> [!WARNING]
>
> **Preview**
>
>
> This feature is
>
> subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the
> [Service Specific
> Terms](https://docs.cloud.google.com/terms/service-terms#1).
>
> Pre-GA features are available "as is" and might have limited support.
>
> For more information, see the
> [launch stage descriptions](https://cloud.google.com/products/#product-launch-stages).

The VPC Service Controls [recommender](https://docs.cloud.google.com/recommender/docs/key-concepts.md.txt#recommenders)
provides recommendations and insights for resources and perimeters
on Google Cloud based on the perimeter configuration and
historical traffic usage. You can use these recommendations to strengthen your
exfiltration defense posture and optimal perimeter configurations with minimal
manual discovery.

Each recommendation includes insights on identified risks and actionable next
steps to apply the recommendation to your service perimeters.

Use the recommender to help protect your projects with perimeters and
optimize your VPC accessible services configurations. For more information, see the
[recommender documentation](https://docs.cloud.google.com/recommender/docs/whatis-activeassist.md.txt).

## Recommendations and insights addressed by the recommender

The following table describes what the VPC Service Controls
recommender detects and helps you address:

| Vulnerability or misconfiguration type | Detected insight | Recommended action |
|---|---|---|
| **Critical resources at risk of exfiltration** | Sensitive services in a project aren't restricted by a service perimeter (either directly or through folder membership), exposing resources to exfiltration risks. The recommender flags your most used VPC Service Controls supported services (such as BigQuery, Cloud Storage, Spanner, or Bigtable) based on historical request counts. | Configure a new service perimeter that restricts the identified project and its active services, or add the project to an existing service perimeter. |
| **Unconfigured VPC accessible services** | A service perimeter doesn't have [VPC accessible services](https://docs.cloud.google.com/vpc-service-controls/docs/vpc-accessible-services.md.txt) configured. By default, all supported APIs remain accessible from within the perimeter, increasing exfiltration risks from network endpoints inside the perimeter. | Enable the **VPC accessible services** restriction on the perimeter and limit access only to the set of services required by your workloads (minimally including the `RESTRICTED-SERVICES` value). |
| **Misconfigured VPC accessible services** | A service perimeter has configured accessible services that aren't inhibited or restricted within the perimeter (they aren't restricted services). This configuration allows unsanctioned traffic boundary crossings and exposes assets. | To correct the misconfiguration, do the following: - Removing the unrestricted services from the allowed VPC accessible services list. - Adding the services into the restricted services list for the perimeter to ensure consistent protection. |

## Before you begin

Before you can view or retrieve recommendations, do the following:

- Ensure that the **Recommender API** (`recommender.googleapis.com`) is enabled. For more information, see [Enabling the Recommender API](https://docs.cloud.google.com/recommender/docs/enable-api.md.txt).
- [Verify that you have the permissions required to view or retrieve
  recommendations](https://docs.cloud.google.com/vpc-service-controls/docs/recommender#required-roles).

### Required roles


To get the permissions that
you need to view or update recommendations,

ask your administrator to grant you the
following IAM roles on the project, folder, or organization:

- View recommendations and insights: [Recommender Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/recommender.md.txt#recommender.viewer) (`roles/recommender.viewer`)
- View, update, and dismiss recommendations: [Recommender Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/recommender.md.txt#recommender.admin) (`roles/recommender.admin`)


For more information about granting roles, see [Manage access to projects, folders, and organizations](https://docs.cloud.google.com/iam/docs/granting-changing-revoking-access.md.txt).


These predefined roles contain

the permissions required to view or update recommendations. To see the exact permissions that are
required, expand the **Required permissions** section:


#### Required permissions

The following permissions are required to view or update recommendations:

- View recommendations and insights:
  - `recommender.vpcScRecommendations.get`
  - `recommender.vpcScRecommendations.list`
- View, update, and dismiss recommendations: `recommender.vpcScRecommendations.update`


You might also be able to get
these permissions
with [custom roles](https://docs.cloud.google.com/iam/docs/creating-custom-roles.md.txt) or
other [predefined roles](https://docs.cloud.google.com/iam/docs/roles-overview.md.txt#predefined).

## Limitations

The recommender updates recommendations daily. If you create a new perimeter
or resolve an outstanding issue, it takes up to 24 hours for the
recommendations to update in Active Assist.

## View and apply recommendations

You can view and act on security recommendations for your projects and
perimeters using the Google Cloud console, the Google Cloud CLI, or the
Recommender API.

### Console

1. In the Google Cloud console, go to the **Active Assist** page.  

   [Go to Active Assist](https://console.cloud.google.com/home/recommendations)

2. Filter by **Security** or search for **VPC Service Controls**
   recommendations.

3. Click a VPC Service Controls recommendation card to open the details
   panel. The panel displays the underlying security insights, resources
   involved, and specific instructions.

4. Follow the instructions in the panel to configure or
   update your perimeters.

### gcloud

To retrieve recommendations using the Google Cloud CLI, run the
`gcloud recommender` command:

```bash
gcloud recommender recommendations list \
  --recommender=google.accessContextManager.VpcScRecommender \
  --location=global
```

For more details about filtering and processing metadata using
command-line tools, see the
[gcloud recommender CLI reference](https://docs.cloud.google.com/sdk/gcloud/reference/recommender/recommendations).

### API and exports

For large-scale automation or custom reporting, you can use the
following programmatic integrations:

- **Recommender API** : Retrieve recommendations programmatically. For more information, see [Using the Recommender API](https://docs.cloud.google.com/recommender/docs/using-api).
- **BigQuery export** : Set up automatic exports of all recommendations directly to a BigQuery dataset. This export is useful for creating custom visualization dashboards or piping data to a SIEM tool. For more information, see [Export recommendations to BigQuery](https://docs.cloud.google.com/recommender/docs/bq-export/export-recommendations-to-bq.md.txt).

## Apply recommendations for VPC accessible services

If the recommender alerts you to an unconfigured or misconfigured
allowed services list on a perimeter, you can resolve the issue using the
Google Cloud CLI.

### Resolve unconfigured accessible services

To enable VPC accessible services and configure them with a secure minimum
set of restricted APIs, run the following command:

```bash
gcloud access-context-manager perimeters update PERIMETER_NAME \
  --enable-vpc-accessible-services \
  --add-vpc-allowed-services=RESTRICTED-SERVICES
```

Replace the following:

- <var translate="no">PERIMETER_NAME</var>: The name of the service perimeter.

### Resolve misconfigured accessible services

If the allowed accessible services aren't aligned with your restricted services list, do one of the following to resolve the misconfiguration:

1. To restrict the allowed accessible services to the standard restricted services list, run the following command:

   ```bash
   gcloud access-context-manager perimeters update PERIMETER_NAME 

   --clear-vpc-allowed-services 

   --add-vpc-allowed-services=RESTRICTED-SERVICES
   ```
2. Alternatively, to add a specific service (such as `bigquery.googleapis.com` or `storage.googleapis.com`) to the perimeter's restricted list so that it matches the accessible services list, run the following command:

   ```bash
   gcloud access-context-manager perimeters update PERIMETER_NAME 

   --add-restricted-services=SERVICE_NAME
   ```

Replace the following:

- <var translate="no">PERIMETER_NAME</var>: The name of the service perimeter.
- <var translate="no">SERVICE_NAME</var>: The API identifier name of the service (such as `bigquery.googleapis.com` or `storage.googleapis.com`).

## What's next

- Learn how to [set up a service perimeter](https://docs.cloud.google.com/vpc-service-controls/docs/set-up-service-perimeter.md.txt).
- Understand how [VPC accessible services](https://docs.cloud.google.com/vpc-service-controls/docs/vpc-accessible-services.md.txt) can restrict the APIs accessible from within a perimeter.
- Learn how to [troubleshoot service perimeters](https://docs.cloud.google.com/vpc-service-controls/docs/troubleshooting.md.txt).