A healthcare enterprise maintains sensitive patient analytics workloads inside a Google Cloud project secured by a VPC Service Controls perimeter protecting BigQuery and Cloud Storage. A data science team operates an automated pipeline from a separate, un-perimeterized operations project that requires reading datasets from BigQuery inside the perimeter and writing results to Cloud Storage. Security policies strictly prohibit exposing perimeter resources to the public internet or relaxing IAM permissions broadly. Which architectural solution securely grants the pipeline access while preserving the perimeter security boundary?
- Define VPC Service Controls Ingress and Egress rules to allow specific service account identities from the operations project to interact with protected services inside the perimeter.Cevap
- BConfigure VPC Network Peering between the operations VPC and the perimeter VPC, relying on IAM permissions to enforce data access controls.
- CSet up transitive routing through a shared hub VPC network to bridge traffic around the perimeter boundary without modifying VPC Service Controls policies.
- DGrant the primitive Owner role to the pipeline's service account at the organization level to automatically bypass all VPC Service Controls restrictions.
Cevap
Configure VPC Service Controls Ingress and Egress rules allowing explicit service account identities from the external project to communicate with perimeter resources.
VPC Service Controls Ingress and Egress rules provide a secure mechanism to allow explicitly authorized API traffic across a service perimeter boundary based on identity (e.g., service account email) and API attributes without disabling perimeter protections.
Adım Adım Çözüm
Anahtar Kavram
VPC Service Controls Ingress and Egress rules