[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-05 (世界標準時間)。"],[],[],null,["# Manage security for Private Service Connect consumers\n=====================================================\n\nThis page describes how service consumers can configure security for consumer\norganizations and VPC networks that use\nPrivate Service Connect.\n\n*Organization policies* let administrators broadly control which\nVPC networks or organizations their projects can connect to\nby using Private Service Connect endpoints and backends.\n*VPC firewall rules* and *firewall policies* let network\nadministrators control network-level access to Private Service Connect\nresources. Organization policies and firewall rules are complementary and can be\nused together.\n\nRoles\n-----\n\n\nTo get the permissions that\nyou need to manage organization policies,\n\nask your administrator to grant you the\n\n\n[Organization policy administrator](/iam/docs/roles-permissions/orgpolicy#orgpolicy.policyAdmin) (`roles/orgpolicy.policyAdmin`)\nIAM role on the organization.\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nYou might also be able to get\nthe required permissions through [custom\nroles](/iam/docs/creating-custom-roles) or other [predefined\nroles](/iam/docs/roles-overview#predefined).\n\n\nTo get the permissions that\nyou need to create firewall rules,\n\nask your administrator to grant you the\n\n\n[Compute network administrator](/iam/docs/roles-permissions/compute#compute.networkAdmin) (`roles/compute.networkAdmin`)\nIAM role on the VPC network.\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nYou might also be able to get\nthe required permissions through [custom\nroles](/iam/docs/creating-custom-roles) or other [predefined\nroles](/iam/docs/roles-overview#predefined).\n\nConsumer organization policies\n------------------------------\n\nYou can use [organization policies](/resource-manager/docs/organization-policy/overview#organization_policy) with\n[list constraints](/resource-manager/docs/organization-policy/using-constraints#list-constraint) to control the deployment of\nPrivate Service Connect endpoints or backends. If an endpoint or\nbackend is blocked by a consumer organization policy, the creation of the\nresource fails.\n\nFor more information, see\n[Consumer-side organization policies](/vpc/docs/private-service-connect-security#consumer-side-org-policies).\n\n### Block endpoints and backends from connecting to unauthorized service attachments\n\n**Resources**: endpoints and backends \n\n### gcloud\n\n1. Create a temporary file called `/tmp/policy.yaml` to store the new\n policy. Add the following content to the file:\n\n name: organizations/\u003cvar translate=\"no\"\u003eCONSUMER_ORG\u003c/var\u003e/policies/compute.restrictPrivateServiceConnectProducer\n spec:\n rules:\n - values:\n allowedValues:\n - under:organizations/\u003cvar translate=\"no\"\u003ePRODUCER_ORG_NUMBER\u003c/var\u003e\n - under:organizations/433637338589\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eCONSUMER_ORG\u003c/var\u003e: the [organization resource ID](/resource-manager/docs/creating-managing-organization#retrieving_your_organization_id) of the organization that you want to control endpoint and backend connections in.\n - \u003cvar translate=\"no\"\u003ePRODUCER_ORG_NUMBER\u003c/var\u003e: the numeric organization resource ID of the producer organization that you want to let endpoints and backends connect to.\n\n To block endpoints and backends from connecting to service attachments\n that are owned by Google, remove the following item from the\n `allowedValues` section: `- under:organizations/433637338589`.\n\n To specify additional organizations that can connect to service\n attachments in your project, include additional entries in the\n `allowedValues` section.\n\n In addition to organizations, you can specify authorized folders and\n projects in the following form:\n - `under:folders/`\u003cvar translate=\"no\"\u003eFOLDER_ID\u003c/var\u003e\n\n The \u003cvar translate=\"no\"\u003eFOLDER_ID\u003c/var\u003e must be the numeric ID.\n - `under:projects/`\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e\n\n The \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e must be the string ID.\n\n For example, the following can be used to create an organization\n policy that blocks endpoints and backends in `Consumer-org-1` from\n connecting to service attachments unless the service attachments are\n associated with an allowed value or a descendant of an allowed value.\n The allowed values are the organization `Producer-org-1`, the project\n `Producer-project-1`, and the folder `Producer-folder-1`. \n\n name: organizations/Consumer-org-1/policies/compute.restrictPrivateServiceConnectProducer\n spec:\n rules:\n - values:\n allowedValues:\n - under:organizations/Producer-org-1\n - under:projects/Producer-project-1\n - under:folders/Producer-folder-1\n\n2. Apply the policy.\n\n ```\n gcloud org-policies set-policy /tmp/policy.yaml\n ```\n3. View the policy that is in effect.\n\n ```\n gcloud org-policies describe compute.restrictPrivateServiceConnectProducer \\\n --effective \\\n --organization=CONSUMER_ORG\n ```\n\n### Block consumers from deploying endpoints by connection type\n\n**Resources**: endpoints \n\n### gcloud\n\n1. Create a temporary file called `/tmp/policy.yaml` to store the new\n policy.\n\n - To block users in a consumer organization from creating endpoints that\n connect to Google APIs, add the following content to the file:\n\n name: organizations/\u003cvar translate=\"no\"\u003eCONSUMER_ORG\u003c/var\u003e/policies/compute.disablePrivateServiceConnectCreationForConsumers\n spec:\n rules:\n - values:\n allowedValues:\n - SERVICE_PRODUCERS\n\n - To block users in a consumer organization from creating endpoints that\n connect to published services, add the following content to the file:\n\n name: organizations/\u003cvar translate=\"no\"\u003eCONSUMER_ORG\u003c/var\u003e/policies/compute.disablePrivateServiceConnectCreationForConsumers\n spec:\n rules:\n - values:\n allowedValues:\n - GOOGLE_APIS\n\n Replace \u003cvar translate=\"no\"\u003eCONSUMER_ORG\u003c/var\u003e with the name of the\n consumer organization for which you want to control endpoint deployment.\n2. Apply the policy.\n\n ```\n gcloud org-policies set-policy /tmp/policy.yaml\n ```\n3. View the policy that is in effect.\n\n ```\n gcloud org-policies describe compute.restrictPrivateServiceConnectProducer \\\n --effective \\\n --organization=CONSUMER_ORG\n ```\n\nFirewall rules\n--------------\n\n**Resources**: all\n\nYou can use [VPC firewall rules](/firewall/docs/firewalls) or\n[firewall policies](/firewall/docs/firewall-policies-overview) to control access\nto Private Service Connect resources. Egress firewall rules can\nblock or allow access from VM instances to the IP address or subnet of endpoints\nand backends.\n\nFor example, figure 1 describes a configuration where firewall rules control\naccess to the subnet that the Private Service Connect endpoint is\nconnected to.\n[](/static/vpc/images/psc-consumer-firewall-rules.svg) Firewall rules control traffic to the endpoint-subnet. Traffic from `vm-1` can reach the endpoint-subnet, while traffic from `vm-2` is blocked (click to enlarge).\n\n1. The following firewall rule denies all egress traffic to the endpoint\n subnet:\n\n ```\n gcloud compute firewall-rules create deny-all \\\n --network=vpc-1 \\\n --direction=egress \\\n --action=deny \\\n --destination-ranges=10.33.0.0/24\n --priority=1000\n ```\n2. The following higher priority firewall rule allows egress traffic to the\n endpoint subnet for VMs with the `allow-psc` network tag:\n\n ```\n gcloud compute firewall-rules create allow-psc \\\n --network=vpc-1 \\\n --direction=egress \\\n --action=allow \\\n --target-tags=allow-psc \\\n --destination-ranges=10.33.0.0/24\n --priority=100\n ```\n\n### Use firewall rules to limit access to endpoints or backends\n\nTo limit access from VMs to the subnet of an endpoint or backend, do the\nfollowing.\n\n1. Create a firewall rule to deny egress traffic to the endpoint or backend\n subnet.\n\n ```\n gcloud compute firewall-rules create deny-all \\\n --network=NETWORK \\\n --direction=egress \\\n --action=deny \\\n --destination-ranges=ENDPOINT_SUBNET_RANGE \\\n --priority=1000\n ```\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eNETWORK\u003c/var\u003e: the name of the network of your endpoint or backend.\n - \u003cvar translate=\"no\"\u003eENDPOINT_SUBNET_RANGE\u003c/var\u003e: the IP CIDR range of the endpoint or backend subnet that you want to control access to.\n2. Create a second firewall rule to allow egress traffic from tagged VMs to the\n endpoint or backend subnet.\n\n ```\n gcloud compute firewall-rules create allow-psc \\\n --network=NETWORK \\\n --direction=egress \\\n --action=allow \\\n --target-tags=allow-psc \\\n --destination-ranges=ENDPOINT_SUBNET_RANGE \\\n --priority=100\n ```"]]
