Modernizing perimeter security: Scalable perimeters with VPC Service Controls
Traditional, manually-operated network perimeters are vulnerable to today’s machine-speed attacks. Overly permissive perimeters, built to avoid blocked connections, increase the risk of unauthorized data theft, but overly strict perimeters stall development under a flood of access denials.
Today, we're excited to announce key enhancements to VPC Service Controls (VPC-SC) that make perimeters easier to create, maintain, and scale. You can now add folders to perimeter membership, so that projects contained in them inherit policy. You can also manage granular exceptions and resolve denials with guided, scoped remediation.
The result is data protected by default, so you can scale autonomous agents across your enterprise without letting data leave your perimeter. This update is generally available, and at no additional cost.
Perimeters aligned to your architecture
VPC-SC provides a context-aware network security perimeter around your Google Cloud deployment, designed to secure your organization against data theft, even in the event of compromised credentials, identity and access management (IAM) misconfigurations, and insider threats. By extending network-layer protection across service-to-service interactions in Google Cloud's infrastructure, VPC-SC goes beyond traditional firewalls and creates an additional layer of defense that prevents access outside your corporate network — and is now easier for your organization to manage.
Cloud administrators configuring VPC-SC can now include folders in perimeter membership, automatically extending the folder’s access policy to every project and nested subfolder it contains. New workloads can inherit protection by default, with no further modification.
Figure 1: Simplified perimeter authoring in VPC-SC.
Perimeter membership updates when a project is moved, simplifying lifecycle maintenance. Security coverage follows the resource hierarchy that your organization already governs, and compliance verification requires only confirming that the resource is located in the correct part of the hierarchy.
Dry-run mode also supports folder membership, helping administrators evaluate the effect of a hierarchy-wide perimeter against live traffic before enforcement.
Folder and organization support in ingress and egress rules
Well-defined ingress and egress rules establish granular, context-aware perimeters without sacrificing operational flexibility across complex multi-project environments. Security administrators can now specify Google Cloud folders and organizations directly within those rules. A single hierarchy reference stands in for the set of projects beneath it, which keeps rules concise, keeps attribute counts well within quota limits, and extends access automatically to projects created later in the hierarchy.
Figure 2 : Simplified authoring of ingress/egress rules.
Using Private Service Connect endpoints in ingress and egress rules
Enterprises increasingly use private paths to reach desired endpoints in their deployment instead of exposing the traffic to the internet. Private Service Connect endpoints for Google APIs are now supported as an attribute in ingress and egress rules. Administrators can author a rule that authorizes access specifically over a designated private endpoint, producing a policy that corresponds directly to the connectivity architecture it is intended to govern.
Figure 3: Supporting Private Service Connect endpoints with ingress and egress rules.
For organizations that have standardized on Private Service Connect, including endpoints propagated across the estate through Network Connectivity Center, this provides both a more precise and a more concise means of expressing source for the request.
Service patterns in VPC accessible services
Service patterns in VPC accessible services provide granular control over Google APIs accessed with private Virtual IP addresses (VIP), permitting interoperability beyond just VPC-SC integrated services. If the workload requires controlled access to validated API endpoints over a private path, administrators can now allow only the specific API URL patterns required.
Additionally, the capability supports appending org-restriction-headers with egress requests to facilitate access to only authorized domains and resources. Because you don’t need to manage egress-proxy, you can accommodate legitimate operational requirements while maintaining a tightly-bounded private path, instead of choosing between a broad allowance and no access at all.
Figure 4: Granular control over Google APIs with service patterns in VPC accessible services.
Guided violation remediation
VPC-SC perimeter policies evolve continuously alongside the workloads they protect, and administrators periodically need to authorize a legitimate access request not yet covered. New Guided Violation Remediation in VPC-SC Violation Analyzer cuts resolution time for blocked requests from days to minutes by generating a policy fix with remediation recommendations, which you can validate in Dry-Run mode first.
Rather than just diagnosing why the violation occurred for a given denial, Violation Analyzer evaluates the blocked request against the applicable perimeter configuration, and proposes a specific configuration change, narrowly scoped by least-privilege design principles, to authorize the traffic: an ingress rule, an egress rule, an access level, or an update to VPC accessible services. This relieves pressure on administrators to broadly open up a perimeter just to resolve a violation and get an application working quickly.
Read more about how BlackLine uses Violation Analyzer to streamline investigations.
Figure 5 : VPC-SC Violation Remediation for faster turn-around.
Get started today
VPC-SC makes it simple and automated to deploy and refine granular network perimeter protection, even for autonomous agents. To get started:
*
Establish your folder baseline: Identify the folders in your resource hierarchy that correspond to the boundaries you intend to enforce, and define perimeters around them so that new workloads inherit policy on creation.
*
Run risk-free in Dry-Run mode: Observe production traffic safely without blocking active developers.
*
Unblock traffic with Violation Analyzer and Violation Dashboard: Use automated least-privilege remediation recommendations to resolve any denials that surface.
*
Enforce with confidence: Secure your full data estate by transitioning to enforcement once your dry-run logs show your intended access with clean, authorized traffic.
To learn more about how VPC-SC can help simplify your data security posture and confidently secure your autonomous agent fleets, check out the VPC-SC documentation. 🔗 Google Security
https://cloud.google.com/blog/products/identity-security/introducing-new-scalable-perimeter-options-with-vpc-service-controls/?utm_source=dlvr.it&utm_medium=blogger
