Configure VPC Service Controls

To mitigate the risk of data exfiltration from your AlloyDB for PostgreSQL instances, you can use VPC Service Controls to configure service perimeters and access levels that protect your AlloyDB resources and data.

For a general overview of VPC Service Controls, its security benefits, and its capabilities across Google Cloud products, see Overview of VPC Service Controls.

Before you begin

  1. In the Google Cloud console, go to the Project Selector page.

    Go to project selector

  2. Select or create a Google Cloud project.
  3. Make sure that billing is enabled for your Google Cloud project. Learn how to check if billing is enabled on a project.
  4. Enable the Compute Engine API.

    Enable the Compute Engine API

  5. Enable the Service Networking API.

    Enable the Service Networking API

  6. Add the Identity and Access Management (IAM) roles to the user or service account that you're using to set up and administer VPC Service Controls. For more information, see IAM roles for administering VPC Service Controls.
  7. Review limitations when you use VPC Service Controls with AlloyDB.

Secure AlloyDB using VPC Service Controls

Before you begin, review Overview of VPC Service Controls and AlloyDB limitations when using VPC Service Controls.

Configuring VPC Service Controls for an AlloyDB project includes the following steps:

  1. Create and manage a service perimeter.

    First, you select the AlloyDB project that you want the VPC service perimeter to protect, and then you create and manage the service perimeter.

  2. Create and manage access levels.

    Optionally, to permit external access to protected resources inside a perimeter, you can use access levels. Access levels apply only to requests for protected resources coming from outside the service perimeter. You can't use access levels to give protected resources or VMs permission to access data and services outside the perimeter.

Create and manage a service perimeter

To create and manage a service perimeter, complete the following steps:

  1. Select the AlloyDB project that you want the VPC service perimeter to protect.

  2. Create a service perimeter by following the instructions in Creating a service perimeter.

  3. Add more instances to the service perimeter. To add existing AlloyDB instances to the perimeter, follow the instructions in Updating a service perimeter.

  4. Add APIs to the service perimeter. To mitigate the risk of your data being exfiltrated from AlloyDB, you must restrict the AlloyDB API, Compute Engine API, Cloud Storage API, Artifact Registry API, Certificate Authority Service API, and Cloud Key Management Service API. For more information about updating service perimeters, see the gcloud access-context-manager perimeters update command.

    To add APIs as restricted services, follow these steps:

    Console

    1. In the Google Cloud console, go to the VPC Service Controls page.

      Go to VPC Service Controls

    2. In the VPC Service Controls page, in the table, click the name of the service perimeter that you want to modify.
    3. Click Edit.
    4. In the Edit VPC Service Perimeter page, click Add Services.
    5. Add AlloyDB API, Compute Engine API, Cloud Storage API, Artifact Registry API, Certificate Authority Service API, and Cloud KMS API.
    6. Click Save.

    gcloud

    gcloud access-context-manager perimeters update PERIMETER_ID \
--policy=POLICY_ID \
--add-restricted-services=alloydb.googleapis.com,compute.googleapis.com,storage.googleapis.com,artifactregistry.googleapis.com,privateca.googleapis.com,cloudkms.googleapis.com

    Replace the following:

    • PERIMETER_ID: the ID of the perimeter or the fully qualified identifier for the perimeter.
    • POLICY_ID: the ID of the access policy.

  5. If you enabled advanced query insights features, add the databaseinsights.googleapis.com API to the service perimeter as a restricted service:

    Console

    1. In the Google Cloud console, go to the VPC Service Controls page.

      Go to VPC Service Controls

    2. In the VPC Service Controls page, in the table, click the name of the service perimeter that you want to modify.
    3. Click Edit.
    4. In the Edit VPC Service Perimeter page, click Add Services.
    5. Add databaseinsights.googleapis.com.
    6. Click Save.

    gcloud

    gcloud access-context-manager perimeters update PERIMETER_ID \
--policy=POLICY_ID \
--add-restricted-services=databaseinsights.googleapis.com

    Replace the following:

    • PERIMETER_ID: the ID of the perimeter or the fully qualified identifier for the perimeter.
    • POLICY_ID: the ID of the access policy.

Create and manage access levels

To create and manage access levels, follow the instructions in Allowing access to protected resources from outside a perimeter.