Project A hosts a Pub/Sub topic with confidential data that only resources in project A should access. Prevent project B and any future projects from accessing that topic. What do you do?

VPC Service Controls create a security perimeter around resources, like Pub/Sub topics, to prevent data exfiltration. By creating a perimeter around Project A, you ensure that only resources within Project A can access its confidential Pub/Sub topic, effectively blocking access from Project B and any future projects. Adding firewall rules is ineffective for Pub/Sub as it operates at the application layer, not the network layer. IAM conditions restrict who can access resources but don't prevent data exfiltration to unauthorized projects. Configuring a perimeter around Project A's VPC rather than Project A itself is too narrow; VPC Service Controls perimeters are designed to encompass entire projects or sets of projects, protecting all supported services within them.