Your organization has two VPC Service Controls service perimeters, Perimeter-A and Perimeter- B, in Google Cloud. You want to allow data to be copied from a Cloud Storage bucket in Perimeter-A to…

Configuring a perimeter bridge allows broader project-level communication between perimeters, which might grant more access than strictly necessary for a specific data copy operation between two buckets, thus violating the principle of least privilege.

Configuring a perimeter bridge between projects is similar to A and provides broader access than required, which does not align with minimizing exfiltration risk and following the principle of least privilege for a specific data transfer.

Configuring an egress rule on Perimeter-A to specifically allow traffic to the Cloud Storage service in Perimeter-B, combined with a corresponding ingress rule on Perimeter-B to accept traffic from Perimeter-A, provides precise, least-privilege control for unidirectional data copying. This approach minimizes exfiltration risk by only allowing the explicitly required connection between the specified services and perimeters.

Configuring a bidirectional egress/ingress rule would allow data flow in both directions between the buckets, which exceeds the requirement to copy data *from* Perimeter-A *to* Perimeter-B and violates the principle of only allowing required connections.