私人 Google 存取權 (適用於內部部署主機)：使用 IP 位址子網路範圍 199.36.153.8/30 (private.googleapis.com) 或 199.36.153.4/30 (restricted.googleapis.com) 存取 REGION-aiplatform.googleapis.com。
Google API 適用的 Private Service Connect 端點：使用使用者定義的內部 IP 位址 (例如 10.0.0.100) 存取 REGION-aiplatform.googleapis.com，或使用指派的 DNS 名稱 (例如 aiplatform-genai1.p.googleapis.com)。
如果應用程式使用 Vertex AI 支援的存取方法表格中列出的 Google 服務，應用程式就能針對服務端點 (REGION-aiplatform.googleapis.com) 執行 DNS 查詢，並傳回可公開路由的虛擬 IP 位址。只要有網際網路連線，您就能在世界各地使用這個 API。不過，從 Google Cloud 資源傳送至這些 IP 位址的流量仍會保留在 Google 的網路內。
Vertex AI API 的私人存取權
私人存取權是透過網際網路連線至 Google API 和服務的替代方案。它可提供更高的頻寬、可靠性和一致的效能。 Google Cloud 支援下列選項，可透過混合式網路服務 (例如 Cloud Interconnect、Cross-Cloud Interconnect、採用 Cloud Interconnect 的高可用性 VPN 和 SD-WAN) 私下存取 Google API。
內部部署主機的私人 Google 存取
「內部部署主機的私人 Google 存取權」可讓內部部署系統透過混合式網路服務將流量路由，連線至 Google API 和服務。
私人 Google 存取權要求您使用 Cloud Router 宣告下列任一子網路 IP 位址範圍，做為自訂宣告路徑：
使用 Private Service Connect，您可以在虛擬私有雲網路中使用全域內部 IP 位址建立私人端點。您可以為這些內部 IP 位址指派 DNS 名稱，例如 aiplatform-genai1.p.googleapis.com 和 bigtable-adsteam.p.googleapis.com 等有意義的名稱。這些名稱和 IP 位址是虛擬私有雲網路的內部名稱和 IP 位址，以及透過混合式網路服務連線至該網路的任何地端部署網路。您可以控管哪些流量傳至哪個端點，並證實這些流量會留在 Google Cloud中。
您可以建立使用者定義的全球 Private Service Connect 端點 IP 位址 (/32)。詳情請參閱「IP 位址相關規定」。
您可以在與 Cloud Router 相同的 VPC 網路中建立 Private Service Connect 端點。
您可以為這些內部 IP 位址指派 DNS 名稱，例如 aiplatform-prodpsc.p.googleapis.com 等有意義的名稱。詳情請參閱「關於透過端點存取 Google API」。
部署考量事項
以下是一些重要考量事項，會影響您使用私人 Google 存取權和 Private Service Connect 存取 Vertex AI API 的方式。
私人 Google 存取權
最佳做法是在 VPC 子網路上啟用私人 Google 存取權，讓沒有外部 IP 位址的運算資源 (例如 Compute Engine 和 GKE VM 執行個體) 能夠連上 Google Cloud API 和服務 (例如 Vertex AI、Cloud Storage 和 BigQuery)。
IP 廣告
您必須透過 Cloud Router 將 Private Google Access 子網路範圍或 Private Service Connect 端點 IP 位址，做為自訂宣傳路徑，宣傳至內部部署和多雲環境。詳情請參閱「通告自訂 IP 範圍」。
防火牆規則
您必須確保內部部署和多雲環境的防火牆設定，允許來自私人 Google 存取權或 Private Service Connect 子網路 IP 位址的傳出流量。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[],[],null,["# About accessing the Vertex AI API\n\nYour applications can connect to APIs in Google's production environment from\nwithin Google Cloud or from hybrid (on-premises and multicloud) networks.\nGoogle Cloud offers the following public and private access options, which offer\nglobal reachability and SSL/TLS security:\n\n1. [Public internet access](#internet): Send traffic to \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e`-aiplatform.googleapis.com`.\n2. [Private Google Access for on-premises hosts](#pga): Use the IP address subnet range `199.36.153.8/30` (private.googleapis.com) or `199.36.153.4/30` (restricted.googleapis.com) to access \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e`-aiplatform.googleapis.com`.\n3. [Private Service Connect endpoints for Google APIs](#psc): Use a user-defined internal IP address such as `10.0.0.100` to access \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e`-aiplatform.googleapis.com` or an assigned DNS name such as `aiplatform-genai1.p.googleapis.com`.\n\nThe following diagram illustrates these access options.\n\nSome Vertex AI service producers require you to connect to their\nservices through\n[private services access](/vertex-ai/docs/general/private-services-access)\nor through\n[Private Service Connect endpoints](/vertex-ai/docs/general/psc-endpoints).\nThese services are listed in the\n[Private access options for Vertex AI](/vertex-ai/docs/general/netsec-overview#private_access_options_for)\ntable.\n\nPublic internet access to the Vertex AI API\n-------------------------------------------\n\nIf your application uses a Google service listed in the [table of supported access methods for Vertex AI](/vertex-ai/docs/general/netsec-overview#access-methods), your application can access the API by performing a DNS lookup against the\n[service endpoint](/vertex-ai/docs/reference/rest#service-endpoint)\n(\u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e`-aiplatform.googleapis.com`), which returns\npublicly routable virtual IP addresses. You can use the API from\nany location in the world as long as you have an internet connection.\nHowever, traffic that is sent from Google Cloud resources to those IP\naddresses remains within Google's network.\n\nPrivate access to the Vertex AI API\n-----------------------------------\n\nPrivate access is an alternative to connecting to Google APIs\nand services over the internet. It provides higher bandwidth, reliability and\nconsistent performance. Google Cloud supports the following options\nfor accessing Google APIs privately\nthrough hybrid networking services such as Cloud Interconnect,\nCross-Cloud Interconnect, HA VPN over Cloud Interconnect, and\nSD-WAN.\n\n### Private Google Access for on-premises hosts\n\n[Private Google Access for on-premises hosts](/vpc/docs/private-google-access-hybrid)\nprovides a way for on-premises systems to connect to Google APIs\nand services by routing traffic through hybrid networking services.\n\nPrivate Google Access requires you to advertise one of the following subnet\nIP address ranges as a custom advertised route by using Cloud Router:\n\n- `private.googleapis.com`: `199.36.153.8/30`, `2600:2d00:0002:2000::/64`\n- `restricted.googleapis.com`: `199.36.153.4/30`, `2600:2d00:0002:1000::/64`\n\nFor more information, see\n[Configure Private Google Access for on-premises hosts](/vpc/docs/configure-private-google-access-hybrid).\n\n### Private Service Connect endpoints for the Vertex AI API\n\nWith Private Service Connect, you can create private endpoints\nusing global internal IP addresses within your VPC network.\nYou can assign DNS names to these internal IP addresses with meaningful names\nlike `aiplatform-genai1.p.googleapis.com` and\n`bigtable-adsteam.p.googleapis.com`. These names and IP addresses are\ninternal to your VPC network and any on-premises networks\nthat are connected to it through hybrid networking services.\nYou can control which traffic goes to which endpoint, and can demonstrate\nthat traffic stays within Google Cloud.\n\n- You can create a user-defined global Private Service Connect endpoint IP address (/32). For more information, see [IP address requirements](/vpc/docs/about-accessing-google-apis-endpoints#ip-address-requirements).\n- You create the Private Service Connect endpoint in the same VPC network as the Cloud Router.\n- You can assign DNS names to these internal IP addresses with meaningful names like `aiplatform-prodpsc.p.googleapis.com`. For more information, see [About accessing Google APIs through endpoints](/vpc/docs/about-accessing-google-apis-endpoints).\n\nDeployment considerations\n-------------------------\n\nFollowing are some important considerations that affect how you use\nPrivate Google Access and Private Service Connect to access\nthe Vertex AI API.\n\n### Private Google Access\n\nAs a best practice, you should\n[enable Private Google Access](/vpc/docs/configure-private-google-access#config-pga)\non VPC subnets to allow compute resources (such as\nCompute Engine and GKE VM instances) that don't have external\nIP addresses to reach Google Cloud APIs and services (such as\nVertex AI, Cloud Storage, and BigQuery).\n\n### IP advertisement\n\nYou must advertise the Private Google Access subnet range or the\nPrivate Service Connect endpoint IP address to on-premises and\nmulticloud environments from the Cloud Router as a custom advertised route.\nFor more information, see\n[Advertise custom IP ranges](/network-connectivity/docs/router/how-to/advertising-custom-ip).\n\n### Firewall rules\n\nYou must ensure that the firewall configuration of on-premises and\nmulticloud environments allows outbound traffic\nfrom the IP addresses of Private Google Access or\nPrivate Service Connect subnets.\n\n### DNS configuration\n\n- Your on-premises network must have DNS zones and records configured so that a request to \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e`-aiplatform.googleapis.com` resolves to the [Private Google Access subnet](/vpc/docs/configure-private-google-access-hybrid#config-domain) or the [Private Service Connect endpoint](/vpc/docs/configure-private-service-connect-apis#on-premises) IP address.\n- You can create Cloud DNS managed private zones and use a Cloud DNS inbound server policy, or you can configure on-premises name servers. For example, you can use [BIND](https://wikipedia.org/wiki/BIND) or [Microsoft Active Directory DNS](https://learn.microsoft.com/windows-server/networking/dns/dns-top).\n- If your on-premises network is connected to a VPC network, you can use Private Service Connect to access Google APIs and services from on-premises hosts using the internal IP address of the endpoint. For more information, see [Access the endpoint from on-premises hosts](/vpc/docs/configure-private-service-connect-apis#on-premises)."]]
