Question

A financial services company runs Compute Engine instances in a VPC with no external IP addresses and an organization policy that blocks external IPs. The instances must reach Google APIs such as Cloud Storage and BigQuery, but the security team requires that traffic use a private internal IP endpoint that they fully control and can reference in firewall rules and DNS, rather than the default public API domains. They also want to avoid routing this traffic over the internet or through Cloud NAT. Which approach meets these requirements?

Accepted Answer

Create a Private Service Connect endpoint for Google APIs with a consumer internal IP address, and configure DNS so API requests resolve to that endpoint

Answer

Enable Private Google Access on the subnet so instances can reach the default Google API public IP ranges without external addresses

Answer

Deploy Cloud NAT and restrict egress firewall rules to only Google's published API IP ranges

Answer

Configure a VPC Service Controls perimeter around the project to force API traffic onto internal IP addresses