[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[],[],null,["# Context-aware access with ingress rules\n\nContext-aware access ingress rule setups allow access to resources\nbased on client attributes such as network origin (IP address or VPC network),\nidentity type (service account or user), identity, and device data. Access is\ndefined by ingress rules.\n\nFor an overview of ingress and egress rules, see [Ingress and egress rules](/vpc-service-controls/docs/ingress-egress-rules).\n\nFor instructions on how to apply ingress and egress rule policies, see [Configuring ingress and egress policies](/vpc-service-controls/docs/configuring-ingress-egress-policies).\n\nConfiguration examples of context-aware access use cases\n--------------------------------------------------------\n\nThis section contains the following examples of context-aware access:\n\n1. [Allow human users to access BigQuery from the internet and only specific service accounts access from a specified IP range](/vpc-service-controls/docs/context-aware-access#allow_human_users_to_access_bigquery_from_the_internet_and_only_specific_service_accounts_access_from_a_specified_ip_range)\n2. [Allow employees to query BigQuery from trusted devices over the internet and a specific service account to privately load data to a Cloud Storage bucket (source data)](/vpc-service-controls/docs/context-aware-access#allow_employees_to_query_bigquery_from_trusted_devices_over_the_internet_and_a_specific_service_account_to_privately_load_data_to_a_cloud_storage_bucket_source_data)\n\n### Allow human users to access BigQuery from the internet and only specific service accounts access from a specified IP range\n\nAssume that you have defined the following perimeter, found by [listing the perimeter](/vpc-service-controls/docs/manage-service-perimeters#list-and-describe)\nwith gcloud: \n\n```\nname: accessPolicies/222/servicePerimeters/Example\nstatus:\n resources:\n - projects/111\n restrictedServices:\n - bigquery.googleapis.com\n - storage.googleapis.com\n vpcAccessibleServices:\n enableRestriction: true\n allowedServices:\n - RESTRICTED_SERVICES\ntitle: Example\n```\n\nWe also assume that an access level called CorpDatacenters has been defined.\nCorpDatacenters, in this example, is a whitelisted range of IPs of corporate\ndata centers that access from which service accounts are allowed.\n\nHere is the directional policy to allow all humans and a specific set of service\naccounts, limited to a particular set of IPs (defined by an access level): \n\n```\necho \"\"\"\n- ingressFrom:\n identities:\n - serviceAccount:my-sa@my-project.iam.gserviceaccount.com\n sources:\n - accessLevel: accessPolicies/222/accessLevels/CorpDatacenters\n ingressTo:\n operations:\n - serviceName: bigquery.googleapis.com\n methodSelectors:\n - method: \\\"*\\\"\n resources:\n - \\\"*\\\"\n- ingressFrom:\n identityType: ANY_USER_ACCOUNT\n sources:\n - accessLevel: \\\"*\\\"\n ingressTo:\n operations:\n - serviceName: bigquery.googleapis.com\n methodSelectors:\n - method: \\\"*\\\"\n resources:\n - \\\"*\\\"\n\"\"\" \u003e ingress.yaml\n```\n\nApply the ingress rules by running the following command: \n\n```\ngcloud access-context-manager perimeters update Example --set-ingress-policies=ingress.yaml\n```\n\n### Allow employees to query BigQuery and privately load data to a Cloud Storage bucket\n\nAssume that you have defined the following perimeter, found by [listing the perimeter](/vpc-service-controls/docs/manage-service-perimeters#list-and-describe)\nwith gcloud: \n\n```\nname: accessPolicies/222/servicePerimeters/Example\nstatus:\n resources:\n - projects/111\n restrictedServices:\n - bigquery.googleapis.com\n - storage.googleapis.com\n vpcAccessibleServices:\n enableRestriction: true\n allowedServices:\n - RESTRICTED_SERVICES\ntitle: Example\n```\n\nHere is the directional policy to allow humans to access BigQuery views\nfrom trusted devices (using a Access Level) and a specific service account\nprivate to access Cloud Storage from an authorized VPC network: \n\n```\necho \"\"\"\n- ingressFrom:\n identities:\n - serviceAccount:my-sa@my-project.iam.gserviceaccount.com\n sources:\n - resource: projects/111\n ingressTo:\n operations:\n - serviceName: storage.googleapis.com\n methodSelectors:\n - method: google.storage.Write\n - method: google.storage.objects.create\n resources:\n - \\\"*\\\"\n\n- ingressFrom:\n identityType: ANY_SERVICE_ACCOUNT\n sources:\n - resource: //compute.googleapis.com/projects/my-network-project/global/networks/top-tier-vpc-network\n ingressTo:\n operations:\n - serviceName: storage.googleapis.com\n methodSelectors:\n - method: google.storage.Write\n - method: google.storage.objects.create\n resources:\n - \\\"*\\\"\n\n- ingressFrom:\n identityType: ANY_USER_ACCOUNT\n sources:\n - accessLevel: accessPolicies/222/accessLevels/TrustedDevices\n ingressTo:\n operations:\n - serviceName: bigquery.googleapis.com\n methodSelectors:\n - permission: bigquery.tables.getData\n resources:\n - \\\"*\\\"\n\"\"\" \u003e ingress.yaml\n```\n\nApply the ingress rules by running the following command: \n\n```\ngcloud access-context-manager perimeters update Example --set-ingress-policies=ingress.yaml\n```\n\nFor information about VPC networks limitations when you use VPC\nnetworks in service perimeters, see [VPC network limitations](/vpc-service-controls/docs/vpc-perimeters-management#limitations)."]]
