This page shows you how to protect your Filestore instances with a
service perimeter using VPC Service Controls.

VPC Service Controls protect against data exfiltration and provide an extra
layer of security for your instances. For more information about
VPC Service Controls, see
[Overview of VPC Service Controls](https://docs.cloud.google.com/vpc-service-controls/docs/overview.md.txt).

Once the Filestore API is protected by a service perimeter,
Filestore API requests coming from clients outside of the perimeter
must have the proper access level rules.

## Securing your Filestore instances using VPC Service Controls

1. [Create a service perimeter](https://docs.cloud.google.com/vpc-service-controls/docs/create-service-perimeters.md.txt).

2. Add the Filestore API to your service perimeter. For
   instructions on adding a service to your service perimeter, see
   [Updating a service perimeter](https://docs.cloud.google.com/vpc-service-controls/docs/manage-service-perimeters.md.txt#update).

## Limitations of VPC Service Controls for Filestore instances

For a list of VPC Service Controls limitations for Filestore, see
[Supported products and limitations](https://docs.cloud.google.com/vpc-service-controls/docs/supported-products.md.txt#table_filestore).