You are troubleshooting access denied errors between Compute Engine instances connected to a Shared VPC and BigQuery datasets. The datasets reside in a project protected by a VPC Service Controls…

Question

Options

• AAdd the host project containing the Shared VPC to the service perimeter.
• BAdd the service project where the Compute Engine instances reside to the service perimeter.
• CCreate a service perimeter between the service project where the Compute Engine instances
• DCreate a perimeter bridge between the service project where the Compute Engine instances

• A
  77% (20)
• B
  12% (3)
• C
  8% (2)
• D
  4% (1)

Explanation

In a Shared VPC architecture, Compute Engine instances reside in a service project but use the network defined in the host project. When VPC Service Controls evaluates API requests from those instances, the network identity is attributed to the host project (the Shared VPC host), not the service project. Therefore, to allow those instances to access BigQuery datasets protected by a VPC Service Controls perimeter, the host project containing the Shared VPC must be added to that service perimeter. Option B (adding only the service project) is insufficient because the network traffic originates from the host project's VPC. Option C (creating a new perimeter between service project and instances) is redundant and misunderstands the architecture. Option D (perimeter bridge) is used to allow communication between two separate perimeters, which is not the issue here.

No community discussion yet for this question.