Designing for security and compliance · Topic 3 of 5
Perimeters, Context-Aware and Remote Access
VPC Service Controls against exfiltration, context-aware access, IAP, hierarchical firewall policies and keyless access with workload federation.
- 4 min
- Includes a diagram
- VPC Service Controls stop data leaving through Google APIs, even with valid IAM.
- Access levels add network, device and identity context.
- IAP gives per-user app and SSH access without a VPN.
What it is
IAM answers "who may do this". Perimeter and access controls add where from, on what device and to which destination. They stop authorized users from copying data out, keep remote access off the internet without a VPN, and let workloads outside Google Cloud authenticate without keys.
How it works
VPC Service Controls
A service perimeter surrounds projects and restricts chosen Google APIs (such as BigQuery and Cloud Storage). Data cannot move from inside the perimeter to a project outside it, even for a user with valid IAM permissions.
| Feature | Use |
|---|---|
| Restricted services | APIs protected by the perimeter |
| Access levels | Allow calls from specific networks, devices or identities |
| Ingress and egress rules | Precise exceptions, for example one partner project |
| Perimeter bridges | Let two perimeters share data |
| Dry-run mode | See what would be blocked before enforcing |
| restricted.googleapis.com | Private access from on premises to supported APIs only |
"An authorized user copied data to a bucket in a personal project" is the textbook VPC Service Controls scenario. IAM alone cannot stop it.
Context-aware access
Access Context Manager defines access levels from attributes such as IP range, region, device policy and identity. These levels apply to VPC Service Controls perimeters and to applications behind IAP. Chrome Enterprise Premium (formerly BeyondCorp Enterprise) extends this zero-trust model with device trust and threat protection for browser access.
Identity-Aware Proxy
| IAP use | What it gives |
|---|---|
| Web apps on App Engine, Compute Engine, GKE or Cloud Run behind a load balancer | Sign-in and authorization per user, plus device conditions, with no VPN |
| TCP forwarding | SSH and RDP to VMs without public IPs |
Hierarchical firewall policies
Firewall policies at the organization or folder level apply to every VPC below. Use them for rules that no project may override (block known bad ranges, allow only approved admin sources) and delegate the rest to lower levels with "go to next". Combine with secure tags to target groups of VMs across projects.
Workloads outside Google Cloud and impersonation
| Situation | Keyless approach |
|---|---|
| CI system, other cloud or on-premises job | Workload Identity Federation: exchange OIDC or SAML tokens, or AWS or Azure credentials, for short-lived Google credentials |
| GKE Pods | Workload Identity Federation for GKE |
| Admin needs a service account's rights for a task | Service account impersonation with Service Account Token Creator, logged per use |
| Users from an external identity provider | Workforce Identity Federation |
Block key creation with an organization policy once federation is in place.
Other organization-wide controls
- Organization policies for guardrails (locations, public IPs, OS Login, key creation).
- Audit logs for evidence (next pages).
- Domain restricted sharing to keep roles inside approved domains.
A worked scenario
Associates review AI-generated content in a Cloud Run app. Some work from contractor offices and from home, only company-managed devices may connect and no VPN is allowed. Put the app behind an external Application Load Balancer with IAP and an access level requiring managed devices. Checking identity in code ignores the device; office IP allowlists exclude home workers.
How the exam asks about this
- "On-premises CI deploys with service account keys from a vault; remove long-lived credentials." Workload Identity Federation with an OIDC provider, then disable key creation.
- "Stop copying of BigQuery and Cloud Storage data out of two projects; on-premises writes continue over the private link." One perimeter around both projects and the restricted VIP.
- "Admins need SSH, VMs have no external IPs, no VPN." IAP TCP forwarding.
What to remember for the exam
- VPC Service Controls stop data leaving through Google APIs, even with valid IAM.
- Access levels add network, device and identity context.
- IAP gives per-user app and SSH access without a VPN.
- Hierarchical firewall policies enforce rules across folders and the organization.
- Workload Identity Federation and impersonation replace service account keys.
VPC Service Controls protect Google API access, not VM-to-VM traffic. Use firewall policies for that.
Common mistakes
Firewalls to stop API-based exfiltration. Firewalls do not govern API calls.
Domain restricted sharing as an exfiltration control. It limits who receives roles, not where data goes.
Keys in a vault, rotated monthly, when federation removes them entirely.
Check yourself
What stops a user with valid permissions from copying BigQuery data to a project outside the organization's control?
A VPC Service Controls perimeter restricting BigQuery.
How can an on-premises CI system deploy without service account keys?
Workload Identity Federation, exchanging its OIDC tokens for short-lived credentials to impersonate a deployer service account.
Which control gives SSH to VMs with no public IPs and no VPN?
IAP TCP forwarding.
Topic 3 of 5 in Designing for security and compliance
Test yourself on Designing for security and compliance
The full Google Cloud Professional Cloud Architect question bank has 877 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Google Cloud. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.