Question

A retail company runs a Cloud Run service that must query a Cloud SQL for PostgreSQL instance and a Memorystore for Redis instance, both of which only expose private IP addresses inside a VPC. Security policy forbids assigning public IPs to any backend resource. What is the recommended way to allow the Cloud Run service to reach these private resources?

Accepted Answer

Configure a Serverless VPC Access connector and route the service's egress to the VPC where the private resources reside

Answer

Enable Private Google Access on the VPC subnet so Cloud Run can reach the private IPs

Answer

Create a Cloud NAT gateway and route Cloud Run traffic through it to the private resources

Answer

Set up VPC Network Peering between the Cloud Run service and the VPC hosting the resources