Question

A SaaS provider hosts a multi-tenant analytics application behind an internal load balancer in their own VPC. Your company wants to consume this service from your VPC without exposing traffic to the public internet, without overlapping RFC 1918 ranges between the two VPCs, and without requiring VPC peering that would expose your entire network to the provider. Which solution should you implement?

Accepted Answer

Create a Private Service Connect endpoint in your VPC that targets the service attachment the provider published from their internal load balancer.

Answer

Establish VPC Network Peering between your VPC and the provider's VPC and add firewall rules to restrict traffic to the load balancer IP.

Answer

Configure a Cloud VPN tunnel between your VPC and the provider's VPC and advertise only the load balancer subnet via Cloud Router.

Answer

Use Private Service Connect for Google APIs with a private.googleapis.com endpoint to reach the provider's service.