Datastream은 Private Service Connect 인터페이스를 사용하여 트래픽을Google Cloud내에 완전히 유지하는 방식으로 데이터를 복제할 수 있도록 지원합니다.
Private Service Connect 인터페이스는 프로듀서 Virtual Private Cloud (VPC) 네트워크가 소비자 VPC 네트워크의 네트워크 연결에 연결을 시작하고 연결을 수신할 수 있게 해주는 리소스입니다. 프로듀서 및 소비자 네트워크는 다른 프로젝트 및 조직에 포함될 수 있습니다.
그림 1. Private Service Connect 인터페이스를 사용하면 서비스 프로듀서가 서비스 소비자에게 연결을 시작할 수 있습니다.
이 섹션에서는 Private Service Connect에 적용되는 핵심 용어와 개념을 간략히 설명합니다.
프로듀서: 일반적으로 VPC 네트워크 내의 서비스 또는 VM과 같이 소비자 네트워크에 대한 연결을 시작하는 항목입니다. 프로듀서는 서비스를 제공합니다. Datastream 컨텍스트에서 데이터를 가져와 대상에 복제합니다.
소비자: 프로듀서로부터 연결을 수신하는 항목(일반적으로 VPC 네트워크 내 VM)입니다. 소비자가 연결을 수락하면Google Cloud 는 네트워크 연결에 지정된 소비자 VPC 네트워크의 서브넷에서 Private Service Connect 인터페이스에 IP 주소를 할당합니다. Private Service Connect 인터페이스의 VM에는 프로듀서의 VPC 네트워크에 연결되는 두 번째 네트워크 인터페이스가 있습니다.
네트워크 연결: 제작자 VPC 네트워크가 Private Service Connect 인터페이스를 통해 소비자 VPC 네트워크에 대한 연결을 시작할 수 있는 리전별 리소스입니다. 소비자 VPC 네트워크에서 네트워크 연결은 프로듀서 네트워크의 Private Service Connect 인터페이스에서 연결을 위한 지정된 진입점 역할을 합니다. 네트워크 연결에 Private Service Connect 인터페이스가 설정되면 프로듀서 VM에 네트워크 연결의 서브넷에서 IP가 할당됩니다. Private Service Connect 인터페이스의 가상 머신 인스턴스에는 프로듀서 서브넷에 연결되는 일반 네트워크 인터페이스가 하나 이상 있습니다. 자세한 내용은 네트워크 연결 정보를 참고하세요.
프로듀서 프로젝트: Datastream을 실행하는 가상 머신 (VM)이 호스팅되는 Google 소유 프로젝트입니다. 고객 VPC의 리소스에 액세스하기 위해 Datastream VM은 Private Service Connect 네트워크 인터페이스가 서브넷에서 할당한 IP 주소를 사용합니다.
Private Service Connect 기본 요건
Private Service Connect 인터페이스를 사용하여 비공개 연결 구성을 만들려면 Datastream이 프로젝트에 대한 연결을 설정할 수 있도록 다음 단계를 수행해야 합니다.
Datastream 비공개 네트워크에 연결할 수 있는 VPC 네트워크가 있습니다. VPC 네트워크 생성에 대한 자세한 내용은 VPC 네트워크 만들기 및 관리를 참고하세요.
Datastream에서 연결에 필요하므로 이 URL을 기록해 둡니다. Google Cloud를 사용하여 Private Service Connect 인터페이스 비공개 연결 구성을 만드는 방법에 관한 자세한 내용은 비공개 연결 구성 관리를 참고하세요.
비공개 연결 구성 만들기
프로젝트에서 네트워크 연결을 만든 후 Google Cloud Private Service Connect 인터페이스를 사용하여 비공개 연결 구성을 설정해야 합니다. 구성을 만들 때 Private Service Connect 인터페이스를 호스팅하는 프로젝트를 허용 목록에 추가합니다. 그런 다음 Private Service Connect 리소스의 일부로 네트워크 연결 URL을 Datastream에 제공합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[],[],null,["# Configure Private Service Connect interfaces\n\nDatastream uses Private Service Connect interfaces\nto let you replicate data in a way that keeps the traffic entirely within\nGoogle Cloud.\n\nA Private Service Connect interface is a resource that lets a *producer*\nVirtual Private Cloud (VPC) network initiate connections to and receive connections from\na *network attachment* in a *consumer* VPC network. Producer and consumer\nnetworks can be in different projects and organizations.\n[](/static/datastream/docs/images/psc-overview-interface-overview.svg) **Figure 1.** Private Service Connect interfaces\nlet service producers initiate connections to service consumers.\n\nFor key term definitions, see the section that follows.\n\nFor more information about Private Service Connect, see the\n[Virtual Private Cloud documentation](/vpc/docs/private-service-connect).\n\nKey terms\n---------\n\nThis section provides an overview of key terms and concepts that apply to\nPrivate Service Connect.\n\n- **Producer**: an entity, typically a service or a VM within a VPC network,\n that initiates the connection to the consumer network. The producer delivers\n the service: in the Datastream context, it fetches and replicates\n data to a destination.\n\n- **Consumer**: an entity, typically a VM within a VPC network, that receives\n the connection from the producer. When the consumer accepts the connection,\n Google Cloud allocates the Private Service Connect interface an\n IP address from a subnet in the consumer VPC network that's specified by the\n network attachment. The VM of the Private Service Connect\n interface has a second network interface that connects to the producer's\n VPC network.\n\n- **Network attachment** : a regional resource that lets a producer VPC network\n initiate connections to a consumer VPC network through a\n Private Service Connect interface. In the consumer VPC network,\n the network attachment acts as a designated entry point for connections from\n Private Service Connect interfaces in the producer network. When\n a Private Service Connect interface is established on\n a network attachment, the producer VM is assigned an IP from the subnet of the\n network attachment. The virtual machine instance of the\n Private Service Connect interface has at least one more regular network\n interface that connects to a producer subnet. For more information, see\n [About network attachments](/vpc/docs/about-network-attachments).\n\n- **Producer project**: a Google-owned project where the virtual machines (VMs)\n running Datastream are hosted. To access resources in the customer\n VPC, the Datastream VMs use the IP address that the\n Private Service Connect network interface assigns from its subnet.\n\nPrivate Service Connect prerequisites\n-------------------------------------\n\nBefore you create a private connectivity configuration using a\nPrivate Service Connect interface, you need to take the following steps\nso that Datastream can establish a connection to your project:\n\n- Have a VPC network that you can connect to the Datastream\n private network. For more information about creating a VPC network, see\n [Create and manage VPC networks](/vpc/docs/create-modify-vpc-networks).\n\n- Create a [network attachment](/vpc/docs/create-manage-network-attachments#create-manual-accept)\n in your VPC project.\n\n- Verify that Google Cloud and the on-premises firewall allow traffic from the\n network attachment IP address range to the source database from which you want\n to stream data.\n\nPricing\n-------\n\nData ingress and egress through Private Service Connect is\ncharged. For more information, see the [Private Service Connect\npricing](/vpc/network-pricing#psc-network-attachment).\n\nRequired roles and permissions\n------------------------------\n\nTo get the permissions that you need to create a network attachment, ask your\nadministrator to grant you the following Identity and Access Management (IAM) roles on\nyour project:\n\n- Create, view, and delete network attachments: [Compute Network Admin](/compute/docs/access/iam#compute.networkAdmin) (`roles/compute.networkAdmin`)\n\nIf your network attachment is in a different project than Datastream,\nthen you need to grant the following role to the\n`service-`\u003cvar translate=\"no\"\u003eDATASTREAM-PROJECT-NUMBER\u003c/var\u003e`@gcp-sa-datastream.iam.gserviceaccount.com`\nservice account:\n\n- Read-only access to networking resources:\n [Compute Network Viewer](/compute/docs/access/iam#compute.networkViewer)\n (`roles/compute.networkViewer`)\n\n Grant the role on the project where your network attachment is, and replace\n \u003cvar translate=\"no\"\u003eDATASTREAM-PROJECT-NUMBER\u003c/var\u003e with the number of the project where\n Datastream is deployed.\n\nFor more information about granting roles, see\n[Manage access](/iam/docs/granting-changing-revoking-access).\n\nYou might also be able to get the required permissions through\n[custom roles](/iam/docs/creating-custom-roles) or other\n[predefined roles](/iam/docs/understanding-roles).\n\nFor more information about access control options in Datastream,\nsee [Access control with IAM](/data-fusion/docs/access-control).\n\nConfigure Private Service Connect\n---------------------------------\n\nTo let Datastream establish outbound connectivity to your network\nusing a Private Service Connect interface:\n\n1. Create a network attachment in your project.\n2. Create a private connectivity configuration.\n\n### Create a network attachment\n\nTo configure Private Service Connect in Datastream, you\nmust first create a network attachment. \n\n### Console\n\n1. In the Google Cloud console, go to the **Network attachments** page:\n\n [Go to Network attachments](https://console.cloud.google.com/net-services/psc/list/networkAttachments)\n2. Click **Create network attachment**.\n\n3. In the **Name** field, enter a name for your network attachment.\n\n4. From the **Network** list, select a VPC or a Shared VPC\n network.\n\n5. From the **Region** list, select a Google Cloud region. This region\n must be the same as the region used for the subnet of the VPC network\n peered to the Datastream private network. For more\n information, see [Private Service Connect prerequisites](#psci-prereqs).\n\n6. From the **Subnetwork** list, select a subnetwork range.\n\n7. In **Connection preference** , select\n **Accept connections for selected projects**.\n\n Datastream automatically adds the producer project to the\n **Accepted projects** list when you create the Datastream\n private connectivity resource.\n | **Caution:** The option **Automatically accept connections for all projects** is less secure because it allows any service to obtain IP addresses from your subnet. We don't recommend using this option.\n8. Don't add **Accepted projects** or **Rejected projects**.\n\n9. Click **Create network attachment**.\n\n### gcloud\n\n1. Create one or more subnetworks. For example:\n\n gcloud compute networks subnets create subnet-1 --network=network-0 --range=10.10.1.0/24 --region=\u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e\n\n The network attachment uses these subnetworks in the subsequent steps.\n2. Create a network attachment resource in the same region as the\n Datastream project, with the `connection-preference` property\n set to `ACCEPT_MANUAL`:\n\n gcloud compute network-attachments create \u003cvar translate=\"no\"\u003eNAME\u003c/var\u003e\n --region=\u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e\n --connection-preference=ACCEPT_MANUAL\n --subnets=\u003cvar translate=\"no\"\u003eSUBNET\u003c/var\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eNAME\u003c/var\u003e: the name for your network attachment.\n - \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e: the name of the Google Cloud region. This region must be the same as the Datastream private network.\n - \u003cvar translate=\"no\"\u003eSUBNET\u003c/var\u003e: the name of the subnet.\n\n The output of this command is a network attachment URL of the following\n format:\n\n `projects/`\u003cvar translate=\"no\"\u003ePROJECT\u003c/var\u003e`/locations/`\u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e`/network-attachments/`\u003cvar translate=\"no\"\u003eNETWORK_ATTACHMENT_ID\u003c/var\u003e.\n\n Make a note of this URL as Datastream needs it for\n connectivity. For information about how to create a\n Private Service Connect interface private\n connectivity configuration using Google Cloud, see\n [Manage private connectivity configurations](/datastream/docs/manage-private-connectivity-configurations#create-a-private-connectivity-configuration).\n | **Caution:** Specifying `connection-preference` as `ACCEPT_AUTOMATIC` is less secure because it allows any service to obtain IP addresses from your subnet. We don't recommend using this option.\n\n### Create a private connectivity configuration\n\nAfter you create a network attachment in your Google Cloud project, you need\nto set up your private connectivity configuration using\nPrivate Service Connect interfaces. When you create the configuration,\nyou allowlist the project that hosts the Private Service Connect\ninterface. You then provide the network attachment URL to\nDatastream as part of the Private Service Connect\nresource.\n\nFor more information, see\n[Create a private connectivity configuration](/datastream/docs/create-a-private-connectivity-configuration#create-the-configuration).\n\nWhat's next\n-----------\n\n- Learn how to [view your private connectivity configuration](/datastream/docs/view-a-private-connectivity-configuration).\n- Find out how to [delete a private connectivity configuration](/datastream/docs/delete-a-private-connectivity-configuration)."]]
