Question

A financial services company runs an internal HTTP(S) API on Compute Engine instances in a producer VPC. Multiple consumer teams in separate VPCs, plus an on-premises data center connected via Cloud Interconnect, need to reach this API. Security requires that all traffic stay on Google's private network with no exposure to the internet, and that the producer team explicitly control which consumer projects can connect. Which approach best meets these requirements?

Accepted Answer

Publish the internal API behind an internal load balancer as a Private Service Connect service attachment with an explicit consumer accept list, and have each consumer create a PSC endpoint; on-premises reaches the endpoint over the existing Interconnect.

Answer

Assign external IP addresses to the backend instances and restrict access using Cloud Armor security policies scoped to the consumer and on-premises IP ranges.

Answer

Create VPC Network Peering between the producer VPC and every consumer VPC, and advertise the load balancer route to on-premises via Cloud Router.

Answer

Configure Private Google Access on all consumer subnets and expose the API through a Cloud NAT gateway shared across the projects.