VPC Service Controls release notes

VPC Service Controls feature (Status: Preview): Support for optimizing service perimeters using the VPC Service Controls recommender is available.

The recommender detects architectural risks and perimeter misconfigurations, including the following:

• Critical resources at risk of exfiltration: Identifies active and sensitive services (such as BigQuery and Cloud Storage) operating outside service perimeters.

• Unconfigured VPC accessible services: Identifies perimeters that leave APIs unrestricted from within the security boundary.

• Misconfigured VPC accessible services: Identifies mismatches between allowed accessible APIs and restricted services inside a perimeter.

For more information, see Optimize perimeters with recommender.

VPC Service Controls feature: The VPC Service Controls service patterns feature is generally available. You can use service patterns to explicitly configure which Google APIs (both supported and unsupported) can be accessed from VPC networks within a service perimeter when using the private VIP (private.googleapis.com) or a Private Service Connect endpoint with the all-apis bundle.

For more information, see VPC Service Controls service patterns.

General availability support for the following integration:

• Gemini Cloud Assist

Preview stage support for the following integration:

• Google Antigravity in Gemini Enterprise

VPC Service Controls feature: Support for using the following identities in ingress and egress rules to allow access to resources protected by a service perimeter is generally available:

• Agent identities
• SPIFFE formats for third-party workforce and workload identities

For more information, see Configure identity groups and third-party identities in ingress and egress rules and Supported identities for ingress and egress rules.

General availability support for the following integration:

• Conversational Analytics API

General availability support for the following integration:

• Firebase Phone Number Verification

Preview stage support for the following integration:

• Workload Identity API

Preview stage support for the following integration:

• Firebase Phone Number Verification

Preview stage support for the following integration:

• Cloud Network Insights

VPC Service Controls feature: Support for using IAM roles in ingress and egress rules to allow access to resources protected by a service perimeter is generally available. This feature includes the following updates:

• You can use the gcloud access-context-manager supported-permissions describe command to check the support status of an IAM role.

• You can use the gcloud access-context-manager supported-permissions list command to retrieve the complete list of all supported permissions.

For more information, see Configure IAM roles in ingress and egress rules.

Preview stage support for the following integration:

• App Topology

Preview stage support for the following integration:

• Agent Registry

Preview stage support for the following integration:

• Cluster Director

General availability support for the following integration:

• Oracle Database@Google Cloud

Preview stage support for the following integration:

• App Lifecycle Manager

Preview stage support for the following integration:

• Oracle Database@Google Cloud

General availability support for the following integration:

• CX Agent Studio

VPC Service Controls feature (Status: Preview): VPC Service Controls supports the following identities in ingress and egress rules to allow access to resources protected by a service perimeter:

• Agent identities

• SPIFFE formats for third-party workforce and workload identities

This feature is available in Preview.

For more information, see Supported identities for ingress and egress rules.

General availability support for the following integration:

• Managed Lustre

Preview stage support for the following integration:

• Google Security Operations

Preview stage support for the following integration:

• Vector Search 2.0

Preview stage support for the following integration:

• Managed Lustre

Preview stage support for the following integration:

• CX Agent Studio

General availability support for the following integration:

• Distributed Cloud Edge Container API

General availability support for the following integration:

• Privileged Access Manager

Preview stage support for the following integration:

• Cloud Location Finder

General availability support for the following integration:

• Model Armor

Preview stage support for the following integration:

• Gemini Cloud Assist

General availability support for the following integration:

• Unified Maintenance

General availability support for the following integration:

• Firebase App Hosting

VPC Service Controls feature: The VPC Service Controls violation analyzer is generally available. You can use the violation analyzer to diagnose access denial events and generate comprehensive evaluation reports to help resolve the denial events.

The violation analyzer includes the following capabilities and updates:

• You can use a denial event's unique ID to generate a comprehensive evaluation report.
• Edit ingress and egress rules of a selected perimeter directly from the troubleshooting results page.
• View log entry details associated with a denial event directly on the troubleshooting results page.
• A few previous limitations in the violation analyzer have been removed.
• You don't need to enable the Policy Troubleshooter API to use the violation analyzer.

For more information, see Diagnose an access denial in violation analyzer.

Preview stage support for the following integration:

• Firebase App Hosting

Preview stage support for the following integration:

• App Design Center

Preview stage support for the following integration:

• Unified Maintenance

General availability support for the following integration:

• Address Validation

Updated the limitations for the following integration in the Supported products and limitations page:

• Policy Simulator: simulations on organization and folder resources are not protected by VPC Service Controls.

General availability support for the following integration:

• Vertex AI Agent Engine

General availability support for the following integration:

• Telemetry API

General availability support for the following integration:

• Google Cloud Managed Service for Apache Kafka

General availability support for the following integration:

• Personalized Service Health

Preview stage support for the following integration:

• Google Cloud Managed Service for Apache Kafka

General availability support for the following integration:

• Secure Web Proxy

General availability support for the following integration:

• License Manager

General availability support for the following integration:

• FleetPackage API

General availability support for the following integration:

• Backup for GKE

General availability support for the following integration:

• Eventarc Advanced

VPC Service Controls feature: The VPC Service Controls violation dashboard is generally available. This dashboard provides an aggregated view of all access denials by service perimeters in your organization.

• The following charts are added to the dashboard:
  • Violation count
  • Top violations by access policy
• While creating a new log bucket during the dashboard setup, you can now select the region and retention period.

For more information, see Set up and view the violation dashboard.

Preview stage support for the following integration:

• License Manager

Preview stage support for the following integration:

• Address Validation API

• Places (New) API

Preview stage support for the following integration:

• Firebase Crashlytics

General availability support for the following integration:

• Apigee API hub

Preview stage support for the following integration:

• FleetPackage API

General availability support for the following integration:

• Parameter Manager

Preview stage support for the following integration:

• Model Armor

Preview stage support for the following integration:

• Storage batch operations

Preview stage support for the following integration:

• Assured Open Source Software

Preview stage support for the following integration:

• Apigee API hub

Preview stage support for the following integration:

• Secure Web Proxy

Updated the limitations for the following integration in the Supported products and limitations page:

• Firestore: using Firestore Enterprise edition with restricted VIP requires adding IP ranges to an allowlist.

General availability support for the following integration:

• Service Usage

General availability support for the following integration:

• Agent Assist

General availability support for the following integration:

• Database Center

General availability support for the following integration:

• Google Agentspace Enterprise

General availability support for the following integration:

• Storage Intelligence API

VPC Service Controls feature (Status: Preview): VPC Service Controls adds support for using IAM roles in ingress and egress rules to allow access to resources protected by service perimeters. This feature is available in Preview.

For more information, see Configure IAM roles in ingress and egress rules.

Preview stage support for the following integration:

• Firebase Data Connect

General availability support for the following integration:

• Service Networking

Preview stage support for the following integration:

• Telemetry (OTLP) API

The Dialogflow entry has been corrected to reflect that the Dialogflow integration with VPC Service Controls is generally available (GA).

The integration of Dialogflow with VPC Service Controls has been generally available since January 29, 2021.

Preview stage support for the following integration:

• Parameter Manager

VPC Service Controls now supports custom organization policies. This feature is generally available (GA). For more information, see Create custom constraints for VPC Service Controls.

Preview stage support for the following integration:

• Service Usage

VPC Service Controls feature (Status: Preview): The VPC Service Controls violation analyzer lets you diagnose access denial events for services in your perimeters using an encrypted troubleshooting token generated by VPC Service Controls. The violation analyzer also provides troubleshooting results that can help you understand and resolve the access denial events. This feature is available in Preview.

For more information, see Diagnose an access denial event using the VPC Service Controls violation analyzer.

Preview stage support for the following integration:

• Google Agentspace Enterprise

General availability support for the following integration:

• NotebookLM Enterprise

General availability support for the following integration:

• Database Insights API

VPC Service Controls feature (Status: Preview): The VPC Service Controls violation dashboard provides an aggregated view of all access denials by service perimeters in your organization. This feature is available in Preview.

For more information, see Set up and view the violation dashboard.

VPC Service Controls feature: Support for using third-party identities (both single identities and groups) in the ingress and egress rules to allow access to resources protected by a service perimeter is generally available.

For more information, see Configure identity groups and third-party identities in ingress and egress rules.

VPC Service Controls feature: Support for adding projects as a source in the egress rules of a service perimeter is generally available.

For more information, see Ingress and egress rules.

VPC Service Controls feature: Support for adding titles in the ingress and egress rules of a service perimeter is generally available.

For more information, see Ingress and egress rules.

General availability support for the following integration:

• Autoscaling

Preview stage support for the following integration:

• Database Insights API

General availability support for the following integration:

• Memorystore for Valkey

VPC Service Controls feature: Support for using identity groups in the ingress and egress rules to allow access to resources protected by a service perimeter is generally available.

For more information, see Configure identity groups and third-party identities in ingress and egress rules.

VPC Service Controls feature: VPC Service Controls extends support for etags in the service perimeter resources. For example, you can use the --etag flag with the gcloud CLI commands such as gcloud access-context-manager perimeters update and gcloud access-context-manager perimeters describe. This feature is generally available.

VPC Service Controls feature (Status: Preview): VPC Service Controls adds support for using groups of third-party identities in ingress and egress rules to allow access to resources protected by service perimeters. This feature is available in Preview.

For more information, see Configure identity groups and third-party identities in ingress and egress rules.

General availability support for the following integration:

• Vertex AI in Firebase

Updated the correct support status for the following integration in the Supported products and limitations page:

• Dialogflow is in Preview stage.

This note is incorrect; see entry for March 24, 2025

Preview stage support for the following integration:

• Audit Manager

General availability support for the following integration:

• Google Cloud Contact Center as a Service

Preview stage support for the following integration:

• Privileged Access Manager

General availability support for the following integration:

• Google Cloud VMware Engine

General availability support for the following integration:

• Workload Manager

Preview stage support for the following integration:

• Contact Center AI Platform

VPC Service Controls feature: VPC Service Controls supports using identity groups and third-party identities (only single identities) in ingress and egress rules to allow access to resources protected by service perimeters. This feature is available in Preview.

For more information, see Configure identity groups and third-party identities in ingress and egress rules. You can also learn an example of using identity groups and third-party identities in ingress and egress rules.

Preview stage support for the following integration:

• Commerce Org Governance API

VPC Service Controls feature: Support to programmatically retrieve the list of services that are supported by VPC Service Controls is generally available. Using this feature, you also can retrieve the list of methods and permissions supported by VPC Service Controls for a service.

• The following changes are made in the output of the gcloud access-context-manager supported-services list command:
  • The field name SUPPORT_STAGE is changed into SERVICE_SUPPORT_STAGE.
  • The status BETA is changed into PREVIEW in the SERVICE_SUPPORT_STAGE field.
  • A new status DEPRECATED is added in the SERVICE_SUPPORT_STAGE field.
• The field name supportStage is changed into serviceSupportStage in the output of the gcloud access-context-manager supported-services describe command.

VPC Service Controls feature: Support for using an internal IP address to allow access to protected resources is generally available.

For more information, see Allow access to protected resources from an internal IP address. Make sure that you read the updated Limitations section before using this feature.

Preview stage support for the following integration:

• Kubernetes Metadata API

For more information, see Anthos On-Prem API, Google Kubernetes Engine, and GKE Multi-Cloud.

Preview stage support for the following integration:

• Workload Manager

General availability support for the following integration:

• Sovereign Controls by Partners

General availability support for the following integration:

• Backup and DR Service

General availability support for the following integration:

• Cloud Quotas

General availability support for the following integration:

• Secure Source Manager

General availability support for the following integration:

• API keys

General availability support for the following integration:

• Migration Center

Preview stage support for the following integration:

• Sovereign Controls by Partners

Preview stage support for the following integration:

• Cloud Code

Beta stage support for the following integration:

• App Hub

General availability support for the following integration:

• Earth Engine

Preview stage support for the following integration:

• API keys

General availability support for the following integration:

• Storage Insights

General availability support for the following integration:

• Google Cloud Serverless for Apache Spark (formerly known as Dataproc Serverless)

General availability support for the following integration:

• Colab Enterprise

General availability support for the following integration:

• Infrastructure Manager

Preview stage support for the following integration:

• Earth Engine

General availability support for the following integration:

• Dataform

General availability support for the following integration:

• Security Command Center

General availability support for the following integration:

• Web Security Scanner

General availability support for the following integration:

• Blockchain Node Engine

General availability support for the following integration:

• Parallelstore

Preview stage support for the following integration:

• Personalized Service Health

The ability to programmatically retrieve the list of services that are supported by VPC Service Controls is available in Preview. Using this feature, you can also retrieve the list of methods and permissions supported by VPC Service Controls for a service.

General availability support for the following integration:

• Integration Connectors

General availability support for the following integration:

• Microservices

The ability to allow access to protected resources from an internal IP address is available in Preview.

Preview stage supported for the following integration:

• Web Security Scanner

General availability support for the following integration:

• Confidential Space

Preview stage supported for the following integration:

• Security Command Center

Preview stage supported for the following integration:

• Confidential Space

General availability support for the following integration:

• Duet AI in Google Cloud

Preview stage supported for the following integration:

• Infrastructure Manager

Preview stage support for the following integration:

• Serial console

General availability support for the following integration:

• NetApp Volumes

Preview stage support for the following integration:

• Backup and DR Service

General availability support for the following integration:

• Certificate Manager

Preview stage support for the following integration:

• Generative AI App Builder - Enterprise Search

Preview stage support for the following integration:

• Certificate Manager

Preview stage support for the following integration:

• Integration Connectors

General availability support for the following integration:

• Batch

The Quota page displays only the default quota limits and doesn't include any additional quotas provided by Google.

For information about VPC Service Controls quotas, see Quotas and limits.

Preview stage support for the following integration:

• Cloud Customer Care

General availability for the following integration:

• Live Stream API

Preview stage support for the following integration:

• Storage Insights

General availability for the following integration:

• Looker (Google Cloud core)

VPC Service Controls support for Cloud Scheduler jobs with the following targets is now in Preview:

• Cloud Functions
• Cloud Run
• Dataflow API
• Data Pipelines

To learn more, see the documentation on how to secure cron jobs with VPC Service Controls.

Preview stage support for the following integration:

• Looker (Google Cloud core)

Preview stage support for the following integration:

• Dataflow Data Pipelines

Preview stage support for the following integration:

• Resource Manager tags API

Preview stage support for the following integration:

• On-Demand Scanning API

Preview stage support for the following integration:

• Public Certificate Authority

Preview stage support for the following integration:

• Visual Inspection AI

The ability to add individual VPC networks to a perimeter is generally available (GA).

Previously, all VPC networks in a host project were added to a perimeter. You can now do the following:

• Add individual VPC networks as members of a perimeter.
• Create an ingress rule to authorize individual VPC networks to access a perimeter.

Preview stage support for the following integration:

• Policy Simulator

Preview stage support for the following integration:

• Identity Platform

General availability for the following integration:

• BigQuery Data Policy API

Preview stage support for the following integration:

• Essential Contacts

Support for Cloud Tasks is now at General Availability. To learn more, see the Cloud Tasks documentation on setting up a service perimeter using VPC Service Controls.

Preview stage support for the following integration:

• Policy Troubleshooter

Preview stage support for the following integration:

• Video Stitcher API

Preview stage support for the following integrations:

• Batch

Preview stage support for the following integration:

• Bare Metal Solution

Preview stage support for the following integrations:

• Cloud IDS
• Document AI Warehouse

Preview stage support for the following integration:

• Data Lineage API

Beta stage support for the following integration:

• Config Controller

Beta stage support for the following integration:

• BigQuery Data Policy API

General availability for the following integration:

• Organization Policy Service

Preview stage support for the following integration:

• Cloud Workstations

General availability for the following integration:

• Analytics Hub

Beta stage support for the following integration:

• Organization Policy Service

General availability support for the following integration:

• Service Account Credentials API

General availability for the following integration:

• Web Risk

Beta stage support for the following integration:

• Service Account Credentials API

Beta stage support for the following integration:

• Integration Platform

General availability for the following integration:

• BigQuery Reservation API

Support to add individual VPC networks to a perimeter is now available in Preview.

Previously, the entire VPC host project was added to a perimeter. VPC Service Controls now supports the following enhancements (Preview release):

• You can now add individual VPC networks as members of a perimeter.
• You can create an ingress rule to authorize individual VPC networks to access a perimeter.

General Availability for the following integration:

Security Token Service

Beta stage support for the following integration:

• AlloyDB

General availability for the following integration:

• Migrate for Compute Engine

General availability for the following integrations:

• Firestore
• Firestore in Datastore mode

General availability for the following integration:

• Cloud Domains

General availability for the following integration:

• Google Cloud Deploy

General availability for the following integration:

• Database Migration Service

General availability support for the following integration:

• Image streaming