Question

A financial services company runs on-premises servers connected to a Google Cloud VPC through a Dedicated Interconnect. These servers must call Cloud Storage and BigQuery APIs, but corporate security policy forbids any traffic to Google APIs from traversing the public internet, and the on-premises hosts have no external IPs. DNS resolution for googleapis.com currently returns public IP addresses. What should the security engineer configure to meet these requirements?

Accepted Answer

Enable Private Google Access for on-premises hosts by creating Cloud DNS response policies (or private zones) that resolve *.googleapis.com to the restricted.googleapis.com VIP range (199.36.153.4/30) and add routes over the Interconnect toward that range.

Answer

Assign external IP addresses to the on-premises servers and rely on Cloud Armor to restrict which Google API endpoints they can reach.

Answer

Enable Private Google Access on the subnets where the on-premises hosts reside, since Private Google Access automatically applies to any host reachable over the Interconnect.

Answer

Deploy Cloud NAT in the VPC and route on-premises API traffic through it so the servers reach googleapis.com public endpoints via a shared egress IP.