Google Cloud provides several private access options that let virtual machine (VM) instances reach supported APIs and services without requiring an external IP address. Choose an option that supports the APIs and services that you need to access.
The following table summarizes each option. You can configure one or all of these options. They operate independently of each other.
|Connecting to Google APIs|
|Private Service Connect for Google APIs|
|Google Cloud resources with or without external IP addresses, and on-premises systems.||Connect to a Private Service Connect endpoint in your VPC network, which forwards requests to Google APIs and services.||Supports most Google APIs and services.||Connect to Google APIs and services using an endpoint in your VPC network. Google Cloud and on-premises resources don't need an external IP addresses.|
|Private Google Access||Google Cloud resources without external IP addresses.||Connect to the standard external IP addresses or Private Google Access domains and VIPs for Google APIs and services through the Virtual Private Cloud (VPC) network's default internet gateway.||Supports most Google APIs and services.||Use this option to connect to Google APIs and services without giving your Google Cloud resources external IP addresses.|
|Private Google Access for on-premises hosts|
|On-premises hosts with or without external IP addresses.||Connect to Google APIs and services, from your on-premises network, through a Cloud VPN tunnel or Cloud Interconnect by using one of the Private Google Access-specific domains and VIPs.||The Google services that you can access depend on which Private Google Access-specific domain you use.||Use this option to connect to Google APIs and services through a VPC network. This method doesn't require your on-premises hosts to have external IP addresses.|
|Connecting to services|
|Private Service Connect for services (Preview)|
|Google Cloud VM instances with or without external IP addresses.||Connect to services in another VPC network through a Private Service Connect endpoint.||Supports services that are published using Private Service Connect for service producers (Preview)||Use this option to connect to supported services in another VPC network without assigning external IP addresses to your Google Cloud resources.|
|Private services access|
|Google Cloud VM instances with or without external IP addresses.||Connect to a Google or third-party managed VPC network through a VPC Network Peering connection.||Supports some Google or third-party services||Use this option to connect to specific Google and third-party services without assigning external IP addresses to your Google Cloud and Google or third-party resources.|
|Connecting from serverless Google services|
|Serverless VPC Access|
|Google Cloud VM instances with or without external IP addresses.||Connect directly from serverless Google services through an internal VPC connection.||Cloud Run, App Engine standard environment, and Cloud Functions||Use this option to connect from a serverless environment on Google Cloud directly to resources in a VPC network using internal IP addresses.|