[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[],[],null,["# Context-aware access with ingress rules\n\nContext-aware access ingress rule setups allow access to resources\nbased on client attributes such as network origin (IP address or VPC network),\nidentity type (service account or user), identity, and device data. Access is\ndefined by ingress rules.\n\nFor an overview of ingress and egress rules, see [Ingress and egress rules](/vpc-service-controls/docs/ingress-egress-rules).\n\nFor instructions on how to apply ingress and egress rule policies, see [Configuring ingress and egress policies](/vpc-service-controls/docs/configuring-ingress-egress-policies).\n\nConfiguration examples of context-aware access use cases\n--------------------------------------------------------\n\nThis section contains the following examples of context-aware access:\n\n1. [Allow human users to access BigQuery from the internet and only specific service accounts access from a specified IP range](/vpc-service-controls/docs/context-aware-access#allow_human_users_to_access_bigquery_from_the_internet_and_only_specific_service_accounts_access_from_a_specified_ip_range)\n2. [Allow employees to query BigQuery from trusted devices over the internet and a specific service account to privately load data to a Cloud Storage bucket (source data)](/vpc-service-controls/docs/context-aware-access#allow_employees_to_query_bigquery_from_trusted_devices_over_the_internet_and_a_specific_service_account_to_privately_load_data_to_a_cloud_storage_bucket_source_data)\n\n### Allow human users to access BigQuery from the internet and only specific service accounts access from a specified IP range\n\nAssume that you have defined the following perimeter, found by [listing the perimeter](/vpc-service-controls/docs/manage-service-perimeters#list-and-describe)\nwith gcloud: \n\n```\nname: accessPolicies/222/servicePerimeters/Example\nstatus:\n resources:\n - projects/111\n restrictedServices:\n - bigquery.googleapis.com\n - storage.googleapis.com\n vpcAccessibleServices:\n enableRestriction: true\n allowedServices:\n - RESTRICTED_SERVICES\ntitle: Example\n```\n\nWe also assume that an access level called CorpDatacenters has been defined.\nCorpDatacenters, in this example, is a whitelisted range of IPs of corporate\ndata centers that access from which service accounts are allowed.\n\nHere is the directional policy to allow all humans and a specific set of service\naccounts, limited to a particular set of IPs (defined by an access level): \n\n```\necho \"\"\"\n- ingressFrom:\n identities:\n - serviceAccount:my-sa@my-project.iam.gserviceaccount.com\n sources:\n - accessLevel: accessPolicies/222/accessLevels/CorpDatacenters\n ingressTo:\n operations:\n - serviceName: bigquery.googleapis.com\n methodSelectors:\n - method: \\\"*\\\"\n resources:\n - \\\"*\\\"\n- ingressFrom:\n identityType: ANY_USER_ACCOUNT\n sources:\n - accessLevel: \\\"*\\\"\n ingressTo:\n operations:\n - serviceName: bigquery.googleapis.com\n methodSelectors:\n - method: \\\"*\\\"\n resources:\n - \\\"*\\\"\n\"\"\" \u003e ingress.yaml\n```\n\nApply the ingress rules by running the following command: \n\n```\ngcloud access-context-manager perimeters update Example --set-ingress-policies=ingress.yaml\n```\n\n### Allow employees to query BigQuery and privately load data to a Cloud Storage bucket\n\nAssume that you have defined the following perimeter, found by [listing the perimeter](/vpc-service-controls/docs/manage-service-perimeters#list-and-describe)\nwith gcloud: \n\n```\nname: accessPolicies/222/servicePerimeters/Example\nstatus:\n resources:\n - projects/111\n restrictedServices:\n - bigquery.googleapis.com\n - storage.googleapis.com\n vpcAccessibleServices:\n enableRestriction: true\n allowedServices:\n - RESTRICTED_SERVICES\ntitle: Example\n```\n\nHere is the directional policy to allow humans to access BigQuery views\nfrom trusted devices (using a Access Level) and a specific service account\nprivate to access Cloud Storage from an authorized VPC network: \n\n```\necho \"\"\"\n- ingressFrom:\n identities:\n - serviceAccount:my-sa@my-project.iam.gserviceaccount.com\n sources:\n - resource: projects/111\n ingressTo:\n operations:\n - serviceName: storage.googleapis.com\n methodSelectors:\n - method: google.storage.Write\n - method: google.storage.objects.create\n resources:\n - \\\"*\\\"\n\n- ingressFrom:\n identityType: ANY_SERVICE_ACCOUNT\n sources:\n - resource: //compute.googleapis.com/projects/my-network-project/global/networks/top-tier-vpc-network\n ingressTo:\n operations:\n - serviceName: storage.googleapis.com\n methodSelectors:\n - method: google.storage.Write\n - method: google.storage.objects.create\n resources:\n - \\\"*\\\"\n\n- ingressFrom:\n identityType: ANY_USER_ACCOUNT\n sources:\n - accessLevel: accessPolicies/222/accessLevels/TrustedDevices\n ingressTo:\n operations:\n - serviceName: bigquery.googleapis.com\n methodSelectors:\n - permission: bigquery.tables.getData\n resources:\n - \\\"*\\\"\n\"\"\" \u003e ingress.yaml\n```\n\nApply the ingress rules by running the following command: \n\n```\ngcloud access-context-manager perimeters update Example --set-ingress-policies=ingress.yaml\n```\n\nFor information about VPC networks limitations when you use VPC\nnetworks in service perimeters, see [VPC network limitations](/vpc-service-controls/docs/vpc-perimeters-management#limitations)."]]
