VPC Service Controls に起因するエラーかどうかを特定するには、VPC Service Controls が有効で、使用するプロジェクトとサービスに適用されているかどうかを確認します。プロジェクトとサービスが VPC Service Controls で保護されているかどうかを確認するには、そのリソース階層レベルで VPC Service Controls ポリシーを確認します。
たとえば、サービス境界内のプロジェクトで VPC Service Controls が制限付きサービスに設定しているサービスを間接的に使用するシナリオを考えてみましょう。この場合、VPC Service Controls がアクセスを拒否する可能性があります。
通常、サービスは依存関係に従ってエラー メッセージを伝播します。次のいずれかのエラーが発生した場合は、VPC Service Controls に問題があります。
Cloud Storage:403: Request violates VPC Service Controls.
BigQuery:403: VPC Service Controls: Request is prohibited by
organization's policy.
その他のサービス:403: Request is prohibited by organization's policy.
エラーの一意の ID を使用する
Google Cloud コンソールとは異なり、gcloud コマンドライン ツールは VPC Service Controls のエラーに対して一意の ID を返します。他のエラーのログエントリを見つけるには、メタデータを使用してログをフィルタします。
VPC Service Controls によって生成されるエラーには、関連する監査ログを識別するために使用される一意の ID が含まれます。
一意の ID を使用してエラーに関する情報を取得するには、次の操作を行います。
Google Cloud コンソールで、エラーの原因と考えられるサービス境界内のプロジェクトの [Cloud Logging] ページに移動します。
gcloudloggingread\'protoPayload.metadata.@type:"type.googleapis.com/google.cloud.audit.VpcServiceControlAuditMetadata" AND timestamp>="2019-03-22T23:59:59Z" AND timestamp<="2019-03-26T00:00:00Z"'
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-09-04 UTC。"],[],[],null,["This page describes how you can find VPC Service Controls errors using\nCloud Logging.\n\nVPC Service Controls helps mitigate data exfiltration risks by isolating\nmulti-tenant Google Cloud services. For more information, see [Overview of\nVPC Service Controls](/vpc-service-controls/docs/overview).\n\nDetermine if an error is due to VPC Service Controls\n\nVPC Service Controls can modify the properties of Google Cloud and\nhave cascading effects across services. This can make it difficult to debug\nissues, especially if you don't know what to look for.\n\nThe [service perimeter](/vpc-service-controls/docs/service-perimeters) changes can take up to 30 minutes to\npropagate and take effect. When the changes have propagated, access to the\nservices restricted in the perimeter isn't allowed to cross the perimeter\nboundary unless explicitly authorized.\n\nTo determine if an error is related to VPC Service Controls, check whether\nyou have enabled VPC Service Controls and applied it to the projects and\nservices you are attempting to use. To verify whether the projects and services\nare protected by VPC Service Controls, check the VPC Service Controls\npolicy at that level of resource hierarchy.\n\nConsider an example scenario in which you indirectly use a service that is\nmarked as a *restricted service* by VPC Service Controls in a project that\nis inside a service perimeter. In such a case, VPC Service Controls might be\ndenying access.\n\nUsually, services propagate error messages from their dependencies. If you\nencounter one of the following errors, it indicates a problem with\nVPC Service Controls.\n\n- **Cloud Storage:** `403: Request violates VPC Service Controls.`\n\n- **BigQuery:** `403: VPC Service Controls: Request is prohibited by\n organization's policy.`\n\n- **Other services:** `403: Request is prohibited by organization's policy.`\n\nUse the error's unique ID\n\nUnlike the Google Cloud console, the `gcloud` command-line tool returns a unique ID for\nVPC Service Controls errors. To locate log entries for other errors, [filter the\nlogs using metadata](#metadata-filter).\n\nAn error generated by VPC Service Controls includes a unique ID that is used to\nidentify relevant audit logs.\n\nTo obtain information about an error using the unique ID, do the following:\n\n1. In the Google Cloud console, go to the **Cloud Logging** page for the\n project inside the service perimeter that triggered the error.\n\n [Go to Cloud Logging](https://console.cloud.google.com/logs/query)\n2. In the search-filter field, enter the error's unique ID.\n\nYou can see the relevant log entry.\n\nFilter logs using metadata\n\nYou can use the [Logs Explorer](/logging/docs/view/logs-explorer-interface) to find errors related to\nVPC Service Controls. You can use the [Logging query language](/logging/docs/view/logging-query-language)\nto retrieve the logs. For information about building queries, see [Building\nqueries by using the Logging query language](/logging/docs/view/building-queries). \n\nConsole\n\nTo obtain the last 24 hours of VPC Service Controls errors in\nLogging, do the following:\n\n1. In the Google Cloud console, go to the **Cloud Logging** page.\n\n [Go to Cloud Logging](https://console.cloud.google.com/logs/query)\n2. Make sure that you are in the project that is inside the service\n perimeter.\n\n3. In the search-filter field, enter the following:\n\n protoPayload.metadata.@type:\"type.googleapis.com/google.cloud.audit.VpcServiceControlAuditMetadata\"\n\n4. In the **Resource** menu, select **Audited Resource**.\n\n5. In the time-range selector menu, select **Last 24 hours**.\n\n6. Optional: To find the VPC Service Controls errors that\n have occurred during a different period, use the **time-range\n selector** menu.\n\ngcloud\n\n- To obtain the last 24 hours of VPC Service Controls errors, run the\n following command:\n\n gcloud logging read 'protoPayload.metadata.@type:\"type.googleapis.com/google.cloud.audit.VpcServiceControlAuditMetadata\"'\n\n By default, the `read` command is limited to the last 24 hours. To obtain\n VPC Service Controls logs for a different period, use one of the\n following commands:\n- To retrieve logs that were generated within a certain period from the\n current date, run the following command:\n\n gcloud logging read \\\n 'protoPayload.metadata.@type:\"type.googleapis.com/google.cloud.audit.VpcServiceControlAuditMetadata\"' \\\n --freshness=\u003cvar translate=\"no\"\u003eDURATION\u003c/var\u003e\n\n \u003cvar translate=\"no\"\u003eDURATION\u003c/var\u003e is a formatted period of time. For more information\n about formatting, see [relative duration and time formats](/sdk/gcloud/reference/topic/datetimes#Relative-duration-date)\n for gcloud CLI.\n- To retrieve all VPC Service Controls errors that have occurred in the\n past week, run the following command:\n\n gcloud logging read \\\n 'protoPayload.metadata.@type:\"type.googleapis.com/google.cloud.audit.VpcServiceControlAuditMetadata\"' \\\n --freshness=7d\n\n- To retrieve logs that were generated between specific dates, run the\n following command:\n\n gcloud logging read \\\n 'protoPayload.metadata.@type:\"type.googleapis.com/google.cloud.audit.VpcServiceControlAuditMetadata\" AND\n timestamp\u003e=\"\u003cvar translate=\"no\"\u003eSTART_DATETIME\u003c/var\u003e\" AND\n timestamp\u003c=\"\u003cvar translate=\"no\"\u003eEND_DATETIME\u003c/var\u003e\"'\n\n \u003cvar translate=\"no\"\u003eSTART_DATETIME\u003c/var\u003e and \u003cvar translate=\"no\"\u003eEND_DATETIME\u003c/var\u003e are formatted\n date and time strings. For more information about formatting, see\n [absolute date and time formats](/sdk/gcloud/reference/topic/datetimes#Absolute-date)\n for gcloud CLI.\n\n For example, to obtain all VPC Service Controls errors that have occurred\n between March 22, 2019 and March 26, 2019: \n\n gcloud logging read \\\n 'protoPayload.metadata.@type:\"type.googleapis.com/google.cloud.audit.VpcServiceControlAuditMetadata\" AND\n timestamp\u003e=\"2019-03-22T23:59:59Z\" AND\n timestamp\u003c=\"2019-03-26T00:00:00Z\"'\n\nWhat's next\n\n- [Diagnose issues by using the VPC Service Controls troubleshooter](/vpc-service-controls/docs/troubleshooter)\n- [Diagnose an access denial event using the VPC Service Controls violation analyzer](/vpc-service-controls/docs/violation-analyzer) ([Preview](https://cloud.google.com/products/#product-launch-stages))\n- [Troubleshoot common VPC Service Controls issues](/vpc-service-controls/docs/troubleshooting)\n- [Troubleshoot common issues related to other Google Cloud services](/vpc-service-controls/docs/troubleshoot-services-within-perimeter)"]]
