Add projects to service perimeters using Terraform

VPC Service Controls lets you isolate resources of a supported multi-tenant Google Cloud service to mitigate data exfiltration risks. You can use Terraform to add a project in a folder to a service perimeter.

To automatically add a folder to a service perimeter, you can use Cloud Run functions. When the function detects a new project being added to the folder, it executes the Terraform script to add the new project to the perimeter. Similarly, the function automatically removes projects from the perimeter if they are moved out of the folder.

For more information, see Automatically secured folder.

What's next

Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2025年10月13日 UTC.