Question

A retail company runs a Compute Engine application tier in a custom-mode VPC. They are provisioning a new Cloud SQL for PostgreSQL instance and require that all traffic between the application VMs and the database stay on Google's internal network, with no public IP exposure on the database. The application VMs must connect using a private IP address. What must the architect configure to enable this connectivity?

Accepted Answer

Enable a private services access connection by allocating an internal IP range and creating a VPC peering with the Google-managed services producer network, then create the Cloud SQL instance with private IP only.

Answer

Deploy the Cloud SQL Auth Proxy on each VM and connect over the instance's public IP, relying on the proxy's TLS tunnel to keep traffic internal.

Answer

Create a Serverless VPC Access connector in the VPC and attach it to the Cloud SQL instance so VMs route database traffic through the connector.

Answer

Configure Cloud NAT in the VPC and disable the public IP on the Cloud SQL instance so outbound traffic is translated to a private path.