Private Service Connect compatibility

Services

You can access the following services by using Private Service Connect.

Google published services

Google service	Access provided
Apigee	Lets you expose APIs managed by Apigee to the internet. Also lets you connect privately from Apigee to backend target services.
BeyondCorp Enterprise	Lets the Identity-Aware Proxy access the App Connector Gateway.
Cloud Data Fusion	Lets you connect Cloud Data Fusion instances to resources in VPC networks.
Cloud Composer 2	Lets you access the Cloud Composer tenant project.
Cloud SQL	Lets you access your Cloud SQL database privately.
Cloud Workstations	Lets you access private workstation clusters.
Database Migration Service	Lets you migrate your data to Google Cloud.
Dataproc Metastore	Lets you access Dataproc Metastore services.
Eventarc	Lets you receive events from Eventarc.
Google Kubernetes Engine (GKE) public clusters and private clusters	Lets you privately connect nodes and the control plane for a public or private cluster.
Integration Connectors	Lets Integration Connectors access your managed services privately.
Memorystore for Redis Cluster	Lets you access Memorystore for Redis Cluster instances.
Vertex AI Vector Search	Provides private access to Vector Search endpoints.

Third-party published services

Third-party service	Access provided
Aiven	Provides private access to Aiven Kafka clusters.
Citrix DaaS	Provides private access to Citrix DaaS.
ClickHouse	Provides private access to ClickHouse services.
Confluent Cloud	Provides private access to Confluent Cloud clusters.
Databricks	Provides private access to Databricks clusters.
Datadog	Provides private access to Datadog intake services.
Datastax Astra	Provides private access to Datastax Astra DB databases.
Elasticsearch	Provides private access to Elastic Cloud.
JFrog	Provides private access to JFrog SaaS instances.
MongoDB Atlas	Provides private access to MongoDB Atlas.
Neo4j Aura	Provides private access to Neo4j Aura.
Pega Cloud	Provides private access to Pega Cloud.
Redis Enterprise Cloud	Provides private access to Redis Enterprise clusters.
Snowflake	Provides private access to Snowflake.
Striim	Provides private access to Striim Cloud.

Global Google APIs

Endpoints can target a bundle of global Google APIs. Backends can target a single global Google API.

Bundles of global Google APIs

You can use Private Service Connect endpoints to send traffic to a bundle of Google APIs. With Private Service Connect backends, you can send traffic to an individual Google API.

When you create an endpoint to access Google APIs and services, you choose which bundle of APIs you need access to—All APIs (all-apis) or VPC-SC (vpc-sc):

• The all-apis bundle provides access to most Google APIs and services, including all *.googleapis.com service endpoints.

• The vpc-sc bundle provides access to APIs and services that support VPC Service Controls.

Note: Note: These bundles provide access to the same APIs that are available through the Private Google Access VIPs—all-apis is equivalent to private.googleapis.com and vpc-sc is equivalent to restricted.googleapis.com.

The API bundles support only HTTP-based protocols over TCP (HTTP, HTTPS, and HTTP/2). All other protocols, including MQTT and ICMP are not supported.

API bundle	Supported services	Example usage
all-apis	Enables API access to most Google APIs and services regardless of whether they are supported by VPC Service Controls. Includes API access to Google Maps, Google Ads, Google Cloud, and most other Google APIs, including the lists below. Does not support Google Workspace web applications such as Gmail and Google Docs. Does not support any interactive websites. Domain names that match: accounts.google.com (only the paths needed for OAuth authentication) *.aiplatform-notebook.cloud.google.com *.aiplatform-notebook.googleusercontent.com appengine.google.com *.appspot.com *.backupdr.cloud.google.com backupdr.cloud.google.com *.backupdr.googleusercontent.com backupdr.googleusercontent.com *.cloudfunctions.net *.cloudproxy.app *.composer.cloud.google.com *.composer.googleusercontent.com *.datafusion.cloud.google.com *.datafusion.googleusercontent.com *.dataproc.cloud.google.com dataproc.cloud.google.com *.dataproc.googleusercontent.com dataproc.googleusercontent.com dl.google.com gcr.io or *.gcr.io *.googleapis.com *.gstatic.com *.ltsapis.goog *.notebooks.cloud.google.com *.notebooks.googleusercontent.com packages.cloud.google.com pkg.dev or *.pkg.dev pki.goog or *.pki.goog *.run.app source.developers.google.com storage.cloud.google.com	Choose all-apis under these circumstances: You don't use VPC Service Controls. You do use VPC Service Controls, but you also need to access Google APIs and services that are not supported by VPC Service Controls. ^1
vpc-sc	Enables API access to Google APIs and services that are supported by VPC Service Controls. Blocks access to Google APIs and services that do not support VPC Service Controls. Does not support Google Workspace APIs or Google Workspace web applications such as Gmail and Google Docs.	Choose vpc-sc when you only need access to Google APIs and services that are supported by VPC Service Controls. The vpc-sc bundle does not permit access to Google APIs and services that do not support VPC Service Controls. ^1

¹ If you need to restrict users to just the Google APIs and services that support VPC Service Controls, use vpc-sc. Although VPC Service Controls are enforced for compatible and configured services, regardless of the bundle you use, vpc-sc provides additional risk mitigation for data exfiltration. Using vpc-sc denies access to Google APIs and services that are not supported by VPC Service Controls. See Setting up private connectivity in the VPC Service Controls documentation for more details.

Single global Google API

You can use Private Service Connect backends to send requests to a single supported global Google API. The following APIs are supported:

• Bigtable: bigtable.googleapis.com and bigtableadmin.googleapis.com
• Cloud Logging: logging.googleapis.com
• Spanner: spanner.googleapis.com
• Cloud Storage: storage.googleapis.com
• Pub/Sub: pubsub.googleapis.com

Locational Google APIs

For a list of supported locational Google APIs, see Locational service endpoints.

Types

The following tables summarize compatibility information for different Private Service Connect configurations.

In the following tables, a checkmark indicates that a feature is supported, and a no symbol indicates that a feature isn't supported.

Endpoints and published services

This table summarizes the supported configuration options and capabilities of endpoints that access published services.

Consumer configuration (endpoint)	Producer load balancer
	Internal passthrough Network Load Balancer	Regional internal Application Load Balancer	Regional internal proxy Network Load Balancer	Internal protocol forwarding (target instance)
Consumer global access	Independent of global access setting on load balancer	Only if global access is enabled on the load balancer	Only if global access is enabled on the load balancer	Independent of global access setting on load balancer
Interconnect traffic
Cloud VPN traffic
Automatic DNS configuration
IP stack	IPv4	IPv4	IPv4	IPv4

Endpoints that access a published service have the following limitations:

• You can't create an endpoint in the same VPC network as the published service that you are accessing.

• Endpoints are not accessible from peered VPC networks.

• Packet Mirroring can't mirror packets for Private Service Connect published services traffic.

• Not all static routes with load balancer next hops are supported with Private Service Connect. For more information, see Static routes with load balancer next hops.

This table summarizes the supported configuration options and capabilities of published services that are accessed by endpoints.

Producer configuration (published service)	Producer load balancer
	Internal passthrough Network Load Balancer	Regional internal Application Load Balancer	Regional internal proxy Network Load Balancer	Internal protocol forwarding (target instance)
Supported producer backends	GCE_VM_IP NEGs Instance groups	GCE_VM_IP_PORT NEGs Hybrid NEGs Serverless NEGs Private Service Connect NEGs Instance groups	GCE_VM_IP_PORT NEGs Hybrid NEGs Serverless NEGs Private Service Connect NEGs Instance groups	Not applicable
PROXY protocol	TCP traffic only			TCP traffic only
Session affinity modes	NONE (5-tuple) CLIENT_IP_PORT_PROTO	Not applicable	Not applicable	Not applicable

Published services have the following limitations:

• Producer load balancers do not support the following features:
• Multiple forwarding rules that use a shared IP address (SHARED_LOADBALANCER_VIP)
• Backend subsetting
• Packet Mirroring can't mirror packets for Private Service Connect published services traffic.
• You must use the Google Cloud CLI or the API to create a service attachment that points to a forwarding rule that is used for internal protocol forwarding.
• The following load balancer types do not provide values for BETA metrics—the values are 0 or missing:
  • Regional internal Application Load Balancer
  • Regional internal proxy Network Load Balancer
• For issues and workarounds, see Known issues.

Different load balancers support different port configurations; some load balancers support a single port, some support a range of ports, and some support all ports. For more information, see Port specifications.

Backends and published services

A Private Service Connect backend for published services requires two load balancers—a consumer load balancer and a producer load balancer. This table describes the compatibility between different types of consumer and producer load balancers, including which backend service protocols can be used with each consumer load balancer. Each row represents a type of consumer load balancer, and each column represents a type of producer load balancer.

Consumer load balancer and supported consumer backend-service protocols	Producer load balancer
	Internal passthrough Network Load Balancer	Regional internal Application Load Balancer	Regional internal proxy Network Load Balancer
Global external Application Load Balancer (supports multiple regions) Protocols: HTTPS, HTTP2 Note: Classic Application Load Balancer is not supported.
Regional external Application Load Balancer Protocols: HTTP, HTTPS, HTTP2
Regional internal Application Load Balancer Protocols: HTTP, HTTPS, HTTP2
Cross-region internal Application Load Balancer (Preview) Protocols: HTTPS, HTTP2
Regional internal proxy Network Load Balancer Protocol: TCP
Cross-region internal proxy Network Load Balancer Protocol: TCP
Regional external proxy Network Load Balancer Protocol: TCP
Global external proxy Network Load Balancer (Preview) Protocol: TCP/SSL Note: Classic proxy Network Load Balancer is not supported.

This table describes the configuration for the producer load balancers that are supported by Private Service Connect backends for published services.

Configuration	Producer load balancer
	Internal passthrough Network Load Balancer	Regional internal Application Load Balancer	Regional internal proxy Network Load Balancer
Supported producer backends	GCE_VM_IP NEGs Instance groups	GCE_VM_IP_PORT NEGs Hybrid NEGs Serverless NEGs Private Service Connect NEGs Instance groups	GCE_VM_IP_PORT NEGs Hybrid NEGs Serverless NEGs Private Service Connect NEGs Instance groups
Forwarding rule protocols	TCP	HTTP HTTPS HTTP/2	TCP
Forwarding rule ports	The forwarding rule must refer to a single port.	The forwarding rule must refer to a single port.	The forwarding rule must refer to a single port.
PROXY protocol

Note: To support access by a Private Service Connect backend in a global or cross-regional load balancer, the producer load balancer must have global access turned on.

Published services have the following limitations:

• Producer load balancers do not support the following features:
• Multiple forwarding rules that use a shared IP address (SHARED_LOADBALANCER_VIP)
• Backend subsetting
• Packet Mirroring can't mirror packets for Private Service Connect published services traffic.
• You must use the Google Cloud CLI or the API to create a service attachment that points to a forwarding rule that is used for internal protocol forwarding.
• The following load balancer types do not provide values for BETA metrics—the values are 0 or missing:
  • Regional internal Application Load Balancer
  • Regional internal proxy Network Load Balancer
• For issues and workarounds, see Known issues.

For an example backend configuration that uses a global external Application Load Balancer, see Access published services through backends.

To publish a service, see Publish services.

Endpoints and global Google APIs

This table summarizes the features that are supported by endpoints used to access Google APIs.

To create this configuration, see Access Google APIs through endpoints.

Configuration	Details
Consumer configuration (endpoint)
Global reachability	Uses an internal global IP address
Interconnect traffic
Cloud VPN traffic
Automatic DNS configuration
IP stack	IPv4
Producer
Supported services	Supported global Google APIs

Backends and global Google APIs

Preview

This product or feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the Service Specific Terms. Pre-GA products and features are available "as is" and might have limited support. For more information, see the launch stage descriptions.

This table describes which load balancers can use a Private Service Connect backend to a global Google API.

Configuration	Details
Consumer configuration (Private Service Connect backend)
Supported consumer load balancers	Global external Application Load Balancer Note: Classic Application Load Balancer is not supported.
Producer
Supported services	Bigtable: bigtable.googleapis.com and bigtableadmin.googleapis.com Cloud Logging: logging.googleapis.com Spanner: spanner.googleapis.com Cloud Storage: storage.googleapis.com Pub/Sub: pubsub.googleapis.com

Backends and locational Google APIs

This table describes which load balancers can use a Private Service Connect backend to access locational Google APIs.

For an example backend configuration that uses an internal Application Load Balancer, see Access locational Google APIs through backends.

Configuration	Details
Consumer configuration (Private Service Connect backend)
Supported consumer load balancers	Internal Application Load Balancer Protocols: HTTPS Regional external Application Load Balancer Protocols: HTTPS
Producer
Supported services	Supported locational Google APIs

What's next

• Learn about accessing published services through endpoints.
• Learn about accessing Google APIs through endpoints.
• Learn about backends.
• Learn about publishing services.