Vpc Service Controls Regular Vs Bridge Perimeter

What a Perimeter Bridge Is

A perimeter bridge in Access Context Manager allows projects enclosed in distinct regular service perimeters to communicate and share protected Google Cloud resources without merging or altering the membership of the underlying perimeters.

How It Meets the Requirements

• Cross-perimeter communication: A perimeter bridge links the project in Perimeter-A and the project in Perimeter-B, allowing services within those specific projects to exchange data directly while keeping perimeter boundaries intact.
• Maintains existing regular perimeters: Because a project can be a member of only one regular service perimeter, a bridge provides a mechanism to establish trusted communication across boundaries without reassigning or merging project memberships.
• Strict boundary enforcement: Unrelated projects inside Perimeter-A and Perimeter-B that are not listed in the bridge cannot access each other, preserving isolation across security zones.

Key Advantages and Capabilities

• Project-level linking: Bridges connect specific projects rather than exposing all projects in both perimeters.
• Preserves separation of concerns: Allows different organizational units or tiers to retain distinct security policies and restricted service lists.
• No data exfiltration bypass: Communication remains strictly bounded to the projects explicitly defined within the bridge.

Why This Is Optimal

Perimeter bridges allow targeted inter-perimeter access without violating the architectural rule that a project can belong to only one regular perimeter, and without exposing the rest of either perimeter's projects to unnecessary lateral communication.