VPC Service Controls release notes

VPC Service Controls feature (Status: Preview): Support for optimizing service perimeters using the VPC Service Controls recommender is available.

The recommender detects architectural risks and perimeter misconfigurations, including the following:

• Critical resources at risk of exfiltration: Identifies active and sensitive services (such as BigQuery and Cloud Storage) operating outside service perimeters.

• Unconfigured VPC accessible services: Identifies perimeters that leave APIs unrestricted from within the security boundary.

• Misconfigured VPC accessible services: Identifies mismatches between allowed accessible APIs and restricted services inside a perimeter.

For more information, see Optimize perimeters with recommender.

VPC Service Controls feature: The VPC Service Controls service patterns feature is generally available. You can use service patterns to explicitly configure which Google APIs (both supported and unsupported) can be accessed from VPC networks within a service perimeter when using the private VIP (private.googleapis.com) or a Private Service Connect endpoint with the all-apis bundle.

For more information, see VPC Service Controls service patterns.

General availability support for the following integration:

• Gemini Cloud Assist

Preview stage support for the following integration:

• Google Antigravity in Gemini Enterprise

VPC Service Controls feature: Support for using the following identities in ingress and egress rules to allow access to resources protected by a service perimeter is generally available:

• Agent identities
• SPIFFE formats for third-party workforce and workload identities

For more information, see Configure identity groups and third-party identities in ingress and egress rules and Supported identities for ingress and egress rules.

General availability support for the following integration:

• Conversational Analytics API

General availability support for the following integration:

• Firebase Phone Number Verification

Preview stage support for the following integration:

• Workload Identity API

Preview stage support for the following integration:

• Firebase Phone Number Verification

Preview stage support for the following integration:

• Cloud Network Insights

VPC Service Controls feature: Support for using IAM roles in ingress and egress rules to allow access to resources protected by a service perimeter is generally available. This feature includes the following updates:

• You can use the gcloud access-context-manager supported-permissions describe command to check the support status of an IAM role.

• You can use the gcloud access-context-manager supported-permissions list command to retrieve the complete list of all supported permissions.

For more information, see Configure IAM roles in ingress and egress rules.

Preview stage support for the following integration:

• App Topology

Preview stage support for the following integration:

• Agent Registry

Preview stage support for the following integration:

• Cluster Director

General availability support for the following integration:

• Oracle Database@Google Cloud

Preview stage support for the following integration:

• App Lifecycle Manager

Preview stage support for the following integration:

• Oracle Database@Google Cloud

General availability support for the following integration:

• CX Agent Studio

VPC Service Controls feature (Status: Preview): VPC Service Controls supports the following identities in ingress and egress rules to allow access to resources protected by a service perimeter:

• Agent identities

• SPIFFE formats for third-party workforce and workload identities

This feature is available in Preview.

For more information, see Supported identities for ingress and egress rules.

General availability support for the following integration:

• Managed Lustre

Preview stage support for the following integration:

• Google Security Operations

Preview stage support for the following integration:

• Vector Search 2.0

Preview stage support for the following integration:

• Managed Lustre

Preview stage support for the following integration:

• CX Agent Studio

General availability support for the following integration:

• Distributed Cloud Edge Container API

General availability support for the following integration:

• Privileged Access Manager

Preview stage support for the following integration:

• Cloud Location Finder

General availability support for the following integration:

• Model Armor

Preview stage support for the following integration:

• Gemini Cloud Assist

General availability support for the following integration:

• Unified Maintenance

General availability support for the following integration:

• Firebase App Hosting

VPC Service Controls feature: The VPC Service Controls violation analyzer is generally available. You can use the violation analyzer to diagnose access denial events and generate comprehensive evaluation reports to help resolve the denial events.

The violation analyzer includes the following capabilities and updates:

• You can use a denial event's unique ID to generate a comprehensive evaluation report.
• Edit ingress and egress rules of a selected perimeter directly from the troubleshooting results page.
• View log entry details associated with a denial event directly on the troubleshooting results page.
• A few previous limitations in the violation analyzer have been removed.
• You don't need to enable the Policy Troubleshooter API to use the violation analyzer.

For more information, see Diagnose an access denial in violation analyzer.

Preview stage support for the following integration:

• Firebase App Hosting

Preview stage support for the following integration:

• App Design Center

Preview stage support for the following integration:

• Unified Maintenance

General availability support for the following integration:

• Address Validation

Updated the limitations for the following integration in the Supported products and limitations page:

• Policy Simulator: simulations on organization and folder resources are not protected by VPC Service Controls.

General availability support for the following integration: