Google updates VPC Service Controls with new policy tools

Google has updated VPC Service Controls with new policy management and remediation features, now generally available at no additional cost.

The update adds folder-based perimeter membership; support for folders and organisations in ingress and egress rules; Private Service Connect endpoints in those rules; service patterns in VPC accessible services; and guided remediation for blocked requests.

VPC Service Controls is Google Cloud's network security perimeter product, designed to limit data movement outside approved environments. The latest changes are intended to make perimeters easier to create, maintain, and scale as organisations expand their use of autonomous software agents and other non-human identities.

Under the new model, cloud administrators can include folders in perimeter membership, so every project and nested subfolder in that hierarchy inherits the same policy. That means new workloads can gain protection by default without further manual changes.

Perimeter membership will also update when a project is moved within the resource hierarchy. This ties security coverage more closely to the organisational structure used to govern cloud resources, while dry-run mode lets administrators test the effect of those settings on live traffic before enforcement.

Rule changes

The update also extends support for folders and organisations directly into ingress and egress rules. Instead of writing rules for each project, administrators can use a hierarchy reference that applies across the projects beneath it, including those created later.

This should keep rules shorter and reduce the risk of hitting quota limits on rule attributes in large multi-project environments. The goal is to simplify administration while maintaining more granular control over which requests can cross a perimeter.

Private Service Connect endpoints for Google APIs can now also be used as an attribute in ingress and egress rules. This allows policies to authorise access over a specified private endpoint rather than exposing traffic to the public internet.

For organisations that use Private Service Connect across their cloud estates, including deployments linked through Network Connectivity Centre, the new option offers a more direct way to define the source of a request within a policy.

API controls

Google has also introduced service patterns in VPC accessible services, giving administrators more specific control over which Google APIs can be reached through private Virtual IP addresses. The feature is aimed at workloads that need access to validated API endpoints over a private path.

With the new setting, administrators can allow only the API URL patterns a workload requires. The feature also supports appending org-restriction headers to egress requests to help limit access to authorised domains and resources.

Google presented this as an alternative to maintaining an egress proxy when teams need tightly bounded private-path access without allowing broader outbound access than necessary.

Blocked requests

One of the more operationally focused additions is Guided Violation Remediation in VPC Service Controls Violation Analyser. The feature analyses blocked requests against the relevant perimeter configuration and proposes a policy change that would permit the traffic.

According to Google, the recommendations are scoped according to least-privilege principles and can take the form of an ingress rule, an egress rule, an access level, or an update to VPC accessible services. Administrators can validate the suggested change in dry-run mode before putting it into effect.

Google said the tool is intended to reduce the time needed to resolve denied requests from days to minutes. It is also designed to reduce pressure on security teams to open a perimeter too broadly when trying to restore application access quickly.

The broader context for the changes is a shift in cloud operations as autonomous agents and other machine identities take on more tasks across multiple projects and services. Google argued that traditional, manually managed network perimeters are poorly suited to machine-speed activity, while both loose and overly strict settings can create security or operational problems.

The new release aims to address that tension by aligning perimeter controls with an organisation's cloud hierarchy and automating parts of the policy maintenance process. Administrators can establish folder-based boundaries, observe traffic in dry-run mode, use Violation Analyser and Violation Dashboard to address denials, and then move to enforcement once authorised traffic patterns are clear.