서비스 인스턴스 관리자는 서비스 연결 정책에 따라 해당 권한을 위임 받기 때문에 VPC 네트워크에 대한 IAM 권한이 필요하지 않습니다. 하지만 서비스 연결 정책을 사용하여 배포된 특정 관리형 서비스에는 IAM 권한이 필요할 수 있습니다. 특정 관리형 서비스에 필요한 IAM 권한에 대한 자세한 내용은 서비스 문서를 확인하세요.
관리형 서비스 인스턴스 배포 및 연결 구성
서비스에 서비스 연결 정책이 있는 경우 소비자 서비스 관리자는 관리형 서비스의 관리 API 또는 UI를 통해 직접 배포 중인 관리형 서비스 인스턴스의 연결을 구성할 수 있습니다.
관리형 서비스 연결을 배포하려면 다음 단계를 따르세요. 이 단계는 관리형 서비스에 따라 다를 수 있습니다.
관리형 서비스의 관리 API 또는 UI를 사용하여 서비스 인스턴스를 배포하고 연결 유형으로 Private Service Connect를 지정합니다. 서비스에서 Private Service Connect 엔드포인트를 배포할 VPC 네트워크를 지정하는 옵션을 제공할 수 있습니다.
서비스에서 IP 주소를 제공하는 등 새 엔드포인트에 연결할 방법에 대한 정보를 제공할 수 있습니다. 제공된 IP 주소를 사용하여 Google Cloud내의 내부 IP 주소로 서비스와 통신합니다.
특정 서비스를 구성하는 방법에 관한 자세한 내용은 해당 서비스의 문서를 참고하세요.
서비스 연결 사용 중단
서비스 연결을 사용 중단하거나 서비스 연결 정책을 사용하여 배포된 관리형 서비스 인스턴스를 사용 중단하려면 관리형 서비스의 관리 API 또는 UI를 사용합니다. 관리형 서비스와 연결된 각 서비스 인스턴스를 삭제합니다. 서비스 인스턴스가 삭제되면 서비스 연결 자동화에서 연결 및 엔드포인트와 연결된 항목을 삭제합니다.
문제 해결
이 섹션에는 서비스 연결 자동화를 통해 생성된 연결 문제 해결에 관한 정보가 포함되어 있습니다.
엔드포인트 생성 또는 삭제 실패
승인된 엔드포인트가 예상대로 생성되거나 삭제되지 않으면 서비스 연결 정책을 설명합니다.
pscConnections 필드에는 차단 오류와 해결 방법에 관한 세부정보가 포함되어 있습니다.
문제가 해결되면 서비스 연결 자동화가 다음에 자동으로 작업을 재시도할 때 엔드포인트가 생성되거나 삭제됩니다.
또는 재시도 프로세스를 기다리지 않으려면 배포 중인 관리형 서비스의 관리 API 또는 UI를 사용하여 유효한 구성을 사용하여 다른 서비스 인스턴스의 배포 및 연결을 요청하면 됩니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-05(UTC)"],[],[],null,["# Deploy a managed service instance by using service connection policies\n\nDeploy a managed service instance by using service\nconnection policies\n======================================================================\n\nThis page describes how a service instance administrator can deploy an instance\nof a managed service and configure connectivity by using service connection\npolicies.\n\nBefore you begin\n----------------\n\n- Make sure that the managed service that you want to deploy supports\n service connection policies. Making services available for deployment by\n using service connection maps is available in a limited Preview. For more\n information about services that support service connection maps, see\n [Supported services](/vpc/docs/about-service-connectivity-automation#supported-services).\n\n- You need a [service connection policy](/vpc/docs/about-service-connection-policies)\n for the VPC network, region, and managed service that you want\n to deploy.\n\n### Required roles\n\nService instance administrators don't need any IAM permissions\nfor the VPC network because these permissions are delegated\nby the service connection policy. However, IAM permissions might\nbe required for specific managed services that are deployed by using service\nconnection policies. For information about IAM permissions that\nare required by a specific managed service, check the service's documentation.\n\nDeploy a managed service instance and configure connectivity\n------------------------------------------------------------\n\nIf a service connection policy exists for a service, a consumer service\nadministrator can configure connectivity for the managed service instance that\nthey are deploying directly through the administrative API or UI of the managed\nservice.\n\nTo deploy managed service connectivity, follow these steps. The steps might\nvary depending on the managed service.\n\n1. Use the administrative API or UI of the managed service to deploy a service\n instance, specifying Private Service Connect as your connectivity\n type. The service might provide the option to specify the VPC\n network to deploy Private Service Connect endpoints in.\n\n For example, you can\n [deploy and configure connectivity for a Cloud SQL instance](/sql/docs/mysql/configure-private-service-connect#create-cloud-sql-instance-psc-enabled-2).\n | **Note:** A service connection policy must exist for this VPC network, region, and service class. Otherwise, the service producer that's represented by the service class is not authorized to deploy connectivity on your behalf.\n2. If all [authorization checks](/vpc/docs/about-service-connectivity-automation#authorization)\n pass, then connectivity is deployed. The\n Network Connectivity Service Account creates an internal IP\n address and Private Service Connect\n endpoint in the specified VPC network.\n\n The lifecycle of your endpoint matches the lifecycle of your managed\n service instance. The endpoint remains active and stable unless you\n reconfigure connectivity or [decommission the service instance](#decommission-service)\n3. After the Network Connectivity Service Account creates your endpoint, the\n endpoint's forwarding rule is visible in the project that you configured\n in step 1. This forwarding rule indicates that the connection has been\n accepted by the producer and includes the IP address that was assigned to\n your endpoint.\n\n The names of all forwarding rules that are created by using\n service connection policies start with `sca-auto-`. The following is an\n example of a forwarding rule that was created by using a service connection\n policy. \n\n ```\n\n kind: compute#forwardingRule\n name: sca-auto-ab3f45d\n IPAddress: 10.33.2.8\n allowPscGlobalAccess: true\n network: https://www.googleapis.com/compute/v1/projects/consumer-project/global/networks/vpc1\n pscConnectionStatus: ACCEPTED\n region: https://www.googleapis.com/compute/v1/projects/consumer-project/regions/us-central1\n selfLink: https://www.googleapis.com/compute/v1/projects/consumer-project/regions/us-central1/forwardingRules/sca-auto-ab3f45d\n serviceDirectoryRegistrations:\n -namespace: goog-psc-default\n target:\n https://www.googleapis.com/compute/v1/projects/producer-project/regions/us-central1/serviceAttachments/producer-sa\n\n ```\n4. Your service might provide information about how to connect to the\n new endpoint---for example, by providing an IP address. Use the\n provided IP address to communicate with your service through internal IP\n addresses within Google Cloud.\n\n For more information about how to configure a specific service, see that\n service's documentation.\n\n| **Caution:** The managed service fully controls the lifecycle of Private Service Connect endpoints and IP addresses that are deployed by using service connection policies. Don't directly delete or update these Google Cloud resources or else you risk losing connectivity to your managed service instance. All actions to add, remove, or update connectivity for a managed service instance should be taken directly through the administrative API or UI of the managed service.\n\nDecommission service connectivity\n---------------------------------\n\nTo decommission service connectivity or decommission a managed service instance\nthat's deployed by using service connection policies, use the administrative API\nor UI of the managed service. Delete each service instance that's associated\nwith the managed service. When service instances are deleted, service\nconnectivity automation deletes the associated connections and endpoints.\n\nTroubleshooting\n---------------\n\nThis section contains information about troubleshooting connections that are\ncreated through service connectivity automation.\n\n### Endpoint creation or deletion failure\n\nIf authorized endpoints are not created or deleted as you expect,\n[describe the service connection policy](/vpc/docs/configure-service-connection-policies#describe-policy).\nThe `pscConnections` field contains details about any blocking\nerrors and how you can resolve them.\n\nAfter any issues are resolved, the endpoint is created or deleted the next time\nservice connectivity automation automatically\n[retries the operation](/vpc/docs/about-service-connectivity-automation#endpoint-automation).\n\nAlternatively, if you don't want to wait for the retry process, you can use the\nadministrative API or UI of the managed service you are deploying to request\ndeployment and connectivity for another service instance, using a valid\nconfiguration."]]
