Question

A financial services company is deploying VPC Service Controls around its analytics projects that use BigQuery and Cloud Storage. The security team is worried that enforcing a perimeter immediately could break legitimate batch jobs and internal tooling whose access patterns are not fully documented. They want to observe which requests would be blocked over a two-week period before committing to enforcement, without actually denying any traffic. What is the recommended approach?

Accepted Answer

Create the service perimeter in dry-run (explicit) mode so violations are logged but not enforced, review the audit logs, then promote to enforced mode.

Answer

Enable the perimeter in enforced mode but add an access level that allows all source IP ranges, then tighten it after reviewing logs.

Answer

Deploy the perimeter in enforced mode and use a perimeter bridge to temporarily exempt all projects until logs are reviewed.

Answer

Apply an organization policy constraint to disable API enforcement for two weeks, then remove it to activate the perimeter.