Question

A retail company runs a centralized network team that manages a Shared VPC in a host project. Application teams deploy Compute Engine instances into their own service projects. A new application team reports that after their service project was attached to the Shared VPC, their engineers cannot create instances that use the shared subnets, even though the instances appear in the network topology. The network team confirmed the subnets exist and that firewall rules permit the required traffic. What is the most likely cause and the correct fix?

Accepted Answer

The service project engineers lack the Compute Network User (roles/compute.networkUser) role on the specific shared subnets or host project; grant it at the subnet or host-project level.

Answer

VPC Peering has not been established between the host and service projects; create a peering connection to allow subnet sharing.

Answer

The service project must be converted into a host project so it can own the subnets directly.

Answer

Private Google Access is disabled on the subnets; enable it so instances can be provisioned into the shared subnets.