如需确定错误是否与 VPC Service Controls 相关，请检查您是否已启用 VPC Service Controls 并且是否将其应用于您尝试使用的项目和服务。如需验证项目和服务是否受 VPC Service Controls 保护，请检查资源层次结构中相应级别的 VPC Service Controls 政策。
假设这样一个示例场景，您间接使用在服务边界内的项目中被 VPC Service Controls 标记为受限服务的服务。在这种情况下，VPC Service Controls 可能会拒绝访问。
服务通常会传播来自其依赖项的错误消息。如果您遇到以下错误，则表示 VPC Service Controls 存在问题。
Cloud Storage：403: Request violates VPC Service Controls.
BigQuery：403: VPC Service Controls: Request is prohibited by
organization's policy.
其他服务：403: Request is prohibited by organization's policy.
使用错误的唯一 ID
与 Google Cloud 控制台不同，gcloud 命令行工具会为 VPC Service Controls 错误返回唯一 ID。如需查找其他错误的日志条目，请使用元数据过滤日志。
由 VPC Service Controls 生成的错误包含用于标识相关审核日志的唯一 ID。
如需使用唯一 ID 获取有关错误的信息，请执行以下操作：
在 Google Cloud 控制台中，前往服务边界内触发该错误的项目的 Cloud Logging 页面。
gcloudloggingread\'protoPayload.metadata.@type:"type.googleapis.com/google.cloud.audit.VpcServiceControlAuditMetadata" AND timestamp>="2019-03-22T23:59:59Z" AND timestamp<="2019-03-26T00:00:00Z"'
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[],[],null,["This page describes how you can find VPC Service Controls errors using\nCloud Logging.\n\nVPC Service Controls helps mitigate data exfiltration risks by isolating\nmulti-tenant Google Cloud services. For more information, see [Overview of\nVPC Service Controls](/vpc-service-controls/docs/overview).\n\nDetermine if an error is due to VPC Service Controls\n\nVPC Service Controls can modify the properties of Google Cloud and\nhave cascading effects across services. This can make it difficult to debug\nissues, especially if you don't know what to look for.\n\nThe [service perimeter](/vpc-service-controls/docs/service-perimeters) changes can take up to 30 minutes to\npropagate and take effect. When the changes have propagated, access to the\nservices restricted in the perimeter isn't allowed to cross the perimeter\nboundary unless explicitly authorized.\n\nTo determine if an error is related to VPC Service Controls, check whether\nyou have enabled VPC Service Controls and applied it to the projects and\nservices you are attempting to use. To verify whether the projects and services\nare protected by VPC Service Controls, check the VPC Service Controls\npolicy at that level of resource hierarchy.\n\nConsider an example scenario in which you indirectly use a service that is\nmarked as a *restricted service* by VPC Service Controls in a project that\nis inside a service perimeter. In such a case, VPC Service Controls might be\ndenying access.\n\nUsually, services propagate error messages from their dependencies. If you\nencounter one of the following errors, it indicates a problem with\nVPC Service Controls.\n\n- **Cloud Storage:** `403: Request violates VPC Service Controls.`\n\n- **BigQuery:** `403: VPC Service Controls: Request is prohibited by\n organization's policy.`\n\n- **Other services:** `403: Request is prohibited by organization's policy.`\n\nUse the error's unique ID\n\nUnlike the Google Cloud console, the `gcloud` command-line tool returns a unique ID for\nVPC Service Controls errors. To locate log entries for other errors, [filter the\nlogs using metadata](#metadata-filter).\n\nAn error generated by VPC Service Controls includes a unique ID that is used to\nidentify relevant audit logs.\n\nTo obtain information about an error using the unique ID, do the following:\n\n1. In the Google Cloud console, go to the **Cloud Logging** page for the\n project inside the service perimeter that triggered the error.\n\n [Go to Cloud Logging](https://console.cloud.google.com/logs/query)\n2. In the search-filter field, enter the error's unique ID.\n\nYou can see the relevant log entry.\n\nFilter logs using metadata\n\nYou can use the [Logs Explorer](/logging/docs/view/logs-explorer-interface) to find errors related to\nVPC Service Controls. You can use the [Logging query language](/logging/docs/view/logging-query-language)\nto retrieve the logs. For information about building queries, see [Building\nqueries by using the Logging query language](/logging/docs/view/building-queries). \n\nConsole\n\nTo obtain the last 24 hours of VPC Service Controls errors in\nLogging, do the following:\n\n1. In the Google Cloud console, go to the **Cloud Logging** page.\n\n [Go to Cloud Logging](https://console.cloud.google.com/logs/query)\n2. Make sure that you are in the project that is inside the service\n perimeter.\n\n3. In the search-filter field, enter the following:\n\n protoPayload.metadata.@type:\"type.googleapis.com/google.cloud.audit.VpcServiceControlAuditMetadata\"\n\n4. In the **Resource** menu, select **Audited Resource**.\n\n5. In the time-range selector menu, select **Last 24 hours**.\n\n6. Optional: To find the VPC Service Controls errors that\n have occurred during a different period, use the **time-range\n selector** menu.\n\ngcloud\n\n- To obtain the last 24 hours of VPC Service Controls errors, run the\n following command:\n\n gcloud logging read 'protoPayload.metadata.@type:\"type.googleapis.com/google.cloud.audit.VpcServiceControlAuditMetadata\"'\n\n By default, the `read` command is limited to the last 24 hours. To obtain\n VPC Service Controls logs for a different period, use one of the\n following commands:\n- To retrieve logs that were generated within a certain period from the\n current date, run the following command:\n\n gcloud logging read \\\n 'protoPayload.metadata.@type:\"type.googleapis.com/google.cloud.audit.VpcServiceControlAuditMetadata\"' \\\n --freshness=\u003cvar translate=\"no\"\u003eDURATION\u003c/var\u003e\n\n \u003cvar translate=\"no\"\u003eDURATION\u003c/var\u003e is a formatted period of time. For more information\n about formatting, see [relative duration and time formats](/sdk/gcloud/reference/topic/datetimes#Relative-duration-date)\n for gcloud CLI.\n- To retrieve all VPC Service Controls errors that have occurred in the\n past week, run the following command:\n\n gcloud logging read \\\n 'protoPayload.metadata.@type:\"type.googleapis.com/google.cloud.audit.VpcServiceControlAuditMetadata\"' \\\n --freshness=7d\n\n- To retrieve logs that were generated between specific dates, run the\n following command:\n\n gcloud logging read \\\n 'protoPayload.metadata.@type:\"type.googleapis.com/google.cloud.audit.VpcServiceControlAuditMetadata\" AND\n timestamp\u003e=\"\u003cvar translate=\"no\"\u003eSTART_DATETIME\u003c/var\u003e\" AND\n timestamp\u003c=\"\u003cvar translate=\"no\"\u003eEND_DATETIME\u003c/var\u003e\"'\n\n \u003cvar translate=\"no\"\u003eSTART_DATETIME\u003c/var\u003e and \u003cvar translate=\"no\"\u003eEND_DATETIME\u003c/var\u003e are formatted\n date and time strings. For more information about formatting, see\n [absolute date and time formats](/sdk/gcloud/reference/topic/datetimes#Absolute-date)\n for gcloud CLI.\n\n For example, to obtain all VPC Service Controls errors that have occurred\n between March 22, 2019 and March 26, 2019: \n\n gcloud logging read \\\n 'protoPayload.metadata.@type:\"type.googleapis.com/google.cloud.audit.VpcServiceControlAuditMetadata\" AND\n timestamp\u003e=\"2019-03-22T23:59:59Z\" AND\n timestamp\u003c=\"2019-03-26T00:00:00Z\"'\n\nWhat's next\n\n- [Diagnose issues by using the VPC Service Controls troubleshooter](/vpc-service-controls/docs/troubleshooter)\n- [Diagnose an access denial event using the VPC Service Controls violation analyzer](/vpc-service-controls/docs/violation-analyzer) ([Preview](https://cloud.google.com/products/#product-launch-stages))\n- [Troubleshoot common VPC Service Controls issues](/vpc-service-controls/docs/troubleshooting)\n- [Troubleshoot common issues related to other Google Cloud services](/vpc-service-controls/docs/troubleshoot-services-within-perimeter)"]]
