Question

A financial services company runs workloads in a custom-mode VPC with no external IP addresses and no default internet gateway route. Compliance requires that all access to Google APIs (such as Cloud Storage and BigQuery) use a specific, controllable internal IP address that can be referenced in on-prem DNS and firewall rules, rather than the default public API endpoints. They want a dedicated internal endpoint they fully control for reaching Google APIs. Which approach best meets this requirement?

Accepted Answer

Create a Private Service Connect endpoint for Google APIs, assigning it an internal IP address from the VPC that clients and on-prem systems target.

Answer

Enable Private Google Access on each subnet and continue using the default private.googleapis.com virtual IP.

Answer

Deploy a Cloud NAT gateway so instances can reach the public Google API endpoints without external IPs.

Answer

Set up VPC Network Peering between the workload VPC and a Google-managed services VPC to reach the APIs privately.