消費者：接收供應端連線的實體，通常是虛擬私有雲網路中的 VM。當用戶端接受連線時，Google Cloud 會從網路連結指定的用戶端虛擬私有雲網路子網路中，為 Private Service Connect 介面分配 IP 位址。Private Service Connect 介面的 VM 具有第二個網路介面，可連線至生產端的虛擬私有雲網路。
網路連結：區域資源，可讓供應商虛擬私有雲網路透過 Private Service Connect 介面，與用戶端虛擬私有雲網路建立連線。在用戶端虛擬私有雲網路中，網路連結會做為供應商網路中 Private Service Connect 介面連線的指定進入點。在網路連結上建立 Private Service Connect 介面時，系統會從網路連結的子網路中，為供應端 VM 指派 IP。Private Service Connect 介面的虛擬機器執行個體至少有一個以上的一般網路介面，可連線至生產端子網路。詳情請參閱「關於網路連結」。
製作者專案：由 Google 擁有的專案，其中代管執行 Datastream 的虛擬機器 (VM)。為了存取客戶虛擬私有雲中的資源，Datastream VM 會使用 Private Service Connect 網路介面從其子網路指派的 IP 位址。
Private Service Connect 先決條件
您必須先執行下列步驟，讓 Datastream 與專案建立連線，才能使用 Private Service Connect 介面建立私人連線設定：
請記下這個網址，因為 Datastream 需要這個網址才能連線。如要瞭解如何使用 Google Cloud建立 Private Service Connect 介面私人連線設定，請參閱「管理私人連線設定」。
建立私人連線設定
在 Google Cloud 專案中建立網路連結後，您必須使用 Private Service Connect 介面設定私人連線設定。建立設定時，您會將代管 Private Service Connect 介面的專案加入許可清單。接著，您可以將網路連結網址提供給 Datastream，做為 Private Service Connect 資源的一部分。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[],[],null,["# Configure Private Service Connect interfaces\n\nDatastream uses Private Service Connect interfaces\nto let you replicate data in a way that keeps the traffic entirely within\nGoogle Cloud.\n\nA Private Service Connect interface is a resource that lets a *producer*\nVirtual Private Cloud (VPC) network initiate connections to and receive connections from\na *network attachment* in a *consumer* VPC network. Producer and consumer\nnetworks can be in different projects and organizations.\n[](/static/datastream/docs/images/psc-overview-interface-overview.svg) **Figure 1.** Private Service Connect interfaces\nlet service producers initiate connections to service consumers.\n\nFor key term definitions, see the section that follows.\n\nFor more information about Private Service Connect, see the\n[Virtual Private Cloud documentation](/vpc/docs/private-service-connect).\n\nKey terms\n---------\n\nThis section provides an overview of key terms and concepts that apply to\nPrivate Service Connect.\n\n- **Producer**: an entity, typically a service or a VM within a VPC network,\n that initiates the connection to the consumer network. The producer delivers\n the service: in the Datastream context, it fetches and replicates\n data to a destination.\n\n- **Consumer**: an entity, typically a VM within a VPC network, that receives\n the connection from the producer. When the consumer accepts the connection,\n Google Cloud allocates the Private Service Connect interface an\n IP address from a subnet in the consumer VPC network that's specified by the\n network attachment. The VM of the Private Service Connect\n interface has a second network interface that connects to the producer's\n VPC network.\n\n- **Network attachment** : a regional resource that lets a producer VPC network\n initiate connections to a consumer VPC network through a\n Private Service Connect interface. In the consumer VPC network,\n the network attachment acts as a designated entry point for connections from\n Private Service Connect interfaces in the producer network. When\n a Private Service Connect interface is established on\n a network attachment, the producer VM is assigned an IP from the subnet of the\n network attachment. The virtual machine instance of the\n Private Service Connect interface has at least one more regular network\n interface that connects to a producer subnet. For more information, see\n [About network attachments](/vpc/docs/about-network-attachments).\n\n- **Producer project**: a Google-owned project where the virtual machines (VMs)\n running Datastream are hosted. To access resources in the customer\n VPC, the Datastream VMs use the IP address that the\n Private Service Connect network interface assigns from its subnet.\n\nPrivate Service Connect prerequisites\n-------------------------------------\n\nBefore you create a private connectivity configuration using a\nPrivate Service Connect interface, you need to take the following steps\nso that Datastream can establish a connection to your project:\n\n- Have a VPC network that you can connect to the Datastream\n private network. For more information about creating a VPC network, see\n [Create and manage VPC networks](/vpc/docs/create-modify-vpc-networks).\n\n- Create a [network attachment](/vpc/docs/create-manage-network-attachments#create-manual-accept)\n in your VPC project.\n\n- Verify that Google Cloud and the on-premises firewall allow traffic from the\n network attachment IP address range to the source database from which you want\n to stream data.\n\nPricing\n-------\n\nData ingress and egress through Private Service Connect is\ncharged. For more information, see the [Private Service Connect\npricing](/vpc/network-pricing#psc-network-attachment).\n\nRequired roles and permissions\n------------------------------\n\nTo get the permissions that you need to create a network attachment, ask your\nadministrator to grant you the following Identity and Access Management (IAM) roles on\nyour project:\n\n- Create, view, and delete network attachments: [Compute Network Admin](/compute/docs/access/iam#compute.networkAdmin) (`roles/compute.networkAdmin`)\n\nIf your network attachment is in a different project than Datastream,\nthen you need to grant the following role to the\n`service-`\u003cvar translate=\"no\"\u003eDATASTREAM-PROJECT-NUMBER\u003c/var\u003e`@gcp-sa-datastream.iam.gserviceaccount.com`\nservice account:\n\n- Read-only access to networking resources:\n [Compute Network Viewer](/compute/docs/access/iam#compute.networkViewer)\n (`roles/compute.networkViewer`)\n\n Grant the role on the project where your network attachment is, and replace\n \u003cvar translate=\"no\"\u003eDATASTREAM-PROJECT-NUMBER\u003c/var\u003e with the number of the project where\n Datastream is deployed.\n\nFor more information about granting roles, see\n[Manage access](/iam/docs/granting-changing-revoking-access).\n\nYou might also be able to get the required permissions through\n[custom roles](/iam/docs/creating-custom-roles) or other\n[predefined roles](/iam/docs/understanding-roles).\n\nFor more information about access control options in Datastream,\nsee [Access control with IAM](/data-fusion/docs/access-control).\n\nConfigure Private Service Connect\n---------------------------------\n\nTo let Datastream establish outbound connectivity to your network\nusing a Private Service Connect interface:\n\n1. Create a network attachment in your project.\n2. Create a private connectivity configuration.\n\n### Create a network attachment\n\nTo configure Private Service Connect in Datastream, you\nmust first create a network attachment. \n\n### Console\n\n1. In the Google Cloud console, go to the **Network attachments** page:\n\n [Go to Network attachments](https://console.cloud.google.com/net-services/psc/list/networkAttachments)\n2. Click **Create network attachment**.\n\n3. In the **Name** field, enter a name for your network attachment.\n\n4. From the **Network** list, select a VPC or a Shared VPC\n network.\n\n5. From the **Region** list, select a Google Cloud region. This region\n must be the same as the region used for the subnet of the VPC network\n peered to the Datastream private network. For more\n information, see [Private Service Connect prerequisites](#psci-prereqs).\n\n6. From the **Subnetwork** list, select a subnetwork range.\n\n7. In **Connection preference** , select\n **Accept connections for selected projects**.\n\n Datastream automatically adds the producer project to the\n **Accepted projects** list when you create the Datastream\n private connectivity resource.\n | **Caution:** The option **Automatically accept connections for all projects** is less secure because it allows any service to obtain IP addresses from your subnet. We don't recommend using this option.\n8. Don't add **Accepted projects** or **Rejected projects**.\n\n9. Click **Create network attachment**.\n\n### gcloud\n\n1. Create one or more subnetworks. For example:\n\n gcloud compute networks subnets create subnet-1 --network=network-0 --range=10.10.1.0/24 --region=\u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e\n\n The network attachment uses these subnetworks in the subsequent steps.\n2. Create a network attachment resource in the same region as the\n Datastream project, with the `connection-preference` property\n set to `ACCEPT_MANUAL`:\n\n gcloud compute network-attachments create \u003cvar translate=\"no\"\u003eNAME\u003c/var\u003e\n --region=\u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e\n --connection-preference=ACCEPT_MANUAL\n --subnets=\u003cvar translate=\"no\"\u003eSUBNET\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eNAME\u003c/var\u003e: the name for your network attachment.\n - \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e: the name of the Google Cloud region. This region must be the same as the Datastream private network.\n - \u003cvar translate=\"no\"\u003eSUBNET\u003c/var\u003e: the name of the subnet.\n\n The output of this command is a network attachment URL of the following\n format:\n\n `projects/`\u003cvar translate=\"no\"\u003ePROJECT\u003c/var\u003e`/locations/`\u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e`/network-attachments/`\u003cvar translate=\"no\"\u003eNETWORK_ATTACHMENT_ID\u003c/var\u003e.\n\n Make a note of this URL as Datastream needs it for\n connectivity. For information about how to create a\n Private Service Connect interface private\n connectivity configuration using Google Cloud, see\n [Manage private connectivity configurations](/datastream/docs/manage-private-connectivity-configurations#create-a-private-connectivity-configuration).\n | **Caution:** Specifying `connection-preference` as `ACCEPT_AUTOMATIC` is less secure because it allows any service to obtain IP addresses from your subnet. We don't recommend using this option.\n\n### Create a private connectivity configuration\n\nAfter you create a network attachment in your Google Cloud project, you need\nto set up your private connectivity configuration using\nPrivate Service Connect interfaces. When you create the configuration,\nyou allowlist the project that hosts the Private Service Connect\ninterface. You then provide the network attachment URL to\nDatastream as part of the Private Service Connect\nresource.\n\nFor more information, see\n[Create a private connectivity configuration](/datastream/docs/create-a-private-connectivity-configuration#create-the-configuration).\n\nWhat's next\n-----------\n\n- Learn how to [view your private connectivity configuration](/datastream/docs/view-a-private-connectivity-configuration).\n- Find out how to [delete a private connectivity configuration](/datastream/docs/delete-a-private-connectivity-configuration)."]]
