VPC Service Controls improves your security posture by providing service-level perimeters around Google Cloud resources to prevent data exfiltration.
When your organization protects resources inside a service perimeter, Security Command Center services need appropriate ingress or egress rules to scan resources, monitor log streams, and export findings across perimeter boundaries.
If your VPC Service Controls perimeters restrict access of the Security Center Service Agent some parts of Security Command Center might not work properly, including threat detection services such as Event Threat Detection and continuous finding exports. To help prevent configuration errors and missing detections, ensure that ingress and egress policies grant the Security Center Service Agent access to required APIs.
If Security Health Analytics detects that perimeter restrictions block scanning or services,
it generates a VPC Service Controls Restriction (VPC_SC_RESTRICTION) error finding.
Supported services and configuration guides
The following table lists Security Command Center services and capabilities that support VPC Service Controls service perimeters and links to guides that explain how to configure perimeter access.
| Service or feature | Configuration guide |
|---|---|
| Security Health Analytics | Scanning projects protected by a service perimeter |
| Event Threat Detection | Allow Event Threat Detection to access VPC Service Controls perimeters |
| Virtual Machine Threat Detection | Allow VM Threat Detection to access VPC Service Controls perimeters |
| Container Threat Detection | Scan projects protected by a service perimeter |
| Mandiant Attack Surface Management | Use Mandiant Attack Surface Management with VPC Service Controls |
| Vulnerability Assessment for Google Cloud | Allow Vulnerability Assessment for Google Cloud to access VPC Service Controls perimeters |
| Compliance Manager | Use Compliance Manager with VPC Service Controls |
| Assured Open Source Software | Configure Assured Open Source Software (Assured OSS) support for VPC Service Controls |
| Finding notifications to Pub/Sub | Grant perimeter access for finding notifications |
| Continuous exports to BigQuery | Grant perimeter access for BigQuery exports |