The short answer
In enterprise organizations managing regulated data estates, relying exclusively on Identity and Access Management () permissions creates an incomplete security perimeter. If an employee or compromised service account possesses valid bigquery.admin or storage.objectAdmin credentials, they could export internal customer records and write them to an unauthorized external Google Cloud project or personal Cloud Storage bucket.
VPC Service Controls (VPC-SC) creates a cryptographic security perimeter around Google Cloud resources.
How service perimeters operate
VPC Service Controls defines service perimeters at the Google Cloud organization level:
- You group trusted Google Cloud projects (such as your data ingestion, BigQuery analytics, and Dataproc projects) inside a shared perimeter.
- You specify protected Google APIs (such as
bigquery.googleapis.comandstorage.googleapis.com).
VPC Service Controls Perimeter +-------------------------------------------------------------+ | Production Project (BigQuery + GCS) | | Data Engineer with valid IAM credentials | | | | Query internal data: [ ALLOWED ] | | Export data to internal GCS: [ ALLOWED ] | | | | Copy data to external bucket: [ BLOCKED BY VPC-SC POLICY ] | +-------------------------------------------------------------+
Once enclosed within a perimeter, communication between services inside the perimeter and clients outside the perimeter is blocked at the Google API network layer, regardless of IAM permissions.
Ingress and egress rules
To allow legitimate data sharing across perimeter boundaries (such as receiving partner data or publishing curated reporting tables):
- Administrators define explicit Egress Rules specifying the target project ID, service identity, and destination bucket.
- Any attempt to exfiltrate data to an unspecified project throws a
VPC Service Controls: Request is prohibited by organization policyerror immediately.