Configure VPC Service Controls

This guide describes how to configure VPC Service Controls for Universal Ledger to enhance security and help mitigate data exfiltration risks.

VPC Service Controls provides an extra layer of defense for Google Cloud services that is independent of Identity and Access Management (IAM). By configuring a service perimeter, you can restrict access to the Universal Ledger API to authorized requests, such as those originating from within your Virtual Private Cloud networks or authorized IP addresses using the restricted VIP.

Protect Universal Ledger with a service perimeter

To protect Universal Ledger resources using VPC Service Controls:

  1. Add the API to the perimeter: Include the Universal Ledger API (universalledger.googleapis.com) in the list of restricted services within your service perimeter. For instructions, see Create a service perimeter or Update a service perimeter.

  2. Route requests through the restricted VIP: Configure private connectivity such that requests to universalledger.googleapis.com are routed to the restricted VIP (restricted.googleapis.com). For details on configuring DNS records and routes, see Set up private connectivity.

Limitations and security considerations

The following sections describe the limitations and security considerations for using VPC Service Controls with Universal Ledger.

Shared ledger and transaction data

The Universal Ledger API operates on shared, multi-tenant networks where data submitted to the ledger is classified as Transaction Data. Under the service-specific terms, Transaction Data—which includes transaction payloads, public keys, and cryptographic signatures—is explicitly excluded from the definition of Customer Data.

Because of the shared nature of the ledger network, Transaction Data submitted to the ledger becomes accessible to all authorized ledger participants. Consequently, this data cannot be restricted or contained by an individual organization's VPC Service Controls perimeter configuration.

Data exfiltration mitigation

Although VPC Service Controls protects API ingress and egress traffic, it does not enforce data visibility after transactions are committed to the shared ledger.

To help prevent data exfiltration, use IAM deny policies to restrict methods that modify or publish data, such as universalledger.endpoints.submitTransaction. This approach blocks unauthorized users from publishing data from inside the perimeter while still permitting read-only queries.

For more information, see the Universal Ledger entry in the VPC Service Controls supported products and limitations documentation.

What's next