某個服務範圍中的專案無法間接獲得其他範圍內專案的存取權。舉例來說，假設我們有 A、B 和 C 三個專案，每個專案都屬於不同的服務範圍。A 和 B 共用一個重疊範圍，B 和 C 也共用一個重疊範圍。資料可以在 A 和 B 之間移動，也可以在 B 和 C 之間移動，但無法在 A 和 C 之間移動，因為這兩個專案未透過重疊範圍直接相連結。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[],[],null,["# Sharing across perimeters with bridges\n\nThis page describes how perimeter bridges can be used to allow projects and\nservices in different service perimeters to communicate.\n\nBefore you begin\n----------------\n\n- Read [Overview of VPC Service Controls](/vpc-service-controls/docs/overview)\n- Read [Service Perimeter Configuration](/vpc-service-controls/docs/service-perimeters#stages)\n\nService perimeter bridges\n-------------------------\n\nWhile a project can be assigned to only one service perimeter, you\nmay want your project to be able to communicate with projects in another\nperimeter. You can enable communication to services and share data across\nservice perimeters by\n[creating a **perimeter bridge**](/vpc-service-controls/docs/create-perimeter-bridges).\n\nA perimeter bridge allows projects in different service perimeters to\ncommunicate. Perimeter bridges are bidirectional, allowing projects from each\nservice perimeter equal access within the scope of the bridge. However, the\naccess levels and service restrictions of the project are controlled solely by\nthe service perimeter that the project belongs to. A project can have multiple\nbridges connecting it to other projects.\n\nA project from one service perimeter cannot indirectly gain access to projects\nin other perimeters. For example, assume we have three projects: A, B,\nand C. Each project belongs to a different service perimeter. A and B\nshare a perimeter bridge. B and C also share a bridge.\nWhile data can move between A and B, as well as between B and C,\nnothing can pass between A and C because the two projects are not directly\nconnected by a perimeter bridge.\n\n### Considerations\n\nBefore you create a perimeter bridge, consider the following:\n\n- A project must belong to a service perimeter before it can be connected to\n another project using a perimeter bridge.\n\n- Perimeter bridges cannot include projects from different organizations.\n The projects connected by a perimeter bridge must belong to service\n perimeters that are in the same organization.\n\n- Perimeter bridges cannot include projects from different [scoped\n policies](/vpc-service-controls/docs/scoped-policies-overview). Instead, you can\n use [ingress or egress rules](/vpc-service-controls/docs/ingress-egress-rules)\n to allow communication between projects from different scoped policies.\n\n- After you create a perimeter bridge for a project, you cannot add the\n VPC networks from that project to a perimeter.\n\nExample of perimeter bridges\n----------------------------\n\nFor a broader example of how perimeter bridges work, consider the following\nsetup:\n\nThe goal is to allow copies between the Cloud Storage buckets in\nthe DMZ Perimeter and only the buckets in the Sink Project but not allow\nany VMs in the DMZ Perimeter access to data in Storage buckets in the\nPrivate Project.\n\nUsing the following command, a perimeter bridge (**Bridge**) is created,\nspecifying that project A and project B are to be connected by the\nperimeter bridge.\n**Note:** In the example command and the previous diagram, projects A and B are represented by their project numbers, 12345 and 67890, as the project numbers are required for the `resources` option. \n\n gcloud access-context-manager perimeters create Bridge \\\n --title=\"Perimeter Bridge\" --perimeter-type=bridge \\\n --resources=projects/12345,projects/67890\n\nThe perimeter bridge boundary is bidirectional. This means copies from\nDMZ Perimeter to Private Perimeter and from Private Perimeter to\nDMZ Perimeter are both allowed. To provide some directional control,\nit's best to combine perimeters with IAM permissions on the\nservice account or identity that is executing the copy operation."]]
