[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-05 (世界標準時間)。"],[],[],null,["You can use [Private Service Connect](/vpc/docs/private-service-connect) to access a private connections Looker (Google Cloud core) instance or connect a private connections Looker (Google Cloud core) instance to other internal or external services. In order to use Private Service Connect, your Looker (Google Cloud core) instance must meet the following criteria:\n\n- [Instance editions](/looker/docs/looker-core-overview#looker_(google_cloud_core)_editions) must be Enterprise (`core-enterprise-annual`) or Embed (`core-embed-annual`).\n- [Private Service Connect](/looker/docs/looker-core-create-psc) must be enabled upon instance creation.\n\nPrivate Service Connect allows [inbound access](#psc-access) to Looker (Google Cloud core) using endpoints or backends. Network endpoint groups (NEGs), once exposed as Private Service Connect service producers, enable Looker (Google Cloud core) to access outbound on-premises resources, multi-cloud environments, VPC workloads, or internet services.\n\nTo learn more about Private Service Connect, watch the [What is Private Service Connect?](https://www.youtube.com/watch?v=JAFagcQBV08) and [Private Service Connect and Service Directory: A revolution to connect your application in Cloud](https://www.youtube.com/watch?v=TYumathiFRI) videos.\n\nService attachment\n\nWhen you [create a Looker (Google Cloud core) instance](/looker/docs/looker-core-create-psc) that is enabled to use Private Service Connect, Looker (Google Cloud core) creates a service attachment for the instance automatically. A [*service attachment*](/vpc/docs/about-vpc-hosted-services#service-attachments) is an attachment point that VPC networks use to access the instance. The service attachment has a URI, which is used for making connections. You can find that URI on the [**Details** tab](/looker/docs/looker-core-view-console#details_tab) of the instance configuration page of the Google Cloud console.\n\nYou next create a Private Service Connect backend that another VPC network uses to connect to the service attachment. This enables the network to access the Looker (Google Cloud core) instance.\n\nInbound access **Note:** You use Private Service Connect for inbound access when your Looker (Google Cloud core) instance is configured to use private connections. Looker (Google Cloud core) instances that are configured to use [hybrid connections](/looker/docs/looker-core-networking-options#private-ip-public-ip) use the [web URL](/looker/docs/looker-core-custom-domain) to gain inbound access.\n\n[*Inbound*](/looker/docs/glossary#northbound-traffic) access concerns configuring routing from clients to Looker (Google Cloud core). Looker (Google Cloud core) deployed with Private Service Connect supports [backend](/vpc/docs/private-service-connect#backends) connections for inbound access.\n\nLooker (Google Cloud core) Private Service Connect instances can be accessed by service consumers through an external regional application load balancer or privately through a Private Service Connect backend. However, Looker (Google Cloud core) supports a single custom domain, so inbound access to a Looker (Google Cloud core) instance must be either public or private, not both public and private.\n\nBackends\n\nBackends are deployed by using [network endpoint groups (NEGs)](/load-balancing/docs/negs), which let consumers direct public and private traffic to their load balancer before the traffic reaches a Private Service Connect service, and also offer certificate termination. With a load balancer, backends provide the following options:\n\n- Observability (every connection is logged)\n- [Cloud Armor integration](/armor/docs/cloud-armor-overview)\n- URL private labeling and client-side certificates\n- Request decoration (adding custom request headers)\n\n| **Note:** For information about setting up inbound access using hybrid networking, see the [Inbound access to a Looker (Google Cloud core) instance using Private Service Connect](/looker/docs/looker-core-psc-access) documentation page.\n\nAccess outbound services\n\nLooker (Google Cloud core) acts as a service consumer when establishing communication to other services in your VPC, multi-cloud network, or the internet. Connecting to these services from Looker (Google Cloud core) is considered [*outbound traffic*](/looker/docs/glossary#southbound-traffic).\n\nTo connect to these services, perform the following steps:\n\n1. Ensure that the service [is published](/vpc/docs/about-vpc-hosted-services). Some Google Cloud services may take care of this for you; for example, Cloud SQL offers a way to [create an instance with Private Service Connect enabled](/sql/docs/mysql/configure-private-service-connect). Otherwise, follow [the instructions for publishing a service by using Private Service Connect](/vpc/docs/configure-private-service-connect-producer) and refer to the additional guidance in the [Looker (Google Cloud core) instructions](/looker/docs/looker-core-psc#set_up_psc_for_external_services).\n2. Specify the [outbound (egress) connection](/looker/docs/looker-core-create-psc#specify_southbound_connections) from Looker (Google Cloud core) to the service.\n\nYou can use hybrid connectivity NEGs or internet NEGs when accessing services with Private Service Connect:\n\n- A [hybrid connectivity NEG](/load-balancing/docs/negs/hybrid-neg-concepts#regional-internal-https) provides access to private endpoints, such as on-premises or multi-cloud endpoints. A hybrid connectivity NEG is a combination of an IP address and port configured as a backend to a load balancer. It is deployed within the same VPC as the Cloud Router. This deployment enables services in your VPC to reach routable endpoints through hybrid connectivity, such as Cloud VPN or Cloud Interconnect.\n\n- An [internet NEG](/load-balancing/docs/negs/internet-neg-concepts) provides access to public endpoints, for example, a GitHub endpoint. An internet NEG specifies an external backend for the load balancer. This external backend referenced by the internet NEG is accessible through the internet.\n\nYou can establish a outbound connection from Looker (Google Cloud core) to service producers in any region. For example, if you have Cloud SQL Private Service Connect instances in regions `us-west1` and `us-east4`, you can create a outbound connection from a Looker (Google Cloud core) Private Service Connect instance deployed in `us-central1`.\n\nThe two regional service attachments with unique domain names would be specified as follows. The `--region` flags refer to the region of the Looker (Google Cloud core) Private Service Connect instance, while the regions of the Cloud SQL instances are included in their service attachment URIs: \n\n```\ngcloud looker instances update looker-psc-instance \\\n--psc-service-attachment domain=sql.database1.com,attachment=projects/123/regions/us-west1/serviceAttachments/sql-database1-svc-attachment --region=us-central1 \\\n--psc-service-attachment domain=sql.database2.com,attachment=projects/123/regions/us-east4/serviceAttachment/sql-database2-svc-attachment --region=us-central1\n```\n\nOutbound access to non-Google managed services requires that you enable [global access](/vpc/docs/about-accessing-vpc-hosted-services-endpoints#global-access) on the producer load balancer to allow inter-region communication.\n\nWhat's next\n\n- [Create a Looker (Google Cloud core) Private Service Connect instance](/looker/docs/looker-core-create-psc)\n- [Access a Looker (Google Cloud core) instance using Private Service Connect](/looker/docs/looker-core-psc-access)"]]
