Set up a service perimeter using VPC Service Controls

VPC Service Controls is a Google Cloud feature that lets you set up a service perimeter and define a data transfer boundary. You can use VPC Service Controls with Eventarc to help protect your services.

We recommend that you protect all services when creating a service perimeter.

Eventarc Advanced

The following limitations apply to VPC Service Controls support for Eventarc Advanced.

You can verify VPC Service Controls support for the Enrollment, GoogleApiSource, MessageBus, and Pipeline resources by viewing platform logs on ingress.

Buses

To publish to an Eventarc Advanced bus, the source of an event must be inside the same service perimeter as the bus. For example, a bus outside of a service perimeter can't receive events from Google Cloud projects inside the perimeter.

To consume an event message, an event consumer must be inside the same service perimeter as the Eventarc Advanced bus. For example, a bus inside of a perimeter can't route events to a consumer outside of the perimeter.

Pipelines

When you create or update an Eventarc Advanced pipeline, destination validation is strictly enforced. Enforcement isn't retroactive. Any pipeline that was created before you set up the service perimeter keeps running. You can't create or update a pipeline with an unsupported destination.

The following table lists the supported and unsupported destinations for the Eventarc Advanced integration with VPC Service Controls:

Supported destinations
  • Cloud Run (*.run.app) and Cloud Run functions (*.cloudfunctions.net)
  • First-party Google APIs (*.googleapis.com) that VPC Service Controls supports—including regional endpoints such as *.rep.googleapis.com, LOCATION.SERVICE.googleapis.com, and REGION-SERVICE.googleapis.com, and mTLS endpoints (*.mtls.googleapis.com)
  • Eventarc Advanced buses, Pub/Sub topics, and Workflows workflows
  • Any HTTP destination—if configured with a network attachment
Unsupported destinations
  • External HTTP endpoints, including Cloud Run and Cloud Run functions custom domains—blocked with an HTTP 403 status code
  • Cloud Run URLs on the *.cloud.run and *.ai.studio domains—blocked with an HTTP 403 status code because only *.run.app URLs are supported
  • First-party Google APIs that VPC Service Controls doesn't support (for example, services at Alpha)—blocked with an HTTP 403 status code

Eventarc Standard

The following limitations apply to VPC Service Controls support for Eventarc Standard.

  • In projects protected by a service perimeter, Eventarc Standard is bound by the same limitations as Pub/Sub:

    • When routing events to Cloud Run destinations, you can create new Pub/Sub push subscriptions only when the push endpoints are set to Cloud Run services with default run.app URLs. Custom domains don't work.

    • When routing events to Workflows destinations for which the Pub/Sub push endpoint is set to a Workflows execution, you can create new Pub/Sub push subscriptions only through Eventarc Standard. The service account used for push authentication for the Workflows endpoint must be included in the service perimeter.

  • Because VPC Service Controls blocks Eventarc Standard triggers from being created for internal HTTP endpoints, you can't route events to those endpoints within a VPC Service Controls service perimeter.

What's next