이 페이지에서는 Cloud Logging을 사용하여 VPC 서비스 제어 오류를 찾는 방법을 설명합니다.
VPC 서비스 제어는 멀티 테넌트 Google Cloud 서비스를 격리하여 데이터 무단 반출 위험을 줄일 수 있게 도와줍니다. 자세한 내용은 VPC 서비스 제어 개요를 참조하세요.
VPC 서비스 제어로 인한 오류인지 확인
VPC 서비스 제어를 사용하면 Google Cloud 속성을 수정할 수 있고 다양한 서비스에 광범위한 영향을 미칠 수 있습니다. 따라서 특히 조사할 대상을 모르면 문제를 디버깅하기 어려울 수 있습니다.
서비스 경계 변경사항은 전파되고 적용되는 데 최대 30분이 걸릴 수 있습니다. 변경사항이 전파되었으면 명시적으로 허용되지 않은 한 경계에서 제한된 서비스에 대한 액세스가 경계 범위를 넘을 수 없습니다.
오류가 VPC 서비스 제어와 관련되었는지 파악하려면 VPC 서비스 제어를 사용 설정한 후 사용하려는 프로젝트 및 서비스에 적용했는지 확인하세요. 프로젝트 및 서비스가 VPC 서비스 제어로 보호되는지 확인하려면 해당 리소스 계층 구조 수준에서 VPC 서비스 제어 정책을 확인합니다.
서비스 경계 내에 있는 프로젝트에서 VPC 서비스 제어에 의해 제한된 서비스로 표시된 서비스를 간접적으로 사용하는 시나리오 예시를 고려해보세요. 이 경우에는 VPC 서비스 제어가 액세스를 거부할 수 있습니다.
일반적으로 서비스는 종속 항목의 오류 메시지를 전파합니다. 다음 오류 중 하나가 발생하면 VPC 서비스 제어에 문제가 있음을 나타냅니다.
Cloud Storage:403: Request violates VPC Service Controls.
BigQuery:403: VPC Service Controls: Request is prohibited by
organization's policy.
기타 서비스:403: Request is prohibited by organization's policy.
오류의 고유 ID 사용
Google Cloud 콘솔과 달리 gcloud 명령줄 도구는 VPC 서비스 제어 오류의 고유 ID를 반환합니다. 다른 오류의 로그 항목을 찾으려면 메타데이터를 사용하여 로그를 필터링하세요.
VPC 서비스 제어에서 생성된 오류에는 관련 감사 로그를 식별하는 데 사용되는 고유 ID가 포함됩니다.
고유 ID를 사용하여 오류에 대한 정보를 가져오려면 다음을 수행합니다.
Google Cloud 콘솔에서 오류를 트리거한 서비스 경계 내 프로젝트의 Cloud Logging 페이지로 이동합니다.
START_DATETIME 및 END_DATETIME 형식은 날짜 및 시간 문자열로 지정됩니다. 형식 지정에 대한 자세한 내용은 gcloud CLI의 절대 날짜 및 시간 형식을 참조하세요.
예를 들어 2019년 3월 22일부터 2019년 3월 26일까지 발생한 모든 VPC 서비스 제어 오류를 확인하려면 다음을 사용하세요.
gcloudloggingread\'protoPayload.metadata.@type:"type.googleapis.com/google.cloud.audit.VpcServiceControlAuditMetadata" AND timestamp>="2019-03-22T23:59:59Z" AND timestamp<="2019-03-26T00:00:00Z"'
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[],[],null,["# Retrieve VPC Service Controls errors from audit logs\n\nThis page describes how you can find VPC Service Controls errors using\nCloud Logging.\n\nVPC Service Controls helps mitigate data exfiltration risks by isolating\nmulti-tenant Google Cloud services. For more information, see [Overview of\nVPC Service Controls](/vpc-service-controls/docs/overview).\n\nDetermine if an error is due to VPC Service Controls\n----------------------------------------------------\n\nVPC Service Controls can modify the properties of Google Cloud and\nhave cascading effects across services. This can make it difficult to debug\nissues, especially if you don't know what to look for.\n\nThe [service perimeter](/vpc-service-controls/docs/service-perimeters) changes can take up to 30 minutes to\npropagate and take effect. When the changes have propagated, access to the\nservices restricted in the perimeter isn't allowed to cross the perimeter\nboundary unless explicitly authorized.\n\nTo determine if an error is related to VPC Service Controls, check whether\nyou have enabled VPC Service Controls and applied it to the projects and\nservices you are attempting to use. To verify whether the projects and services\nare protected by VPC Service Controls, check the VPC Service Controls\npolicy at that level of resource hierarchy.\n\nConsider an example scenario in which you indirectly use a service that is\nmarked as a *restricted service* by VPC Service Controls in a project that\nis inside a service perimeter. In such a case, VPC Service Controls might be\ndenying access.\n\nUsually, services propagate error messages from their dependencies. If you\nencounter one of the following errors, it indicates a problem with\nVPC Service Controls.\n\n- **Cloud Storage:** `403: Request violates VPC Service Controls.`\n\n- **BigQuery:** `403: VPC Service Controls: Request is prohibited by\n organization's policy.`\n\n- **Other services:** `403: Request is prohibited by organization's policy.`\n\nUse the error's unique ID\n-------------------------\n\nUnlike the Google Cloud console, the `gcloud` command-line tool returns a unique ID for\nVPC Service Controls errors. To locate log entries for other errors, [filter the\nlogs using metadata](#metadata-filter).\n\nAn error generated by VPC Service Controls includes a unique ID that is used to\nidentify relevant audit logs.\n\nTo obtain information about an error using the unique ID, do the following:\n\n1. In the Google Cloud console, go to the **Cloud Logging** page for the\n project inside the service perimeter that triggered the error.\n\n [Go to Cloud Logging](https://console.cloud.google.com/logs/query)\n2. In the search-filter field, enter the error's unique ID.\n\nYou can see the relevant log entry.\n\nFilter logs using metadata\n--------------------------\n\nYou can use the [Logs Explorer](/logging/docs/view/logs-explorer-interface) to find errors related to\nVPC Service Controls. You can use the [Logging query language](/logging/docs/view/logging-query-language)\nto retrieve the logs. For information about building queries, see [Building\nqueries by using the Logging query language](/logging/docs/view/building-queries). \n\n### Console\n\nTo obtain the last 24 hours of VPC Service Controls errors in\nLogging, do the following:\n\n1. In the Google Cloud console, go to the **Cloud Logging** page.\n\n [Go to Cloud Logging](https://console.cloud.google.com/logs/query)\n2. Make sure that you are in the project that is inside the service\n perimeter.\n\n3. In the search-filter field, enter the following:\n\n protoPayload.metadata.@type:\"type.googleapis.com/google.cloud.audit.VpcServiceControlAuditMetadata\"\n\n4. In the **Resource** menu, select **Audited Resource**.\n\n5. In the time-range selector menu, select **Last 24 hours**.\n\n6. Optional: To find the VPC Service Controls errors that\n have occurred during a different period, use the **time-range\n selector** menu.\n\n### gcloud\n\n- To obtain the last 24 hours of VPC Service Controls errors, run the\n following command:\n\n gcloud logging read 'protoPayload.metadata.@type:\"type.googleapis.com/google.cloud.audit.VpcServiceControlAuditMetadata\"'\n\n By default, the `read` command is limited to the last 24 hours. To obtain\n VPC Service Controls logs for a different period, use one of the\n following commands:\n- To retrieve logs that were generated within a certain period from the\n current date, run the following command:\n\n gcloud logging read \\\n 'protoPayload.metadata.@type:\"type.googleapis.com/google.cloud.audit.VpcServiceControlAuditMetadata\"' \\\n --freshness=\u003cvar translate=\"no\"\u003eDURATION\u003c/var\u003e\n\n \u003cvar translate=\"no\"\u003eDURATION\u003c/var\u003e is a formatted period of time. For more information\n about formatting, see [relative duration and time formats](/sdk/gcloud/reference/topic/datetimes#Relative-duration-date)\n for gcloud CLI.\n- To retrieve all VPC Service Controls errors that have occurred in the\n past week, run the following command:\n\n gcloud logging read \\\n 'protoPayload.metadata.@type:\"type.googleapis.com/google.cloud.audit.VpcServiceControlAuditMetadata\"' \\\n --freshness=7d\n\n- To retrieve logs that were generated between specific dates, run the\n following command:\n\n gcloud logging read \\\n 'protoPayload.metadata.@type:\"type.googleapis.com/google.cloud.audit.VpcServiceControlAuditMetadata\" AND\n timestamp\u003e=\"\u003cvar translate=\"no\"\u003eSTART_DATETIME\u003c/var\u003e\" AND\n timestamp\u003c=\"\u003cvar translate=\"no\"\u003eEND_DATETIME\u003c/var\u003e\"'\n\n \u003cvar translate=\"no\"\u003eSTART_DATETIME\u003c/var\u003e and \u003cvar translate=\"no\"\u003eEND_DATETIME\u003c/var\u003e are formatted\n date and time strings. For more information about formatting, see\n [absolute date and time formats](/sdk/gcloud/reference/topic/datetimes#Absolute-date)\n for gcloud CLI.\n\n For example, to obtain all VPC Service Controls errors that have occurred\n between March 22, 2019 and March 26, 2019: \n\n gcloud logging read \\\n 'protoPayload.metadata.@type:\"type.googleapis.com/google.cloud.audit.VpcServiceControlAuditMetadata\" AND\n timestamp\u003e=\"2019-03-22T23:59:59Z\" AND\n timestamp\u003c=\"2019-03-26T00:00:00Z\"'\n\nWhat's next\n-----------\n\n- [Diagnose issues by using the VPC Service Controls troubleshooter](/vpc-service-controls/docs/troubleshooter)\n- [Diagnose an access denial event using the VPC Service Controls violation analyzer](/vpc-service-controls/docs/violation-analyzer) ([Preview](/products#product-launch-stages))\n- [Troubleshoot common VPC Service Controls issues](/vpc-service-controls/docs/troubleshooting)\n- [Troubleshoot common issues related to other Google Cloud services](/vpc-service-controls/docs/troubleshoot-services-within-perimeter)"]]
