Private Access options for services in GCP

Private Google Access and Private Service Connect are both ways to access Google APIs and services from your VPC network without using an external IP address. However, there are some key differences between the two services.

Real-World example

Let’s say you have a VPC network that contains a set of VM instances that need to access Google Cloud Storage. You could use Private Google Access to access Cloud Storage without using an external IP address. However, if you want to use your own internal IP addresses for Cloud Storage, you would need to use Private Service Connect.

In this case, you would create a Private Service Connect endpoint for Cloud Storage. You would then configure your network to route traffic from your VM instances to the Private Service Connect endpoint. This would allow your VM instances to access Cloud Storage using your own internal IP addresses.

The key difference is that Private google access uses a shared set of IP addresses, basically connecting to some shared set of IP addresses and these sets of IPs are the ranges defined for all the Google APIs where in the private service connect, you create the Private endpoint to connect to the Google APIs using the internal IP. Which means you don’t need to connect to certain set or ranges of IP. Please keep this in mind the real key difference. I often see people get confused between these two service because they look similar but works differently in the real world.

Private Google Access:

• Uses a shared set of IP addresses. When you use Private Google Access, your VPC network is connected to a shared set of IP addresses that are used to access Google APIs and services. This means that all traffic from your VPC network to Google APIs and services will go through the same set of IP addresses.
• Is not as flexible. Private Google Access is not as flexible as Private Service Connect. For example, you cannot use your own internal IP addresses with Private Google Access.
• Is easier to set up. Private Google Access is easier to set up than Private Service Connect. You do not need to create any custom resources, and you can use the same configuration for all of your Google APIs and services.

Private Google Access

The above architecture describes how to use Private Google Access to access Google APIs and services from a VPC network without using an external IP address. The VPC network is connected to a shared set of IP addresses that are used to access Google APIs and services. This means that all traffic from the VPC network to Google APIs and services will go through the same set of IP addresses.

If your subnet has Private Google Access on and your VM also has an external public IP, Private Google Access has no effect on instances that have external IP addresses. Instances with external IP addresses can access the internet

When a VM in a subnet with Private Google Access tries to connect to a Google API or service, the traffic will be routed to the default internet gateway. However, the default internet gateway will not forward the traffic to the Google API or service. Instead, the traffic will be routed to the Private Google Access proxy. The Private Google Access proxy will then forward the traffic to the Google API or service. This ensures that the traffic is not exposed to the internet, which improves security.

If you want your VM to be able to connect to Google APIs and services using its external public IP, then you will need to disable Private Google Access for the subnet. Once you have disabled Private Google Access for the subnet, the VM will be able to connect to Google APIs and services using its external public IP. However, this will not be as secure as using Private Google Access.

• VM-A and VM-B can access Google APIs and services, including Cloud Storage because its network interface is located in subnet-a, which has Private Google Access enabled. Private Google Access applies to the instance because it only has an internal IP address.
• VM-Ccan access Google APIs and services, including Cloud Storage, because they each have external IP addresses. Private Google Access has no effect on whether or not these instances can access Google APIs and services because both have external IP addresses.

What is Private Service Connect:

• Uses your own IP addresses. When you use Private Service Connect, you can use your own internal IP addresses to access Google APIs and services. This gives you more control over your network traffic, and it can improve performance.
• Is more flexible. Private Service Connect is more flexible than Private Google Access. You can create custom endpoints for specific Google APIs and services, and you can control how traffic is routed between your VPC network and Google.
• Is more complex to set up. Private Service Connect is more complex to set up than Private Google Access. You need to create custom resources, and you need to configure your network to route traffic to the correct endpoints.

Private Service Connect

You can use Private Service Connect to access Google APIs and services from a VPC network using your own internal IP addresses.

The VPC network is connected to a Google Cloud service called a Private Service Connect endpoint. This endpoint is configured to use your own internal IP addresses. Traffic from the VPC network to the Private Service Connect endpoint will be routed to Google APIs and services using your own internal IP addresses. The VM instances in the VPC network can access Google APIs and services by using their internal IP addresses. This means that they do not need to have an external IP address assigned to them.

Moreover, you need to configure DNS for Private Service Connect. You need to create a DNS record that points to the Private Service Connect endpoint. This will allow your VM instances to resolve the names of Google APIs and services to the correct IP addresses.

Which service should you use?

The best service for you will depend on your specific needs. If you need to use your own internal IP addresses to access Google APIs and services, then Private Service Connect is the best option. However, if you need a simpler solution, then Private Google Access may be a better choice.

Conclusion: Private Google Access is a simpler way to access Google APIs and services from a VPC network without using an external IP address. Private Service Connect is a more flexible way to access Google APIs and services from a VPC network using your own internal IP addresses. The best service for you will depend on your specific needs.

Thank you for Reading!

I hope you like this article. Keep Learning!