Cloud Storage services are protected by VPC Service Controls

​

What this check verifies

GCP Projects are evaluated to ensure they have VPC Service Controls enabled for Cloud Storage. VPC Service Controls establish security boundaries by restricting access to Cloud Storage resources to specific networks and trusted clients, preventing unauthorized data access and exfiltration.

​

Risk

Projects without VPC Service Controls protection for Cloud Storage may be vulnerable to unauthorized data access and exfiltration, even with proper IAM policies in place. VPC Service Controls provide an additional layer of network-level security that restricts API access based on the context of the request.

​

Recommendation

Enable VPC Service Controls for all Cloud Storage buckets by adding their projects to a service perimeter with storage.googleapis.com as a restricted service. This prevents data exfiltration and ensures API calls are only allowed from authorized networks.

​

Remediation

Dashboard steps

1. Open Google Cloud Console → Security → VPC Service Controls
2. Create a new service perimeter or select an existing one
3. Add the relevant GCP projects to the perimeter’s protected resources
4. Add ‘storage.googleapis.com’ to the list of restricted services
5. Configure appropriate ingress and egress rules
6. Save the perimeter configuration

​

References

• https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/gcp/CloudStorage/use-vpc-service-controls.html
• https://cloud.google.com/vpc-service-controls/docs/create-service-perimeters

​

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudstorage_uses_vpc_service_controls. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to GCP checks