Your organization processes sensitive healthcare data on GCP. The security team requires that BigQuery datasets, Cloud Storage buckets, and Vertex AI endpoints are only accessible from within the corporate network perimeter. How do you implement VPC Service Controls, and what are the common pitfalls in production?
Quick Answer
Create a VPC Service Controls perimeter that restricts BigQuery, Storage, and Vertex AI APIs to authorized VPC networks and access levels. Use access levels for CI/CD service accounts, ingress/egress rules for cross-project access, and dry-run mode before enforcement to avoid breaking existing workflows.
Detailed Answer
VPC Service Controls Architecture
VPC Service Controls (VPC-SC) creates a security perimeter around GCP resources that prevents data exfiltration even if IAM is misconfigured. When a perimeter protects BigQuery, any query attempt from outside the perimeter—even with valid IAM permissions—is denied. This is critical for healthcare (HIPAA), financial (PCI-DSS), and government (FedRAMP) workloads where data residency and exfiltration prevention are compliance requirements.
Perimeter Design and Access Levels
Define an access level using Access Context Manager that specifies allowed conditions: corporate IP ranges, device trust levels (via BeyondCorp Enterprise), geographic regions, and specific service account identities. Projects containing sensitive data are placed inside the perimeter. The perimeter restricts a set of GCP services (bigquery.googleapis.com, storage.googleapis.com, aiplatform.googleapis.com). Any API call to these services from outside the perimeter is blocked unless it matches an ingress rule.
Ingress and Egress Rules
Ingress rules allow specific identities from outside the perimeter to access specific resources inside. For example, a Cloud Build service account in a CI/CD project might need to write to a Storage bucket inside the perimeter. Egress rules allow identities inside the perimeter to access resources outside—for example, pulling base container images from a public Artifact Registry. These rules are the most complex part of VPC-SC and the primary source of production incidents.
Common Production Pitfalls
The most dangerous mistake is enforcing a perimeter without dry-run testing. Dry-run mode logs violations without blocking, letting you discover all legitimate access patterns. Common surprises include: Cloud Functions needing egress to access GCP APIs, cross-project service account access for shared services, Dataflow workers needing access to temp buckets outside the perimeter, and BigQuery federated queries accessing external tables. Each of these requires specific ingress/egress rules.
Monitoring and Troubleshooting
VPC-SC violations appear in Cloud Audit Logs with RESOURCES_NOT_IN_SAME_SERVICE_PERIMETER errors. Set up log-based alerts for these. Use the VPC-SC Troubleshooter in Cloud Console to diagnose denied requests. In production, maintain a runbook mapping common violation patterns to the ingress/egress rules needed to resolve them.