Question

Your security team is preparing to enforce a VPC Service Controls perimeter around a project that hosts BigQuery and Cloud Storage. Several analytics jobs and third-party integrations access these APIs, and the team is worried that enforcing the perimeter immediately could break legitimate workflows without warning. They want to observe which requests would be denied before any blocking occurs. What should they do?

Accepted Answer

Enable the perimeter in dry-run mode and analyze the resulting violation logs in Cloud Audit Logs before switching to enforced mode.

Answer

Enforce the perimeter immediately but add broad ingress rules that allow all identities, then remove them once workflows are validated.

Answer

Create the perimeter with an access level that permits every source IP range so nothing is blocked while testing.

Answer

Deploy the perimeter in a separate test project and copy the configuration to production after manual verification.