GCP for DevOps — Private Access

3 minute read

Private Access

Private Access allows VMs and services without external IPs to reach Google APIs and services without traversing the internet. This is critical for security-hardened environments.

Private Access Options

Private Access Options:
┌─────────────────────────────────────────────────┐
│  VPC (no external IPs)                            │
│                                                   │
│  ┌──────────┐    ┌──────────────────────────┐   │
│  │  VM        │───▶│ Private Google Access     │   │
│  │  (no ext   │    │ • Access Google APIs      │   │
│  │   IP)      │    │ • Via internal routes     │   │
│  └──────────┘    └──────────────────────────┘   │
│                                                   │
│  ┌──────────┐    ┌──────────────────────────┐   │
│  │  GKE Pod   │───▶│ Private Service Connect   │   │
│  │            │    │ • Private endpoint        │   │
│  │            │    │ • Dedicated connection    │   │
│  └──────────┘    └──────────────────────────┘   │
│                                                   │
│  ┌──────────┐    ┌──────────────────────────┐   │
│  │  On-prem   │───▶│ Cloud VPN / Interconnect  │   │
│  │  Server    │    │ • Encrypted tunnel        │   │
│  │            │    │ • Dedicated fiber         │   │
│  └──────────┘    └──────────────────────────┘   │
└─────────────────────────────────────────────────┘

Private Google Access

Enable VMs without external IPs to access Google APIs (Cloud Storage, BigQuery, etc.):

# Enable Private Google Access on a subnet
$ gcloud compute networks subnets update my-subnet \
    --region=us-central1 \
    --enable-private-ip-google-access

# Verify
$ gcloud compute networks subnets describe my-subnet \
    --region=us-central1 \
    --format="get(privateIpGoogleAccess)"
# True

With Private Google Access enabled, a VM without an external IP can:

  • Access Cloud Storage: gsutil cp file.txt gs://my-bucket/
  • Access BigQuery: bq query "SELECT * FROM dataset.table"
  • Access any Google API via *.googleapis.com

Private Service Connect

Create private endpoints for Google APIs within your VPC:

# Reserve an internal IP for the PSC endpoint
$ gcloud compute addresses create google-apis-endpoint \
    --region=us-central1 \
    --subnet=my-subnet \
    --addresses=10.0.1.100

# Create a PSC endpoint for Google APIs
$ gcloud compute forwarding-rules create google-apis-psc \
    --region=us-central1 \
    --network=my-vpc \
    --address=google-apis-endpoint \
    --target-google-apis-bundle=all-apis \
    --load-balancing-scheme=""

# Create a private DNS zone to resolve googleapis.com to the PSC endpoint
$ gcloud dns managed-zones create googleapis \
    --dns-name="googleapis.com." \
    --visibility=private \
    --networks=my-vpc

$ gcloud dns record-sets create "*.googleapis.com." \
    --zone=googleapis \
    --type=A \
    --ttl=300 \
    --rrdatas="10.0.1.100"

Cloud VPN

# Create a VPN gateway
$ gcloud compute vpn-gateways create my-vpn-gw \
    --network=my-vpc \
    --region=us-central1

# Create a peer VPN gateway
$ gcloud compute external-vpn-gateways create peer-gw \
    --interfaces=0=203.0.113.1

# Create a Cloud Router
$ gcloud compute routers create my-router \
    --network=my-vpc \
    --region=us-central1 \
    --asn=65001

# Create VPN tunnels
$ gcloud compute vpn-tunnels create tunnel-0 \
    --region=us-central1 \
    --vpn-gateway=my-vpn-gw \
    --peer-external-gateway=peer-gw \
    --peer-external-gateway-interface=0 \
    --shared-secret="MySharedSecret123" \
    --router=my-router \
    --vpn-gateway-interface=0

# Configure BGP session
$ gcloud compute routers add-interface my-router \
    --region=us-central1 \
    --interface-name=tunnel-0-iface \
    --vpn-tunnel=tunnel-0 \
    --ip-address=169.254.0.1 \
    --mask-length=30

$ gcloud compute routers add-bgp-peer my-router \
    --region=us-central1 \
    --peer-name=peer-0 \
    --interface=tunnel-0-iface \
    --peer-ip-address=169.254.0.2 \
    --peer-asn=65002

Cloud Interconnect

Type Bandwidth Use Case
Dedicated Interconnect 10 Gbps – 200 Gbps Large data transfers, low latency
Partner Interconnect 50 Mbps – 50 Gbps Medium bandwidth, via partner 
# List interconnect locations
$ gcloud compute interconnects locations list

# Create a VLAN attachment (Partner Interconnect)
$ gcloud compute interconnects attachments partner create my-attachment \
    --region=us-central1 \
    --router=my-router \
    --edge-availability-domain=AVAILABILITY_DOMAIN_1

Comparison

Feature Private Google Access Private Service Connect Cloud VPN Interconnect
Use Case GCP APIs from internal VMs Private endpoints for APIs On-prem to GCP High-bandwidth hybrid
Scope Subnet-level Per-endpoint Tunnel-based Physical connection
Bandwidth Network throughput Network throughput 3 Gbps per tunnel 10–200 Gbps
Cost Free Endpoint charges Per tunnel/hour Port + VLAN charges

Common Mistakes

Mistake Why It’s Wrong Fix
No Private Google Access VMs can’t reach APIs Enable on all private subnets
Missing DNS for PSC Clients use public IPs Create private DNS zones
Single VPN tunnel No redundancy Create 2+ tunnels
No BGP with VPN Static routes, no failover Use Cloud Router + BGP
Interconnect without redundancy Single point of failure Use paired attachments

Quick Reference

Command Description
gcloud compute networks subnets update --enable-private-ip-google-access Enable PGA
gcloud compute forwarding-rules create --target-google-apis-bundle Create PSC endpoint
gcloud compute vpn-gateways create Create VPN gateway
gcloud compute vpn-tunnels create Create VPN tunnel
gcloud compute routers create Create Cloud Router

Next → Practice Exercises

Updated:

You may also enjoy