Question

A healthcare company has placed a Cloud Storage bucket containing PHI inside a VPC Service Controls perimeter. Data analysts must access this bucket from the Google Cloud Console and gcloud, but only when they are connecting from the corporate office IP range and from company-managed devices. Administrators must not weaken the perimeter's overall exfiltration protection. What should the security engineer configure?

Accepted Answer

Create an access level in Access Context Manager specifying the corporate IP CIDR and device policy conditions, then bind it to an ingress rule on the perimeter.

Answer

Add the analysts' user accounts to the perimeter's list of restricted services so they bypass the perimeter checks.

Answer

Create a firewall rule allowing ingress from the corporate IP range to the Cloud Storage API endpoint.

Answer

Disable VPC Service Controls enforcement for Cloud Storage and rely on IAM Conditions to restrict access by IP.