VPC Service Controls

To validate its attestation token, Confidential Space needs to download certificates from Cloud Storage buckets. If these buckets reside outside your perimeter, you must configure the following egress rule:

  - 
  
 egressTo 
 : 
  
 operations 
 : 
  
 - 
  
 serviceName 
 : 
  
 storage.googleapis.com 
  
 methodSelectors 
 : 
  
 - 
  
 method 
 : 
  
 google.storage.objects.get 
  
 resources 
 : 
  
 - 
  
 projects/870449385679 
  
 - 
  
 projects/180376494128 
  
 egressFrom 
 : 
  
 identityType 
 : 
  
 ANY_IDENTITY

The following table lists the projects containing the necessary certificates:

Project ID	Project number	Description
cloud-shielded-ca-prod	870449385679	Project containing attestation certificates
cloud-shielded-ca-prod-root	180376494128	Project containing root certificates

If the Compute Engine API is restricted by your service perimeter, you must create the following egress rule:

  - 
  
 egressTo 
 : 
  
 operations 
 : 
  
 - 
  
 serviceName 
 : 
  
 compute.googleapis.com 
  
 methodSelectors 
 : 
  
 - 
  
 method 
 : 
  
 InstancesService.Insert 
  
 resources 
 : 
  
 - 
  
 projects/30229352718 
  
 egressFrom 
 : 
  
 identityType 
 : 
  
 ANY_IDENTITY

The following table lists the project necessary to fetch Confidential Space VM images:

Project ID	Project number	Description
confidential-space-images	30229352718	Project containing Confidential Space VM images