Dry run observes a proposed boundary
VPC Service Controls helps restrict access to protected Google Cloud service resources through a service perimeter. Dry-run mode lets a proposed perimeter policy produce violation logs without enforcing that proposed denial. It is useful for discovering dependencies, but a successful request during dry run does not prove the request would pass enforcement.
Keep enforced and dry-run policy states separate. An existing enforced rule can still deny a request while another proposed policy is being observed. IAM remains another authorization layer: a perimeter exception does not grant a caller permission to read a dataset or object. Diagnose both the policy boundary and the underlying resource permission.
Prepare a workload inventory, perimeter owner, representative scheduled jobs, and access to relevant audit logs. Include cross-project data movement, operator access, and less frequent recovery or billing workflows. A quiet observation window may miss legitimate monthly activity, so plan controlled tests for operations that will not naturally occur.
Convert a violation into a decision
- Inspect the proposed perimeter's resources, restricted services, access levels, and ingress or egress policies. Record the current enforced configuration separately. Identify which projects and service operations the business actually intends to permit across the boundary.
- Search violation logs for the relevant window and inspect
metadata.dryRun, violation reason, affected resources, and perimeter identity. Preserve the unique violation identifier or troubleshooting token in the incident record rather than pasting broad customer data from surrounding logs. - Trace the caller and operation to a workload owner. Determine whether the request enters protected resources from outside, leaves toward an external resource, or crosses another relevant boundary. Multi-resource operations can require more than one policy relationship; do not guess direction solely from the human user's location.
- Draft the narrow supported rule matching the required identity, resources, and operations. Test the legitimate workflow again in dry run and include a deliberately disallowed test case. Have the perimeter owner review unresolved violations and the enforcement rollback plan before promoting the policy.
Illustrative scenario
A hypothetical analytics job inside a perimeter reads protected BigQuery data and writes an approved report into a separate project. Ordinary queries pass, but dry-run logs show the export path would violate the proposed boundary. The team identifies the report's destination and service identity, then creates a scoped reviewed policy relationship. Allowing every external project would hide the dependency instead of expressing the intended transfer.
| Evidence | Question to answer | Correction |
|---|---|---|
| Request succeeds with dry-run violation | Would enforcement reject it? | Resolve before promotion |
| Request fails despite no new dry-run denial | Existing enforcement or IAM? | Inspect the actual rejecting layer |
| Export touches several resources | Which boundary and direction? | Model the full resource relationship |
| Broad exception clears all findings | Is access wider than required? | Restrict identity, resource, and operation |
Verify enforcement readiness
Repeat representative application, administration, and recovery workflows. Confirm dry-run violations are understood, resolved, or intentionally accepted in the reviewed plan. Test that resource IAM still blocks unauthorized identities. After the approved enforcement change, inspect actual denials and user outcomes closely. Retain the previous policy state so an unintended outage can be addressed through the normal reviewed recovery process.
Operating procedure
Monitor new violation patterns and policy drift after project moves, new service integrations, and identity changes. Keep an owner and purpose for every exception. Re-run dry-run testing before substantial perimeter changes. Review low-frequency workflows periodically so the first restore or month-end export does not become an unexpected enforcement discovery.
Explore Clouvenix cloud security for implementation and operational handover.
Technical reference
dry-run mode, audit metadata, and violation troubleshooting.