I have a question about VPC Service Control ("VSC") in GCP.

Let's say you have a company with multiple departments and you want to create an "organization" on the GCP and use a "VSC" for each department.

In this case, is it possible to restrict "service boundary" so that only "service boundary" of the GCP project that each department handles independently can be set?

I think it depends on the department what kind of IP restrictions they put on BigQuery, so if only the information systems department can change the VSC, I think it will make it less usable. I asked if there was a better way to do this because it's not good for each department's personnel to be able to change the settings in other departments.


You might use Access levels, According with the documentation Using access levels, you can specify public IP CIDR blocks, and individual user and service accounts that you want to permit to access resources protected by VPC Service Controls.

Also I have found an example that describes how to create an access level condition that allows access only from a specified range of IP addresses

In this way when you create your service perimeter you can choose the access level that you already created.

Here you have a guide to create a service perimeter.

You can also add access levels after a perimeter has been created.


Configuring VPC Service control is based on roles at the organization level. This means that if you assign edit permissions to one of your users they will be able configure all service perimeters and access levels.

You can perform this set up you are describing by having multiple organizations, which in this case would be departments and assigning specific users permissions there.

  • thanks.As I thought it's like that... I want to enforce the organization's policies on each project, so I don't want to have multiple organizations in-house. However, I wanted to let you use only the IP restriction function freely in each project, but it seems not to be possible at the moment. – user554982 May 25 '20 at 0:40
  • You can set up IP restrictions in each project, by setting up an access level based on IP address and setting the condition to false. – Gustavo May 25 '20 at 12:30
  • Sorry, but I want each person to be able to set IP restrictions on their own projects only. – user554982 May 27 '20 at 2:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.