이 페이지에서는 서비스 소비자가 Private Service Connect를 사용하는 소비자 조직 및 VPC 네트워크에 대해 보안을 구성하는 방법을 설명합니다.
관리자는 조직 정책에 따라 Private Service Connect 엔드포인트 및 백엔드를 사용하여 프로젝트가 연결할 수 있는 VPC 네트워크 또는 조직을 포괄적으로 제어할 수 있습니다.
네트워크 관리자는 VPC 방화벽 규칙 및 방화벽 정책을 통해 Private Service Connect 리소스에 대한 네트워크 수준의 액세스를 제어할 수 있습니다. 조직 정책과 방화벽 규칙은 상호 보완적이며 함께 사용할 수 있습니다.
역할
조직 정책을 관리하는 데 필요한 권한을 얻으려면 관리자에게 조직에 대한 조직 정책 관리자(roles/orgpolicy.policyAdmin) IAM 역할을 부여해 달라고 요청하세요.
역할 부여에 대한 자세한 내용은 프로젝트, 폴더, 조직에 대한 액세스 관리를 참조하세요.
방화벽 규칙을 만드는 데 필요한 권한을 얻으려면 관리자에게 VPC 네트워크에 대한 Compute 네트워크 관리자(roles/compute.networkAdmin) IAM 역할을 부여해 달라고 요청하세요.
역할 부여에 대한 자세한 내용은 프로젝트, 폴더, 조직에 대한 액세스 관리를 참조하세요.
CONSUMER_ORG: 엔드포인트 및 백엔드 연결을 제어하려는 조직의 조직 리소스 ID입니다.
PRODUCER_ORG_NUMBER: 엔드포인트 및 백엔드에 연결하려는 프로듀서 조직의 숫자 조직 리소스 ID입니다.
엔드포인트 및 백엔드가 Google에서 소유한 서비스 연결에 연결하지 못하도록 차단하려면 allowedValues 섹션에서 - under:organizations/433637338589 항목을 삭제하세요.
프로젝트에서 서비스에 연결할 수 있는 추가 조직을 지정하려면 allowedValues 섹션에 추가 항목을 포함합니다.
조직 외에도 다음 형식으로 승인된 폴더 및 프로젝트를 지정할 수 있습니다.
under:folders/FOLDER_ID
FOLDER_ID는 숫자 ID여야 합니다.
under:projects/PROJECT_ID
PROJECT_ID는 문자열 ID여야 합니다.
예를 들어 서비스 연결이 허용된 값 또는 허용된 값의 하위 요소와 연결되지 않은 경우 Consumer-org-1의 엔드포인트 및 백엔드에서 서비스 연결에 연결하지 못하도록 차단하는 조직 정책을 만드는 데 다음을 사용할 수 있습니다.
허용된 값은 조직 Producer-org-1, 프로젝트 Producer-project-1, 폴더 Producer-folder-1입니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-05(UTC)"],[],[],null,["# Manage security for Private Service Connect consumers\n=====================================================\n\nThis page describes how service consumers can configure security for consumer\norganizations and VPC networks that use\nPrivate Service Connect.\n\n*Organization policies* let administrators broadly control which\nVPC networks or organizations their projects can connect to\nby using Private Service Connect endpoints and backends.\n*VPC firewall rules* and *firewall policies* let network\nadministrators control network-level access to Private Service Connect\nresources. Organization policies and firewall rules are complementary and can be\nused together.\n\nRoles\n-----\n\n\nTo get the permissions that\nyou need to manage organization policies,\n\nask your administrator to grant you the\n\n\n[Organization policy administrator](/iam/docs/roles-permissions/orgpolicy#orgpolicy.policyAdmin) (`roles/orgpolicy.policyAdmin`)\nIAM role on the organization.\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nYou might also be able to get\nthe required permissions through [custom\nroles](/iam/docs/creating-custom-roles) or other [predefined\nroles](/iam/docs/roles-overview#predefined).\n\n\nTo get the permissions that\nyou need to create firewall rules,\n\nask your administrator to grant you the\n\n\n[Compute network administrator](/iam/docs/roles-permissions/compute#compute.networkAdmin) (`roles/compute.networkAdmin`)\nIAM role on the VPC network.\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nYou might also be able to get\nthe required permissions through [custom\nroles](/iam/docs/creating-custom-roles) or other [predefined\nroles](/iam/docs/roles-overview#predefined).\n\nConsumer organization policies\n------------------------------\n\nYou can use [organization policies](/resource-manager/docs/organization-policy/overview#organization_policy) with\n[list constraints](/resource-manager/docs/organization-policy/using-constraints#list-constraint) to control the deployment of\nPrivate Service Connect endpoints or backends. If an endpoint or\nbackend is blocked by a consumer organization policy, the creation of the\nresource fails.\n\nFor more information, see\n[Consumer-side organization policies](/vpc/docs/private-service-connect-security#consumer-side-org-policies).\n\n### Block endpoints and backends from connecting to unauthorized service attachments\n\n**Resources**: endpoints and backends \n\n### gcloud\n\n1. Create a temporary file called `/tmp/policy.yaml` to store the new\n policy. Add the following content to the file:\n\n name: organizations/\u003cvar translate=\"no\"\u003eCONSUMER_ORG\u003c/var\u003e/policies/compute.restrictPrivateServiceConnectProducer\n spec:\n rules:\n - values:\n allowedValues:\n - under:organizations/\u003cvar translate=\"no\"\u003ePRODUCER_ORG_NUMBER\u003c/var\u003e\n - under:organizations/433637338589\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eCONSUMER_ORG\u003c/var\u003e: the [organization resource ID](/resource-manager/docs/creating-managing-organization#retrieving_your_organization_id) of the organization that you want to control endpoint and backend connections in.\n - \u003cvar translate=\"no\"\u003ePRODUCER_ORG_NUMBER\u003c/var\u003e: the numeric organization resource ID of the producer organization that you want to let endpoints and backends connect to.\n\n To block endpoints and backends from connecting to service attachments\n that are owned by Google, remove the following item from the\n `allowedValues` section: `- under:organizations/433637338589`.\n\n To specify additional organizations that can connect to service\n attachments in your project, include additional entries in the\n `allowedValues` section.\n\n In addition to organizations, you can specify authorized folders and\n projects in the following form:\n - `under:folders/`\u003cvar translate=\"no\"\u003eFOLDER_ID\u003c/var\u003e\n\n The \u003cvar translate=\"no\"\u003eFOLDER_ID\u003c/var\u003e must be the numeric ID.\n - `under:projects/`\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e\n\n The \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e must be the string ID.\n\n For example, the following can be used to create an organization\n policy that blocks endpoints and backends in `Consumer-org-1` from\n connecting to service attachments unless the service attachments are\n associated with an allowed value or a descendant of an allowed value.\n The allowed values are the organization `Producer-org-1`, the project\n `Producer-project-1`, and the folder `Producer-folder-1`. \n\n name: organizations/Consumer-org-1/policies/compute.restrictPrivateServiceConnectProducer\n spec:\n rules:\n - values:\n allowedValues:\n - under:organizations/Producer-org-1\n - under:projects/Producer-project-1\n - under:folders/Producer-folder-1\n\n2. Apply the policy.\n\n ```\n gcloud org-policies set-policy /tmp/policy.yaml\n ```\n3. View the policy that is in effect.\n\n ```\n gcloud org-policies describe compute.restrictPrivateServiceConnectProducer \\\n --effective \\\n --organization=CONSUMER_ORG\n ```\n\n### Block consumers from deploying endpoints by connection type\n\n**Resources**: endpoints \n\n### gcloud\n\n1. Create a temporary file called `/tmp/policy.yaml` to store the new\n policy.\n\n - To block users in a consumer organization from creating endpoints that\n connect to Google APIs, add the following content to the file:\n\n name: organizations/\u003cvar translate=\"no\"\u003eCONSUMER_ORG\u003c/var\u003e/policies/compute.disablePrivateServiceConnectCreationForConsumers\n spec:\n rules:\n - values:\n allowedValues:\n - SERVICE_PRODUCERS\n\n - To block users in a consumer organization from creating endpoints that\n connect to published services, add the following content to the file:\n\n name: organizations/\u003cvar translate=\"no\"\u003eCONSUMER_ORG\u003c/var\u003e/policies/compute.disablePrivateServiceConnectCreationForConsumers\n spec:\n rules:\n - values:\n allowedValues:\n - GOOGLE_APIS\n\n Replace \u003cvar translate=\"no\"\u003eCONSUMER_ORG\u003c/var\u003e with the name of the\n consumer organization for which you want to control endpoint deployment.\n2. Apply the policy.\n\n ```\n gcloud org-policies set-policy /tmp/policy.yaml\n ```\n3. View the policy that is in effect.\n\n ```\n gcloud org-policies describe compute.restrictPrivateServiceConnectProducer \\\n --effective \\\n --organization=CONSUMER_ORG\n ```\n\nFirewall rules\n--------------\n\n**Resources**: all\n\nYou can use [VPC firewall rules](/firewall/docs/firewalls) or\n[firewall policies](/firewall/docs/firewall-policies-overview) to control access\nto Private Service Connect resources. Egress firewall rules can\nblock or allow access from VM instances to the IP address or subnet of endpoints\nand backends.\n\nFor example, figure 1 describes a configuration where firewall rules control\naccess to the subnet that the Private Service Connect endpoint is\nconnected to.\n[](/static/vpc/images/psc-consumer-firewall-rules.svg) Firewall rules control traffic to the endpoint-subnet. Traffic from `vm-1` can reach the endpoint-subnet, while traffic from `vm-2` is blocked (click to enlarge).\n\n1. The following firewall rule denies all egress traffic to the endpoint\n subnet:\n\n ```\n gcloud compute firewall-rules create deny-all \\\n --network=vpc-1 \\\n --direction=egress \\\n --action=deny \\\n --destination-ranges=10.33.0.0/24\n --priority=1000\n ```\n2. The following higher priority firewall rule allows egress traffic to the\n endpoint subnet for VMs with the `allow-psc` network tag:\n\n ```\n gcloud compute firewall-rules create allow-psc \\\n --network=vpc-1 \\\n --direction=egress \\\n --action=allow \\\n --target-tags=allow-psc \\\n --destination-ranges=10.33.0.0/24\n --priority=100\n ```\n\n### Use firewall rules to limit access to endpoints or backends\n\nTo limit access from VMs to the subnet of an endpoint or backend, do the\nfollowing.\n\n1. Create a firewall rule to deny egress traffic to the endpoint or backend\n subnet.\n\n ```\n gcloud compute firewall-rules create deny-all \\\n --network=NETWORK \\\n --direction=egress \\\n --action=deny \\\n --destination-ranges=ENDPOINT_SUBNET_RANGE \\\n --priority=1000\n ```\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eNETWORK\u003c/var\u003e: the name of the network of your endpoint or backend.\n - \u003cvar translate=\"no\"\u003eENDPOINT_SUBNET_RANGE\u003c/var\u003e: the IP CIDR range of the endpoint or backend subnet that you want to control access to.\n2. Create a second firewall rule to allow egress traffic from tagged VMs to the\n endpoint or backend subnet.\n\n ```\n gcloud compute firewall-rules create allow-psc \\\n --network=NETWORK \\\n --direction=egress \\\n --action=allow \\\n --target-tags=allow-psc \\\n --destination-ranges=ENDPOINT_SUBNET_RANGE \\\n --priority=100\n ```"]]
