Description

Ensure that the Cloud Storage API is included within a VPC Service Controls service perimeter, so that access to Cloud Storage resources is restricted to requests originating from within the trusted perimeter and data exfiltration to unauthorized projects or the public internet is prevented.

Rationale

IAM policies alone control who can access a resource, but they do not prevent a compromised or malicious identity with valid permissions from exfiltrating data to an external project, personal account, or the public internet. VPC Service Controls creates a network-level security perimeter around Cloud Storage (and other supported services), so that even a principal with valid IAM permissions cannot move data outside the defined perimeter, providing a strong defense-in-depth control against data exfiltration.

Impact

  • Prevents data exfiltration from Cloud Storage to projects or services outside the defined security perimeter

  • Provides defense-in-depth beyond IAM permissions alone

  • Requires careful perimeter design and testing, since a misconfigured perimeter can block legitimate access patterns

Default Value

By default, Cloud Storage is not protected by any VPC Service Controls perimeter; a perimeter must be created and Cloud Storage explicitly included in its restricted services.

Pre-Requisites

  • An organization node with Access Context Manager and VPC Service Controls enabled

  • IAM permissions to create and manage service perimeters (e.g., Access Context Manager Admin)

  • A documented list of projects, networks, and access levels that require legitimate access to the protected Cloud Storage resources

Test Plan

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Navigate to Security > VPC Service Controls.

  3. Select the relevant service perimeter, or confirm whether one exists for the project/organization in scope.

  4. Open the perimeter's Resources and Restricted services configuration.

  5. Verify that the project is included as a protected resource and that storage.googleapis.com (Cloud Storage API) is listed as a restricted service.

  6. Verify the perimeter is in Enforced mode rather than Dry run, if enforcement is required.

  7. If Cloud Storage is not included in an enforced perimeter, follow the implementation steps.

Implementation Steps

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Navigate to Security > VPC Service Controls.

  3. Select an existing perimeter or select New Perimeter to create one.

  4. Under Resources, add the project(s) containing the Cloud Storage buckets to protect.

  5. Under Restricted services, add the Cloud Storage API (storage.googleapis.com).

  6. Configure access levels or ingress/egress rules as needed to allow legitimate access patterns (for example, from approved networks or identities).

  7. Save the perimeter initially in Dry run mode and review the generated violation logs to confirm no legitimate traffic is blocked.

  8. Once validated, switch the perimeter to Enforced mode.

Backout Plan

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Navigate to Security > VPC Service Controls.

  3. Select the relevant perimeter.

  4. Either switch the perimeter back to Dry run mode, or remove the Cloud Storage API from Restricted services, or remove the project from the perimeter's Resources.

  5. Save the change.

Reference