An enterprise is designing a Cardholder Data Environment (CDE) on Google Cloud to meet stringent PCI-DSS and FedRAMP network segmentation and perimeter defense mandates. The architecture deploys a Shared VPC host project for centralized network management alongside multiple service projects hosting compute workloads, Cloud Build private pools, and Cloud Storage buckets containing sensitive cardholder data. Which architectural requirement must be implemented to enforce the VPC Service Controls boundary across this infrastructure without breaking communication?

Include both the Shared VPC host project and all associated service projects within the same VPC Service Controls service perimeter, and restrict the required service APIs.: ### What Shared VPC Perimeter Protection Is **VPC Service Controls** allows enterprises to establish a secure, logical boundary around Google-managed resources and APIs to mitigate data exfiltration risks. When paired with a **Shared VPC** architecture, VPC Service Controls perimeter configuration requires that both the **host project** (which provides the underlying network infrastructure and subnets) and all attached **service projects** (which host the compute instances and application resources) reside within the exact same **service perimeter**. ### How It Meets Network Isolation and Compliance Requirements - **Shared VPC Alignment**: By placing the host project and service projects inside the same perimeter, API calls originating from workloads within shared subnets to protected Google APIs (such as **Cloud Storage** or **Cloud Build**) are recognized as internal to the boundary. - **PCI-DSS & FedRAMP Network Segmentation**: Enforces strict boundary controls at the API layer that prevent sensitive cardholder data from being copied or exfiltrated to unauthorized external storage buckets or projects. - **Service API Restrictions**: Restricting services such as `storage.googleapis.com` and `cloudbuild.googleapis.com` ensures that only authorized identities and networks inside the perimeter can access those service endpoints. ### Key Advantages and Capabilities - **Unified Perimeter Governance**: Prevents API access violations that occur when host and service projects are partitioned across mismatched security perimeters. - **Separation of Duties**: Preserves the operational model where **Network Admins** manage the host project while **Service Project Admins** deploy applications without weakening perimeter security. - **Zero-Trust Data Protection**: Complements network-level firewall rules by inspecting context and blocking requests to untrusted external multi-tenant cloud storage. ### Why This Is Optimal Placing both the host project and service projects inside the same service perimeter aligns with Google Cloud security best practices for Shared VPC and prevents broken cross-project API routing, ensuring uninterrupted compliance enforcement.