake sure that you have the following role or roles on the organization:\n\nAccess Context Manager Editor\n(`roles/accesscontextmanager.policyEditor`).\n\nCheck for the roles\n\n1.\n In the Google Cloud console, go to the **IAM** page.\n\n [Go to IAM](https://console.cloud.google.com/projectselector/iam-admin/iam?supportedpurview=organizationId)\n2. Select the organization.\n3.\n In the **Principal** column, find all rows that identify you or a group that\n you're included in. To learn which groups you're included in, contact your\n administrator.\n\n4. For all rows that specify or include you, check the **Role** column to see whether the list of roles includes the required roles.\n\nGrant the roles\n\n1.\n In the Google Cloud console, go to the **IAM** page.\n\n [Go to IAM](https://console.cloud.google.com/projectselector/iam-admin/iam?supportedpurview=organizationId)\n2. Select the organization.\n3. Click person_add **Grant access**.\n4.\n In the **New principals** field, enter your user identifier.\n\n This is typically the email address for a Google Account.\n\n5. In the **Select a role** list, select a role.\n6. To grant additional roles, click add **Add\n another role** and add each additional role.\n7. Click **Save**.\n\nCreate the egress and ingress rules\n\nTo allow VM Threat Detection to scan the VMs in VPC Service Controls perimeters, add\nthe required egress and ingress rules in those perimeters. Perform these steps\nfor each perimeter that you want VM Threat Detection to scan.\n\nFor more information, see\n[Updating ingress and egress policies for a service perimeter](/vpc-service-controls/docs/configuring-ingress-egress-policies#console)\nin the VPC Service Controls documentation.\n\n\nConsole\n\n1. In the Google Cloud console go to the **VPC Service Controls** page.\n\n\n [Go to VPC Service Controls](https://console.cloud.google.com/security/service-perimeter)\n2. Select your organization or project.\n3. If you selected an organization, click **Select an access policy** and then select the access policy associated with the perimeter that you want to update.\n4. Click the name of the perimeter that you want to update.\n\n\n To find the service perimeter you need to modify, you can check your logs for entries\n that show `RESOURCES_NOT_IN_SAME_SERVICE_PERIMETER` violations. In those\n entries, check the `servicePerimeterName` field: \n\n ```\n accessPolicies/ACCESS_POLICY_ID/servicePerimeters/SERVICE_PERIMETER_NAME\n ```\n5. Click edit **Edit perimeter**.\n6. Click **Egress policy**.\n7. Click **Add an egress rule**.\n8. In the **FROM** section, set the following details:\n\n 1. For **Identity** , select **Select identities \\& groups**.\n 2. Click **Add identities**\n 3.\n Enter the email address of the\n\n [Security Center service agent](/security-command-center/docs/access-control-org#service-agent).\n\n\n The service agent's address has the\n following format:\n\n ```\n service-org-ORGANIZATION_ID@security-center-api.iam.gserviceaccount.com\n ```\n\n Replace \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e with your organization ID.\n 4. Select the service agent or press \u003ckbd\u003eENTER\u003c/kbd\u003e, and then click **Add identities**.\n9. In the **TO** section, set the following details:\n\n 1. For **Project** , select **All projects**.\n 2. For **Operations or IAM roles** , select **Select operations**.\n 3. Click **Add operations**, and then add the following operations:\n\n - Add the **compute.googleapis.com** service.\n 1. Click **Select methods**.\n 2. Select the\n\n **DisksService.Insert** method.\n\n 3. Click **Add selected methods**.\n10. Click **Ingress policy**.\n11. Click **Add an ingress rule**.\n12. In the **FROM** section, set the following details:\n\n 1. For **Identity** , select **Select identities \\& groups**.\n 2. Click **Add identities**\n 3.\n Enter the email address of the\n\n [Security Center service agent](/security-command-center/docs/access-control-org#service-agent).\n\n\n The service agent's address has the\n following format:\n\n ```\n service-org-ORGANIZATION_ID@security-center-api.iam.gserviceaccount.com\n ```\n\n Replace \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e with your organization ID.\n 4. Select the service agent or press \u003ckbd\u003eENTER\u003c/kbd\u003e, and then click **Add identities**.\n 5. For **Sources** , select **All sources**\n13. In the **TO** section, set the following details:\n\n 1. For **Project** , select **All projects**.\n 2. For **Operations or IAM roles** , select **Select operations**.\n 3. Click **Add operations**, and then add the following operations:\n\n - Add the **compute.googleapis.com** service.\n 1. Click **Select methods**.\n 2. Select the\n\n following methods:\n\n - **DisksService.Insert**\n - **InstancesService.AggregatedList**\n - **InstancesService.List**\n 3. Click **Add selected methods**.\n14. Click **Save**.\n\ngcloud\n\n1.\n If a quota project isn't already set, then set it. Choose a project that has the\n Access Context Manager API enabled.\n\n ```bash\n gcloud config set billing/quota_project QUOTA_PROJECT_ID\n ```\n\n\n Replace \u003cvar translate=\"no\"\u003eQUOTA_PROJECT_ID\u003c/var\u003e with the ID of the project that you\n want to use for billing and quota.\n2. Create a file named `egress-rule.yaml` with the following contents:\n\n ```yaml\n - egressFrom:\n identities:\n - serviceAccount:service-org-\u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e@security-center-api.iam.gserviceaccount.com\n egressTo:\n operations:\n - serviceName: compute.googleapis.com\n methodSelectors:\n - method: DisksService.Insert\n resources:\n - '*'\n ```\n\n Replace \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e with your organization ID.\n3. Create a file named `ingress-rule.yaml` with the following contents:\n\n ```yaml\n - ingressFrom:\n identities:\n - serviceAccount:service-org-\u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e@security-center-api.iam.gserviceaccount.com\n sources:\n - accessLevel: '*'\n ingressTo:\n operations:\n - serviceName: compute.googleapis.com\n methodSelectors:\n - method: DisksService.Insert\n - method: InstancesService.AggregatedList\n - method: InstancesService.List\n resources:\n - '*'\n ```\n\n Replace \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e with your organization ID.\n4. Add the egress rule to the perimeter:\n\n ```bash\n gcloud access-context-manager perimeters update PERIMETER_NAME \\\n --set-egress-policies=egress-rule.yaml\n ```\n\n Replace the following:\n -\n \u003cvar translate=\"no\"\u003ePERIMETER_NAME\u003c/var\u003e: the name of the perimeter. For example,\n `accessPolicies/1234567890/servicePerimeters/example_perimeter`.\n\n\n To find the service perimeter you need to modify, you can check your logs for\n entries that show `RESOURCES_NOT_IN_SAME_SERVICE_PERIMETER` violations.\n In those entries, check the `servicePerimeterName` field: \n\n ```\n accessPolicies/ACCESS_POLICY_ID/servicePerimeters/SERVICE_PERIMETER_NAME\n ```\n5. Add the ingress rule to the perimeter:\n\n ```bash\n gcloud access-context-manager perimeters update PERIMETER_NAME \\\n --set-ingress-policies=ingress-rule.yaml\n ```\n\n Replace the following:\n -\n \u003cvar translate=\"no\"\u003ePERIMETER_NAME\u003c/var\u003e: the name of the perimeter. For example,\n `accessPolicies/1234567890/servicePerimeters/example_perimeter`.\n\n\n To find the service perimeter you need to modify, you can check your logs for\n entries that show `RESOURCES_NOT_IN_SAME_SERVICE_PERIMETER` violations.\n In those entries, check the `servicePerimeterName` field: \n\n ```\n accessPolicies/ACCESS_POLICY_ID/servicePerimeters/SERVICE_PERIMETER_NAME\n ```\n\n\nSee\n[Ingress and egress rules](/vpc-service-controls/docs/ingress-egress-rules) for\nmore information.\n\nWhat's next\n\n- Learn how to [use VM Threat Detection](/security-command-center/docs/how-to-use-vm-threat-detection)."]]
