| Prevent access to Google-managed services outside of a trusted perimeter |
 - While Cloud IAM enables granular identity-based access control, VPC Service Controls enables broader context-based perimeter security, including controlling data egress across the perimeter
- Protect resources within a perimeter so they can only be privately accessed from clients within authorized VPC networks using Private Google Access
- Ensure clients within a perimeter that have private access to resources do not have access to unauthorized (potentially public) resources outside the perimeter
- Prevent data from being copied to unauthorized resources outside the perimeter using service operations
|
| Extend communication from cloud resources to an on-premises environment |
 - Private Google Access on-premises extensions allow private communication between VPC networks that span hybrid cloud environments
- VPC networks must be part of a service perimeter for VMs on that network to privately access managed Google Cloud resources within that service perimeter
- VMs with private IPs on a VPC network that is part of a service perimeter cannot access managed resources outside the service perimeter
- For example, a VM within a VPC network that is part of a service perimeter can privately access a Cloud Storage bucket in the same service perimeter, but the VM will be denied access to Cloud Storage buckets that are outside of it
|
| Restrict access to resources from the Internet by creating custom attribute-based access levels |
 - Access from the internet to managed resources within a service perimeter is denied by default
- You can enable access based on the context of the request by creating access levels that control access based on a number of attributes, such as the source IP address
|
| Perimeter bridges can be used to enable communication between projects in different service perimeters |
 |