Question

A team runs a fleet of Compute Engine VMs in a subnet named 'batch-workers' with no external IP addresses. The VMs must upload processed files to Cloud Storage and read from BigQuery using the standard public API endpoints (storage.googleapis.com and bigquery.googleapis.com). Currently the uploads fail with connection timeouts. There is no Cloud NAT gateway, and the organization forbids assigning external IPs to these VMs. What is the minimal configuration change to allow the API calls to succeed?

Accepted Answer

Enable Private Google Access on the 'batch-workers' subnet.

Answer

Deploy a Cloud NAT gateway in the region so the VMs can reach the public API endpoints.

Answer

Create a Private Service Connect endpoint for each Google API and update DNS to resolve the endpoints internally.

Answer

Configure private services access with an allocated IP range peered to the Google-managed service network.