Google Cloud Search는 데이터 보안을 강화할 수 있도록 VPC 서비스 제어를 지원합니다. VPC 서비스 제어를 사용하면 Google Cloud Platform 리소스 주위에 서비스 경계를 정의하여 데이터를 통제하고 데이터 무단 반출 위험을 완화할 수 있습니다.
PROJECTS는 하나 이상의 프로젝트 번호의 쉼표로 구분된 목록이며, 각 번호 앞에는 projects/ 문자열이 붙습니다. 1단계에서 가져온 프로젝트 번호를 사용합니다. 예를 들어 프로젝트가 12345와 67890 두 개 있는 경우 설정은 --resource=projects/12345, project/67890가 됩니다 .이 플래그는 프로젝트 번호만 지원하며 이름이나 ID는 지원하지 않습니다.
RESTRICTED-SERVICES는 쉼표로 구분된 하나 이상의 서비스 목록입니다.
cloudsearch.googleapis.com를 사용합니다.
(선택사항) IP 또는 지역 기반 제한을 적용하려면 액세스 수준을 만들고 3단계에서 만든 서비스 경계에 추가합니다.
액세스 수준을 만들려면 기본 액세스 수준 만들기를 참고하세요.
회사 네트워크 내의 IP 주소와 같이 특정 범위의 IP 주소에서만 액세스를 허용하는 액세스 수준 조건을 만드는 방법의 예는 회사 네트워크의 액세스 제한을 참고하세요.
액세스 수준을 만든 후 서비스 경계에 추가합니다.
서비스 경계에 액세스 수준을 추가하는 방법은 기존 경계에 액세스 수준 추가를 참고하세요.
이 변경사항이 전파되어 적용되는 데 최대 30분이 걸릴 수 있습니다.
Cloud Search 고객 서비스 REST API를 사용하여 VPC 서비스 제어 경계로 보호되는 프로젝트로 고객 설정을 업데이트합니다.
Google 승인 서버에서 OAuth 2.0 액세스 토큰을 가져옵니다.
토큰을 가져오는 방법에 대한 자세한 내용은 OAuth 2.0을 사용하여 Google API에 액세스하기의 2단계를 참고하세요.
액세스 토큰을 가져올 때 다음 OAuth 범위 중 하나를 사용합니다.
https://www.googleapis.com/auth/cloud_search.settings.indexing,
https://www.googleapis.com/auth/cloud_search.settings 또는 https://www.googleapis.com/auth/cloud_search
다음 curl 명령어를 실행하여 Google Cloud Search의 고객 설정 아래에 있는 VPC 서비스 제어 설정에서 프로젝트를 설정합니다.
YOUR_ACCESS_TOKEN은 5a단계에서 획득한 OAuth 2.0 액세스 토큰입니다.
PROJECT_ID은 1단계에서 획득한 프로젝트 ID입니다.
성공하면 업데이트된 고객 설정과 함께 200 OK 응답이 표시됩니다.
위 단계를 완료하면 서비스 경계에 정의된 VPC 서비스 제어 제한이 모든 Google Cloud Search API, cloudsearch.google.com에서의 검색, 관리 콘솔을 사용한 구성 또는 보고서 보기 및 변경에 적용됩니다. 액세스 수준을 따르지 않는 Google Cloud Search API에 대한 추가 요청은 PERMISSION_DENIED “Request is prohibited by organization’s policy” 오류를 수신합니다.
[null,null,["최종 업데이트: 2025-08-29(UTC)"],[],[],null,["# Enhance security with VPC Service Controls\n\nGoogle Cloud Search supports VPC Service Controls\nto enhance the security of your data. VPC Service Controls allows you to define\na service perimeter around Google Cloud Platform resources to constrain data\nand help mitigate data exfiltration risks.\n| **Note:** Cloud Search supports restricted VIP which provides a private network route to make data and resources inaccessible from the internet. For information on setting up restricted VIP, refer to [Setting up private connectivity to Google APIs and services](https://cloud.google.com/vpc-service-controls/docs/set-up-private-connectivity).\n\nPrerequisites\n-------------\n\nBefore you begin,\n[install the gcloud command-line interface](https://cloud.google.com/sdk/gcloud).\n\nEnable VPC Service Controls\n---------------------------\n\nTo enable VPC Service Controls:\n\n1. Obtain the project IDs and project numbers for the Google Cloud Platform\n project you want to use. To obtain the project IDs and numbers, refer to\n [Identifying projects](https://cloud.google.com/resource-manager/docs/creating-managing-projects#identifying_projects).\n\n2. Use gcloud to create an access policy for your Google Cloud Platform\n organization:\n\n 1. [Get your organization ID](https://cloud.google.com/resource-manager/docs/creating-managing-organization#retrieving_your_organization_id).\n 2. [Create an access policy](https://cloud.google.com/access-context-manager/docs/create-access-policy).\n 3. [Get the name of your access policy](https://cloud.google.com/access-context-manager/docs/manage-access-policy#gcloud).\n\n | **Note:** Organizations can only have one access policy. If you attempt to create a second access policy for for your organization, an error occurs.\n3. Create a service perimeter with Cloud Search as a restricted service by\n running the following gcloud command:\n\n gcloud access-context-manager perimeters create NAME \\\n --title=TITLE \\\n --resources=PROJECTS \\\n --restricted-services=RESTRICTED-SERVICES \\\n --policy=POLICY_NAME\n\n Where:\n - `NAME` is the name of the perimeter.\n - `TITLE` is the human-readable title of the perimeter.\n - `PROJECTS` is a comma-separated list of one or more project numbers, each preceded by the string `projects/`. Use the project numbers obtained in step 1. For example, if you had two projects, project `12345` and `67890`, your setting would be `--resource=projects/12345, project/67890` .This flag only supports project numbers; it doesn't support names or IDs.\n - `RESTRICTED-SERVICES` is a comma-separated list of one or more services. Use `cloudsearch.googleapis.com`.\n - `POLICY_NAME` is the numeric name of your organization's access policy obtained in step 2c.\n\n For further information on how to create a service perimeter, refer to\n [Creating a service perimeter](https://cloud.google.com/vpc-service-controls/docs/create-service-perimeters).\n4. (optional) If you want to apply IP or region-based restrictions, create\n access levels and add them to the service perimeter created in step 3:\n\n 1. To create an access level, refer to [Creating an basic access level](https://cloud.google.com/access-context-manager/docs/create-basic-access-level). For an example on how to create an access level condition that only allows access from a specific range of IP addresses, such as those within a corporate network, refer to [Limit access on a corporate network](https://cloud.google.com/access-context-manager/docs/create-basic-access-level#corporate-network-example).\n 2. After you have created an access level, add it to the service perimeter. For instructions on adding an access level to a service perimeter, refer to [Adding an access level to an existing perimeter](https://cloud.google.com/vpc-service-controls/docs/manage-service-perimeters#add-access-level). This change can take up to 30 minutes for this change to propagate and take effect.\n5. Use the Cloud Search Customer Service REST API to update the customer\n settings with your VPC Service Controls perimeter-protected project:\n\n| **Note:** Because Cloud Search resources are not stored in a Google Cloud Platform project, you must update the Cloud Search customer settings with the VPC Service Controls perimeter-protected project. The VPC Service Controls project acts as a virtual project container for all your Cloud Search resources. Without building this mapping, VPC Service Controls won't work for the Cloud Search API.\n\n1. Obtain an OAuth 2.0 access token from the Google Authorization Server.\n For information on obtaining the token, refer to step 2 of\n [Using OAuth 2.0 to Access Google APIs](https://developers.google.com/identity/protocols/oauth2).\n When obtaining the access token, use one of the following OAuth scopes:\n `https://www.googleapis.com/auth/cloud_search.settings.indexing`,\n `https://www.googleapis.com/auth/cloud_search.settings`,\n or `https://www.googleapis.com/auth/cloud_search`\n\n2. Run the following curl command to set the project in VPC Service Controls\n settings under Customer settings in Google Cloud Search:\n\n curl --request PATCH \\\n 'https://cloudsearch.googleapis.com/v1/settings/customer' \\\n --header 'Authorization: Bearer [YOUR_ACCESS_TOKEN]' \\\n --header 'Accept: application/json' \\\n --header 'Content-Type: application/json' \\\n --data '{ \"vpc_settings\": { \"project\": \"projects/PROJECT_ID\" } }' \\\n --compressed\n\n Where:\n\n- `YOUR_ACCESS_TOKEN` is OAuth 2.0 access token obtained in step 5a.\n- `PROJECT_ID` is the project ID obtained in step 1.\n\n If successful, you should receive a `200 OK` response accompanied by the\n updated customer settings.\n\nAfter the above steps are completed successfully, the VPC Service Controls\nrestrictions, as defined in the service perimeter, are applied to all Google\nCloud Search APIs, searches at `cloudsearch.google.com`, and viewing and\nchanging configuration or reports using the Admin console. Further requests\nto the Google Cloud Search API that don't follow access levels receive a\n`PERMISSION_DENIED \"Request is prohibited by organization's policy\"` error."]]
