Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Google Cloud Search mendukung Kontrol Layanan VPC
untuk meningkatkan keamanan data Anda. Kontrol Layanan VPC memungkinkan Anda menentukan
perimeter layanan di seputar resource Google Cloud Platform untuk membatasi data
dan membantu mengurangi risiko pemindahan data yang tidak sah.
Dapatkan project ID dan nomor project untuk project Google Cloud Platform yang ingin Anda gunakan. Untuk mendapatkan ID dan nomor project, lihat
Mengidentifikasi project.
Gunakan gcloud untuk membuat kebijakan akses bagi organisasi Google Cloud Platform Anda:
TITLE adalah judul perimeter yang dapat dibaca manusia.
PROJECTS adalah daftar yang dipisahkan koma yang berisi satu atau beberapa nomor project, yang masing-masing
diawali dengan string projects/. Gunakan nomor project yang diperoleh di langkah 1. Misalnya, jika Anda memiliki dua project, project 12345 dan 67890, setelan Anda adalah --resource=projects/12345, project/67890 .Flag ini hanya mendukung nomor project; tidak mendukung nama atau ID.
RESTRICTED-SERVICES adalah daftar yang dipisahkan koma dari satu atau beberapa layanan.
Gunakan cloudsearch.googleapis.com.
POLICY_NAME adalah nama numerik kebijakan akses organisasi Anda yang diperoleh di langkah 2c.
Untuk mengetahui informasi lebih lanjut tentang cara membuat perimeter layanan, lihat Membuat perimeter layanan.
(opsional) Jika Anda ingin menerapkan batasan berbasis IP atau region, buat
tingkat akses dan tambahkan ke perimeter layanan yang dibuat pada langkah 3:
Untuk membuat tingkat akses, lihat
Membuat tingkat akses dasar.
Untuk contoh cara membuat kondisi tingkat akses yang hanya mengizinkan
akses dari rentang alamat IP tertentu, seperti yang ada dalam jaringan
perusahaan, lihat
Membatasi akses di jaringan perusahaan.
Setelah membuat tingkat akses, tambahkan ke perimeter layanan.
Untuk mengetahui petunjuk cara menambahkan tingkat akses ke perimeter layanan, lihat
Menambahkan tingkat akses ke perimeter yang ada.
Perubahan ini mungkin memerlukan waktu hingga 30 menit agar diterapkan dan berlaku.
Gunakan Cloud Search Customer Service REST API untuk memperbarui setelan pelanggan dengan project yang dilindungi perimeter Kontrol Layanan VPC Anda:
Dapatkan token akses OAuth 2.0 dari Server Otorisasi Google.
Untuk mengetahui informasi tentang cara mendapatkan token, lihat langkah 2 dalam artikel
Menggunakan OAuth 2.0 untuk Mengakses Google API.
Saat mendapatkan token akses, gunakan salah satu cakupan OAuth berikut:
https://www.googleapis.com/auth/cloud_search.settings.indexing,
https://www.googleapis.com/auth/cloud_search.settings,
atau https://www.googleapis.com/auth/cloud_search
Jalankan perintah curl berikut untuk menyetel project di setelan Kontrol Layanan VPC di bagian Setelan pelanggan di Google Cloud Search:
YOUR_ACCESS_TOKEN adalah token akses OAuth 2.0 yang diperoleh pada langkah 5a.
PROJECT_ID adalah project ID yang diperoleh di langkah 1.
Jika berhasil, Anda akan menerima respons 200 OK yang disertai dengan
setelan pelanggan yang telah diperbarui.
Setelah langkah-langkah di atas berhasil diselesaikan, pembatasan Kontrol Layanan VPC, sebagaimana ditentukan dalam perimeter layanan, diterapkan ke semua Google Cloud Search API, penelusuran di cloudsearch.google.com, serta melihat dan mengubah konfigurasi atau laporan menggunakan konsol Admin. Permintaan lebih lanjut
ke Google Cloud Search API yang tidak mengikuti tingkat akses akan menerima error
PERMISSION_DENIED “Request is prohibited by organization’s policy”.
[null,null,["Terakhir diperbarui pada 2025-08-29 UTC."],[],[],null,["# Enhance security with VPC Service Controls\n\nGoogle Cloud Search supports VPC Service Controls\nto enhance the security of your data. VPC Service Controls allows you to define\na service perimeter around Google Cloud Platform resources to constrain data\nand help mitigate data exfiltration risks.\n| **Note:** Cloud Search supports restricted VIP which provides a private network route to make data and resources inaccessible from the internet. For information on setting up restricted VIP, refer to [Setting up private connectivity to Google APIs and services](https://cloud.google.com/vpc-service-controls/docs/set-up-private-connectivity).\n\nPrerequisites\n-------------\n\nBefore you begin,\n[install the gcloud command-line interface](https://cloud.google.com/sdk/gcloud).\n\nEnable VPC Service Controls\n---------------------------\n\nTo enable VPC Service Controls:\n\n1. Obtain the project IDs and project numbers for the Google Cloud Platform\n project you want to use. To obtain the project IDs and numbers, refer to\n [Identifying projects](https://cloud.google.com/resource-manager/docs/creating-managing-projects#identifying_projects).\n\n2. Use gcloud to create an access policy for your Google Cloud Platform\n organization:\n\n 1. [Get your organization ID](https://cloud.google.com/resource-manager/docs/creating-managing-organization#retrieving_your_organization_id).\n 2. [Create an access policy](https://cloud.google.com/access-context-manager/docs/create-access-policy).\n 3. [Get the name of your access policy](https://cloud.google.com/access-context-manager/docs/manage-access-policy#gcloud).\n\n | **Note:** Organizations can only have one access policy. If you attempt to create a second access policy for for your organization, an error occurs.\n3. Create a service perimeter with Cloud Search as a restricted service by\n running the following gcloud command:\n\n gcloud access-context-manager perimeters create NAME \\\n --title=TITLE \\\n --resources=PROJECTS \\\n --restricted-services=RESTRICTED-SERVICES \\\n --policy=POLICY_NAME\n\n Where:\n - `NAME` is the name of the perimeter.\n - `TITLE` is the human-readable title of the perimeter.\n - `PROJECTS` is a comma-separated list of one or more project numbers, each preceded by the string `projects/`. Use the project numbers obtained in step 1. For example, if you had two projects, project `12345` and `67890`, your setting would be `--resource=projects/12345, project/67890` .This flag only supports project numbers; it doesn't support names or IDs.\n - `RESTRICTED-SERVICES` is a comma-separated list of one or more services. Use `cloudsearch.googleapis.com`.\n - `POLICY_NAME` is the numeric name of your organization's access policy obtained in step 2c.\n\n For further information on how to create a service perimeter, refer to\n [Creating a service perimeter](https://cloud.google.com/vpc-service-controls/docs/create-service-perimeters).\n4. (optional) If you want to apply IP or region-based restrictions, create\n access levels and add them to the service perimeter created in step 3:\n\n 1. To create an access level, refer to [Creating an basic access level](https://cloud.google.com/access-context-manager/docs/create-basic-access-level). For an example on how to create an access level condition that only allows access from a specific range of IP addresses, such as those within a corporate network, refer to [Limit access on a corporate network](https://cloud.google.com/access-context-manager/docs/create-basic-access-level#corporate-network-example).\n 2. After you have created an access level, add it to the service perimeter. For instructions on adding an access level to a service perimeter, refer to [Adding an access level to an existing perimeter](https://cloud.google.com/vpc-service-controls/docs/manage-service-perimeters#add-access-level). This change can take up to 30 minutes for this change to propagate and take effect.\n5. Use the Cloud Search Customer Service REST API to update the customer\n settings with your VPC Service Controls perimeter-protected project:\n\n| **Note:** Because Cloud Search resources are not stored in a Google Cloud Platform project, you must update the Cloud Search customer settings with the VPC Service Controls perimeter-protected project. The VPC Service Controls project acts as a virtual project container for all your Cloud Search resources. Without building this mapping, VPC Service Controls won't work for the Cloud Search API.\n\n1. Obtain an OAuth 2.0 access token from the Google Authorization Server.\n For information on obtaining the token, refer to step 2 of\n [Using OAuth 2.0 to Access Google APIs](https://developers.google.com/identity/protocols/oauth2).\n When obtaining the access token, use one of the following OAuth scopes:\n `https://www.googleapis.com/auth/cloud_search.settings.indexing`,\n `https://www.googleapis.com/auth/cloud_search.settings`,\n or `https://www.googleapis.com/auth/cloud_search`\n\n2. Run the following curl command to set the project in VPC Service Controls\n settings under Customer settings in Google Cloud Search:\n\n curl --request PATCH \\\n 'https://cloudsearch.googleapis.com/v1/settings/customer' \\\n --header 'Authorization: Bearer [YOUR_ACCESS_TOKEN]' \\\n --header 'Accept: application/json' \\\n --header 'Content-Type: application/json' \\\n --data '{ \"vpc_settings\": { \"project\": \"projects/PROJECT_ID\" } }' \\\n --compressed\n\n Where:\n\n- `YOUR_ACCESS_TOKEN` is OAuth 2.0 access token obtained in step 5a.\n- `PROJECT_ID` is the project ID obtained in step 1.\n\n If successful, you should receive a `200 OK` response accompanied by the\n updated customer settings.\n\nAfter the above steps are completed successfully, the VPC Service Controls\nrestrictions, as defined in the service perimeter, are applied to all Google\nCloud Search APIs, searches at `cloudsearch.google.com`, and viewing and\nchanging configuration or reports using the Admin console. Further requests\nto the Google Cloud Search API that don't follow access levels receive a\n`PERMISSION_DENIED \"Request is prohibited by organization's policy\"` error."]]
