Question

A financial services company runs a fleet of Compute Engine VMs in a subnet with no external IP addresses for security compliance. These VMs must upload processed reports to Cloud Storage and pull secrets from Secret Manager, but all traffic to Google APIs must stay off the public internet and no Cloud NAT egress is permitted. What should the architect configure to enable this access?

Accepted Answer

Enable Private Google Access on the subnet so VMs can reach Google APIs and services through internal routing without external IPs.

Answer

Deploy a Cloud NAT gateway in the region so the VMs can egress to the public Google API endpoints.

Answer

Assign ephemeral external IP addresses to each VM and restrict egress with firewall rules to Google API ranges.

Answer

Create a VPC peering connection between the subnet and the Google-managed services VPC to reach the APIs.