Question

A healthcare company has two separate business units, each with its own VPC Service Controls perimeter protecting Cloud Storage and BigQuery. Unit A's data-science team runs analytics jobs that must read anonymized datasets stored in a Cloud Storage bucket owned by a project inside Unit B's perimeter. Both perimeters must otherwise remain isolated from each other and from the public internet, and no data must be allowed to leave either perimeter to unauthorized projects. What is the recommended way to enable only this specific cross-perimeter access?

Accepted Answer

Create a VPC Service Controls perimeter bridge that includes only the two specific projects that must share the bucket, allowing bidirectional access between just those projects.

Answer

Merge both business units into a single service perimeter so all projects can communicate freely without ingress or egress rules.

Answer

Add the public IP ranges of Unit A's analytics VMs to an access level and attach it to Unit B's perimeter.

Answer

Remove Cloud Storage from the restricted services list in Unit B's perimeter so external projects can reach the bucket.