Private access options for services

Virtual machine (VM) instances in Virtual Private Cloud (VPC) networks can reach Google and third-party APIs and services without an external IP address. All Google Cloud APIs and services support private access.

The access methods are different for services in VPC networks compared to services in Google's production infrastructure. The former use peering or Private Service Connect; the latter use Private Google Access or Private Service Connect.

The following sections summarize the private access options in each category:

You can configure one or all of these options. They operate independently of each other.

Connect to Google APIs

The following table shows the options for connecting to services in Google's production networks:

Option Clients Connection Supported services Usage
Private Service Connect for Google APIs
Google Cloud resources with or without external IP addresses, and on-premises systems. Connect to a Private Service Connect endpoint in your VPC network, which forwards requests to Google APIs and services. Supports all Google Cloud APIs, and most other Google APIs and services1. Connect to Google APIs and services using an endpoint in your VPC network. Google Cloud and on-premises resources don't need an external IP addresses.
Private Service Connect for Google APIs with consumer HTTP(S) service controls
Google Cloud resources with or without external IP addresses, and on-premises systems. Connect to an internal HTTP(S) load balancer in your VPC network, which forwards requests to Google APIs and services. Supports selected regional Google APIs and services. Connect to regional Google APIs and services using an internal HTTP(S) load balancer in your VPC network. Google Cloud and on-premises resources don't need an external IP addresses.
Private Google Access
Google Cloud resources without external IP addresses. Connect to the standard external IP addresses or Private Google Access domains and VIPs for Google APIs and services through the VPC network's default internet gateway. Supports most Google APIs and services1. Use this option to connect to Google APIs and services without giving your Google Cloud resources external IP addresses.
Private Google Access for on-premises hosts
On-premises hosts with or without external IP addresses. Connect to Google APIs and services, from your on-premises network, through a Cloud VPN tunnel or Cloud Interconnect by using one of the Private Google Access-specific domains and VIPs. The Google services that you can access depend on which Private Google Access-specific domain you use. Use this option to connect to Google APIs and services through a VPC network. This method doesn't require your on-premises hosts to have external IP addresses.
1 Use private services access or Private Service Connect to connect to Google services that are not supported by Private Service Connect for Google APIs or Private Google Access.

Connect to services in VPC networks

The following table shows the options for connecting to services in VPC networks:

Option Clients Connection Supported services Usage
Connecting to services
Private Service Connect for published services
Google Cloud VM instances with or without external IP addresses. Connect to services in another VPC network through a Private Service Connect endpoint. Supports services that are published using Private Service Connect for service producers. Use this option to connect to supported services in another VPC network without assigning external IP addresses to your Google Cloud resources.
Private services access
Google Cloud VM instances with or without external IP addresses. Connect to a Google or third-party managed VPC network through a VPC Network Peering connection. Supports Google services2 and third-party services that are made available using the Service Networking API. Use this option to connect to specific Google and third-party services without assigning external IP addresses to your Google Cloud and Google or third-party resources.
2 Use Private Service Connect for Google APIs or Private Google Access to connect to Google services that are not supported by private services access or Private Service Connect for published services.

Connect from serverless Google services to VPC networks

You can use a Serverless VPC Access connector to let Cloud Run, App Engine standard, and Cloud Functions environments send packets to the internal IPv4 addresses of resources in a VPC network. Serverless VPC Access also supports sending packets to other networks connected to the selected VPC network.