现已推出具有 MongoDB 兼容性的 Firestore 企业版！
了解详情。
VPC Service Controls
使用集合让一切井井有条
根据您的偏好保存内容并对其进行分类。
VPC Service Controls 可让组织围绕 Google Cloud 资源定义边界，从而降低数据渗漏风险。借助 VPC Service Controls，您可以创建边界来保护明确指定的服务的资源和数据。
捆绑的 Cloud Firestore 服务
以下 API 在 VPC Service Controls 中捆绑在一起：
firestore.googleapis.comdatastore.googleapis.comfirestorekeyvisualizer.googleapis.com
当您限制边界中的 firestore.googleapis.com 服务时，边界也会限制 datastore.googleapis.com 和 firestorekeyvisualizer.googleapis.com 服务。
限制 datastore.googleapis.com 服务
datastore.googleapis.com 服务捆绑在 firestore.googleapis.com 服务下。如需限制 datastore.googleapis.com 服务，您必须按以下方式限制 firestore.googleapis.com 服务：
适用于 Datastore 的 App Engine 旧版捆绑服务
适用于 Datastore 的 App Engine 旧版捆绑服务不支持服务边界。使用服务边界保护 Datastore 服务会阻止来自 App Engine 旧版捆绑服务的流量。旧版捆绑服务包括：
导入和导出操作的出站流量保护
与 MongoDB 兼容的 Cloud Firestore 支持 VPC Service Controls，但需要额外配置才能获得对导入和导出操作的全面出站流量保护。您必须使用 Cloud Firestore 服务代理来授权导入和导出操作，而不是使用默认的 App Engine 服务账号。按照以下说明查看和配置授权账号以用于导入和导出操作。
如未另行说明，那么本页面中的内容已根据知识共享署名 4.0 许可获得了许可，并且代码示例已根据 Apache 2.0 许可获得了许可。有关详情，请参阅 Google 开发者网站政策。Java 是 Oracle 和/或其关联公司的注册商标。
最后更新时间 (UTC)：2025-08-29。
[null,null,["最后更新时间 (UTC)：2025-08-29。"],[],[],null,["\u003cbr /\u003e\n\n[VPC Service Controls](https://cloud.google.com/vpc-service-controls/) lets organizations define a perimeter around\nGoogle Cloud resources to mitigate data exfiltration risks. With\nVPC Service Controls, you create perimeters that protect the resources and data\nof services that you explicitly specify.\n\nBundled Cloud Firestore services\n\nThe following APIs are bundled together in VPC Service Controls:\n\n- `firestore.googleapis.com`\n- `datastore.googleapis.com`\n- `firestorekeyvisualizer.googleapis.com`\n\nWhen you restrict the `firestore.googleapis.com` service in a perimeter,\nthe perimeter also restricts the `datastore.googleapis.com` and\n`firestorekeyvisualizer.googleapis.com` services.\n\nRestrict the datastore.googleapis.com service\n\nThe `datastore.googleapis.com` service is bundled under the\n`firestore.googleapis.com` service. To restrict the\n`datastore.googleapis.com`\nservice, you must restrict the `firestore.googleapis.com` service\nas follows:\n\n- When creating a service perimeter using the Google Cloud console, add Cloud Firestore as the restricted service.\n- When creating a service perimeter using the Google Cloud CLI, use\n `firestore.googleapis.com` instead of `datastore.googleapis.com`.\n\n --perimeter-restricted-services=firestore.googleapis.com\n\nApp Engine legacy bundled services for Datastore\n\n[App Engine legacy bundled services for Datastore](https://cloud.google.com/appengine/docs/standard/python/bundled-services-overview)\ndon't support service perimeters. Protecting the Datastore\nservice with a service perimeter blocks traffic from\nApp Engine legacy bundled services. Legacy bundled services include:\n\n- [Java 8 Datastore with App Engine APIs](https://cloud.google.com/appengine/docs/standard/java/datastore)\n- [Python 2 NDB client library for Datastore](https://cloud.google.com/appengine/docs/standard/python/ndb/creating-entities)\n- [Go 1.11 Datastore with App Engine APIs](https://cloud.google.com/appengine/docs/standard/go111/datastore)\n\nEgress protection on import and export operations\n\nCloud Firestore with MongoDB compatibility supports VPC Service Controls but requires additional\nconfiguration to get full egress protection on import and export operations.\nYou must use the Cloud Firestore service agent to authorize import and\nexport operations instead of the default App Engine service\naccount. Use the following instructions to view and configure the authorization\naccount for import and export operations."]]
