MODE는 버킷 IP 필터링 구성의 모드입니다. 유효한 값은 Enabled, Disabled입니다. Enabled로 설정하면 IP 필터링 규칙이 버킷에 적용됩니다. 버킷에 들어오는 모든 요청은 이러한 규칙에 따라 평가됩니다. Disabled로 설정되었으면 들어오는 모든 요청이 버킷에 액세스하도록 허용됩니다.
RANGE_CIDR은 버킷 액세스가 허용된 공용 네트워크 IPv4 또는 IPv6 주소 범위입니다. 주소 범위를 하나만 입력하거나 여러 개를 목록으로 입력할 수 있습니다.
PROJECT_ID는 가상 프라이빗 클라우드(VPC) 네트워크가 속한 프로젝트 ID입니다. 여러 VPC 네트워크를 구성하려면 각 네트워크가 속한 프로젝트를 지정해야 합니다.
NETWORK_NAME은 버킷 액세스가 허용된 VPC 네트워크의 이름입니다. 여러 VPC 네트워크를 구성하려면 각 네트워크의 이름을 지정해야 합니다.
ALLOW_CROSS_ORG_VPCS는 vpcNetworkSources에 정의된 VPC 네트워크가 다른 조직에서 시작되도록 허용할지 여부를 나타내는 불리언 값입니다. 이 필드는 선택사항입니다. true로 설정하면 요청이 조직 간 VPC 네트워크를 허용합니다. false로 설정하면 요청이 VPC 네트워크를 버킷과 동일한 조직으로 제한합니다. 지정되지 않은 경우 기본값은 false입니다. 이 필드는 vpcNetworkSources가 비어 있지 않은 경우에만 적용됩니다.
ALLOW_ALL_SERVICE_AGENT_ACCESS는 IP 필터 구성과 관계없이 서비스 에이전트가 버킷에 액세스하도록 허용할지 여부를 나타내는 불리언 값입니다. 값이 true인 경우 다른 Google Cloud 서비스는 서비스 에이전트를 사용하여 IP 기반 검증 없이 버킷에 액세스할 수 있습니다.
MODE는 IP 필터 구성의 상태입니다. 유효한 값은 Enabled 및 Disabled입니다. Enabled로 설정하면 IP 필터링 규칙이 버킷에 적용되고 버킷에 대해 들어오는 모든 요청이 이러한 규칙에 따라 평가됩니다. Disabled로 설정하면 들어오는 모든 요청이 버킷 및 해당 데이터에 액세스할 수 있습니다.
RANGE_CIDR은 버킷 액세스가 허용된 공용 네트워크 IPv4 또는 IPv6 주소 범위입니다. 주소 범위를 하나만 입력하거나 여러 개를 목록으로 입력할 수 있습니다.
PROJECT_ID는 VPC 네트워크가 속한 프로젝트 ID입니다. 여러 VPC 네트워크를 구성하려면 각 네트워크가 속한 프로젝트를 지정해야 합니다.
NETWORK_NAME은 버킷 액세스가 허용된 VPC 네트워크의 이름입니다. 여러 VPC 네트워크를 구성하려면 각 네트워크의 이름을 지정해야 합니다.
ALLOW_ALL_SERVICE_AGENT_ACCESS는 IP 필터 구성과 관계없이 서비스 에이전트가 버킷에 액세스하도록 허용할지 여부를 나타내는 불리언 값입니다. 값이 true인 경우 다른 Google Cloud 서비스는 서비스 에이전트를 사용하여 IP 기반 검증 없이 버킷에 액세스할 수 있습니다.
ALLOW_CROSS_ORG_VPCS는 vpcNetworkSources 목록에 정의된 VPC 네트워크가 다른 조직에서 시작되도록 허용할지 여부를 나타내는 불리언 값입니다. 이 필드는 선택사항입니다. true로 설정하면 요청이 조직 간 VPC 네트워크를 허용합니다. false로 설정하면 요청이 VPC 네트워크를 버킷과 동일한 조직으로 제한합니다. 지정되지 않은 경우 기본값은 false입니다. 이 필드는 vpcNetworkSources가 비어 있지 않은 경우에만 적용됩니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-05(UTC)"],[],[],null,["# Create or update IP filtering rules on an existing bucket\n\nThis page describes how to create or update the [bucket IP filtering](/storage/docs/ip-filtering-overview) rules\non an existing bucket.\n\nRequired roles\n--------------\n\nTo get the required permissions for updating the IP filtering rules on a bucket,\nask your administrator to grant you the Storage Admin (`roles/storage.admin`)\nrole on the bucket. This role contains the permissions required to update bucket\nIP filtering rules.\n\nTo see the exact permissions that are required, expand the\n**Required permissions** section: \n\n#### Required permissions\n\n- `storage.buckets.update`\n- `storage.buckets.setIpFilter`\n\nYou can also get these permissions with [custom roles](/iam/docs/creating-custom-roles). You might be able to get these permissions with other predefined roles as well. To see which roles are associated with which permissions,\nrefer to [IAM roles for Cloud Storage](/iam/docs/understanding-roles).\n\nFor instructions on granting roles for projects, see [Manage access to\nprojects](/storage/docs/access-control/using-iam-permissions#bucket-iam).\n\nCreate or update IP filtering rules on an existing bucket\n---------------------------------------------------------\n\n### gcloud\n\n1. Verify that you have the Google Cloud CLI version 526.0.0 or later installed:\n\n gcloud version | head -n1\n\n2. If you have an earlier gcloud CLI version installed, update the version:\n\n gcloud components update --version=526.0.0\n\n3. Create a JSON file that defines rules for incoming requests. For\n examples and information about how to structure the bucket IP filtering\n rules, see [Bucket IP filtering configurations](/storage/docs/create-ip-filter#ip-filtering-configurations).\n\n \u003cbr /\u003e\n\n ```json\n {\n \"mode\":\"\u003cvar translate=\"no\"\u003eMODE\u003c/var\u003e\",\n \"publicNetworkSource\":{\n \"allowedIpCidrRanges\":[\n \"\u003cvar translate=\"no\"\u003eRANGE_CIDR\u003c/var\u003e\",\n \"...\"\n ]\n },\n \"vpcNetworkSources\":[\n {\n \"network\":\"projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e/global/networks/\u003cvar translate=\"no\"\u003eNETWORK_NAME\u003c/var\u003e\",\n \"allowedIpCidrRanges\":[\n \"\u003cvar translate=\"no\"\u003eRANGE_CIDR\u003c/var\u003e\",\n \"...\"\n ]\n },\n \"...\"\n ],\n \"allowCrossOrgVpcs\": ALLOW_CROSS_ORG_VPCS,\n \"allowAllServiceAgentAccess\": ALLOW_ALL_SERVICE_AGENT_ACCESS\n }\n \n ```\n\n \u003cbr /\u003e\n\n Where:\n - \u003cvar translate=\"no\"\u003eMODE\u003c/var\u003e is the mode of the bucket IP\n filtering configuration. Valid values are `Enabled`\n and `Disabled`. When set to `Enabled`, IP\n filtering rules are applied to a bucket. Any incoming request to\n the bucket is evaluated against these rules. When set to\n `Disabled`, all incoming requests are allowed to\n access the bucket.\n\n - \u003cvar translate=\"no\"\u003eRANGE_CIDR\u003c/var\u003e is a public network IPv4 or IPv6\n address range that's allowed to access the bucket. You can\n enter one or multiple address ranges as a list.\n\n - \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e is the project ID where\n the Virtual Private Cloud (VPC) network exists. To configure\n multiple VPC networks, you need to specify\n the project where each network is located.\n\n - \u003cvar translate=\"no\"\u003eNETWORK_NAME\u003c/var\u003e is the name of the\n VPC network that is allowed to access the\n bucket. To configure multiple VPC networks,\n you need to specify a name for each network.\n\n - \u003cvar translate=\"no\"\u003eALLOW_CROSS_ORG_VPCS\u003c/var\u003e is a boolean value\n that indicates whether to allow VPC networks\n that are defined in `vpcNetworkSources` to originate\n from a different organization. This field is optional. If set to `true`, the\n request allows cross-organizational VPC\n networks. If set to `false`, the request restricts\n the VPC networks to the same organization as the\n bucket. If not specified, the default value is\n `false`. This field applies only if `vpcNetworkSources` is not empty.\n\n - \u003cvar translate=\"no\"\u003eALLOW_ALL_SERVICE_AGENT_ACCESS\u003c/var\u003e is a\n boolean value that indicates whether to allow [service\n agents](/iam/docs/service-agents) to access the bucket,\n regardless of the IP filter configuration. If the value is\n `true`, other Google Cloud services can use\n service agents to access the bucket without IP-based validation.\n\n4. To update bucket IP filtering rules, run the [`gcloud alpha storage\n buckets update`](/sdk/gcloud/reference/alpha/storage/buckets/update) command in your development environment:\n\n ```\n gcloud alpha storage buckets update gs://BUCKET_NAME --ip-filter-file=IP_FILTER_CONFIG_FILE\n ```\n\n Where:\n - \u003cvar translate=\"no\"\u003eBUCKET_NAME\u003c/var\u003e is the name of your bucket. For example, `my-bucket`.\n - \u003cvar translate=\"no\"\u003eIP_FILTER_CONFIG_FILE\u003c/var\u003e is the JSON file created in the preceding step.\n\n### REST APIs\n\n### JSON API\n\n1. Have gcloud CLI [installed and initialized](/sdk/docs/install), which lets\n you generate an access token for the `Authorization` header.\n\n\n2.\n\n Create a JSON file that contains the settings for the bucket, which\n must include the `name` and the `ipFilter` configuration fields for the bucket. For examples and information about how to structure the bucket IP filtering rules, see [Bucket IP filtering configurations](/storage/docs/create-ip-filter#ip-filtering-configurations). \n\n ```json\n {\n \"ipFilter\":{\n \"mode\":\"\u003cvar translate=\"no\"\u003eMODE\u003c/var\u003e\",\n \"publicNetworkSource\":{\n \"allowedIpCidrRanges\":[\n \"\u003cvar translate=\"no\"\u003eRANGE_CIDR\u003c/var\u003e\",\n \"...\"\n ]\n },\n \"vpcNetworkSources\":[\n {\n \"network\":\"projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e/global/networks/\u003cvar translate=\"no\"\u003eNETWORK_NAME\u003c/var\u003e\",\n \"allowedIpCidrRanges\":[\n \"\u003cvar translate=\"no\"\u003eRANGE_CIDR\u003c/var\u003e\",\n \"...\"\n ]\n },\n \"...\"\n ],\n \"allowCrossOrgVpcs\": ALLOW_CROSS_ORG_VPCS,\n \"allowAllServiceAgentAccess\": ALLOW_ALL_SERVICE_AGENT_ACCESS\n }\n }\n ```\n\n Where:\n - \u003cvar translate=\"no\"\u003eMODE\u003c/var\u003e is the state of the IP filter\n configuration. Valid values are `Enabled` and\n `Disabled`. When set to `Enabled`, IP\n filtering rules are applied to a bucket and all incoming\n requests to the bucket are evaluated against these rules. When\n set to `Disabled`, all incoming requests can access\n the bucket and its data without any evaluation.\n\n - \u003cvar translate=\"no\"\u003eRANGE_CIDR\u003c/var\u003e is a public network IPv4 or\n IPv6 address range that's allowed to access the bucket. You can\n enter one or multiple address ranges as a list.\n\n - \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e is the project ID where the\n VPC network exists. To configure multiple\n VPC networks, you need to specify the project\n where each network is located.\n\n - \u003cvar translate=\"no\"\u003eNETWORK_NAME\u003c/var\u003e is the name of the\n VPC network that is allowed to access the\n bucket. To configure multiple VPC networks, you\n need to specify a name for each network.\n\n - \u003cvar translate=\"no\"\u003eALLOW_ALL_SERVICE_AGENT_ACCESS\u003c/var\u003e is a\n boolean value that indicates whether to allow [service\n agents](/iam/docs/service-agents) to access the bucket,\n regardless of the IP filter configuration. If the value is\n `true`, other Google Cloud services can use\n service agents to access the bucket without IP-based validation.\n\n - \u003cvar translate=\"no\"\u003eALLOW_CROSS_ORG_VPCS\u003c/var\u003e is a boolean value that indicates whether to allow VPC networks that are defined in the `vpcNetworkSources` list to originate from a different organization. This field is optional. If set to `true`, the request allows cross-organizational VPC networks. If set to `false`, the request restricts the VPC networks to the same organization as the bucket. If not specified, the default value is `false`. This field applies only if `vpcNetworkSources` is not empty.\n\n3. Use [`cURL`](http://curl.haxx.se/) to call the [JSON API](/storage/docs/json_api) with a [PATCH bucket](/storage/docs/json_api/v1/buckets/patch) request:\n\n ```\n curl -X PATCH --data-binary @JSON_FILE_NAME \\\n -H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n -H \"Content-Type: application/json\" \\\n \"https://storage.googleapis.com/storage/v1/b/BUCKET_NAME?project=PROJECT_IDENTIFIER\"\n ```\n\n Where:\n - \u003cvar translate=\"no\"\u003eJSON_FILE_NAME\u003c/var\u003e is name of the JSON file you created in the preceding step.\n - \u003cvar translate=\"no\"\u003eBUCKET_NAME\u003c/var\u003e is the name of your bucket.\n - \u003cvar translate=\"no\"\u003ePROJECT_IDENTIFIER\u003c/var\u003e is the ID or number of the project with which your bucket is associated. For example, `my-project`.\n\nWhat's next\n-----------\n\n- [List bucket IP filtering rules](/storage/docs/list-ip-filter).\n- [Disable bucket IP filtering rules](/storage/docs/disable-ip-filtering).\n\nTry it for yourself\n-------------------\n\n\nIf you're new to Google Cloud, create an account to evaluate how\nCloud Storage performs in real-world\nscenarios. New customers also get $300 in free credits to run, test, and\ndeploy workloads.\n[Try Cloud Storage free](https://console.cloud.google.com/freetrial)"]]
