Question

Your company runs on-premises data-processing servers that must call Google Cloud APIs (Cloud Storage and BigQuery) without traversing the public internet. These servers connect to your VPC through an existing HA VPN tunnel and use only internal RFC 1918 addresses. You must ensure the on-premises hosts can reach the Google APIs privately through the tunnel using the default domains (e.g., storage.googleapis.com), with minimal ongoing management. What should you design?

Accepted Answer

Enable Private Google Access for on-premises hosts by routing the restricted.googleapis.com (199.36.153.4/30) range through the VPN and configuring Cloud DNS response policy zones to resolve Google API domains to that VIP range.

Answer

Enable Private Google Access on each subnet in the VPC and rely on the subnet setting to automatically extend private API access to the on-premises hosts over the VPN.

Answer

Assign public IP addresses to the on-premises servers and add firewall rules that allow egress only to the published Google API public IP ranges.

Answer

Create a Private Service Connect endpoint for each Google API and advertise the endpoint's public IP addresses to on-premises over the VPN via Cloud Router.