What changed? VPC Service Controls (VPC‑SC) now supports folder membership in perimeter definitions, and its ingress/egress rule syntax accepts Google Cloud folders and organizations as single references. Dry‑run mode also evaluates these hierarchy‑wide settings before enforcement. Why it matters is that engineers can let new projects inherit protection automatically, keep rule counts low, and avoid manual updates when resources move.
Folder membership extends perimeters automatically
When a folder is added to a VPC‑SC perimeter, every project and sub‑folder inside inherits the same policy without extra configuration. Moving a project between folders updates its membership transparently, so the perimeter follows the resource hierarchy you already govern. This behavior eliminates the need for per‑project perimeter edits and simplifies compliance checks that only need to verify the project’s location in the hierarchy.
Ingress and egress rules can reference hierarchy objects
Previously, rules required explicit project identifiers, which quickly exhausted attribute quotas in large environments. The new capability lets you specify a folder or organization once, and the rule automatically applies to all current and future projects under that node. The result is:
- Concise rule sets that stay within quota limits.
- Automatic inclusion of newly created projects, reducing the risk of accidental exposure.
- Consistent security posture across multi‑project deployments.
Dry‑run mode validates hierarchy‑wide perimeters
Before turning enforcement on, administrators can enable dry‑run mode for perimeters that include folders. The system simulates the impact on live traffic, surfacing denied requests and suggesting remediation steps. This preview helps teams confirm that the expanded scope does not break legitimate service‑to‑service calls.
Private Service Connect endpoints are now first‑class rule subjects
The update also mentions that Private Service Connect (PSC) endpoints can be used in ingress and egress rules. By targeting PSC endpoints, teams can keep traffic on Google’s private network while still benefiting from the hierarchy‑based rule simplification.
Related CloudNinjas coverage: Google Cloud.
What This Means For Practitioners
Adopt folder‑based perimeter definitions wherever your organization already groups workloads by folder. Review existing per‑project VPC‑SC entries and consolidate them into folder or organization references to reduce rule count and future‑proof against project churn. Use dry‑run mode to validate the new scope before enforcement, and update any remediation processes to handle the guided exception workflow that VPC‑SC now provides. Finally, consider routing internal service traffic through Private Service Connect and include those endpoints in your rule set to keep data on the private backbone while staying within the same simplified perimeter model.