Your company runs containerized backend workloads on Cloud Run in the us-central1 region. These serverless applications must communicate securely with the following resources: Internal backend database instances hosted on Compute Engine virtual machines (VMs) with private RFC 1918 IP addresses in your Virtual Private Cloud (VPC) network. Google Cloud APIs accessed privately through a Private Service Connect (PSC) endpoint configured with a privately used external IP address inside the VPC network. All traffic between Cloud Run, the internal VMs, and Google APIs must traverse the VPC network without being routed over the public internet. How should you configure the Cloud Run networking architecture to satisfy these requirements?

Create a Serverless VPC Access connector in `us-central1` attached to the VPC network, configure the Cloud Run service to use the connector, and set the VPC egress setting to Route all traffic to the VPC.: ### What Serverless VPC Access with All-Traffic Egress is **Serverless VPC Access** allows serverless environments—such as **Cloud Run**, **Cloud Functions**, and **App Engine**—to initiate outbound connections to private resources in a Google Cloud **Virtual Private Cloud (VPC)** network. When creating a connector, it provisions lightweight connector VM instances inside an allocated subnet or CIDR range within your VPC. ### How it meets the requirements - **Internal VM communication**: Connecting the Cloud Run service to the **Serverless VPC Access connector** routes outbound network requests through the VPC, allowing seamless communication with **Compute Engine** instances on RFC 1918 private IPs. - **Private Service Connect (PSC) access**: By default, Serverless VPC Access only routes RFC 1918, RFC 6598, and specific default Google IP ranges. However, when connecting to a **Private Service Connect endpoint** utilizing a privately used external IP address, the egress setting must explicitly be configured to **Route all traffic to the VPC** (`all-traffic`). This guarantees that packets destined for non-RFC 1918 internal endpoints pass through the connector and into the VPC routing table rather than escaping directly to the public internet. - **Private transit**: Setting egress to route all traffic ensures no service-initiated egress bypasses the VPC boundary. ### Key advantages and capabilities - **Comprehensive IP routing**: Directs both RFC 1918 private addresses and privately used external IP ranges directly into the VPC. - **Elastic scaling**: Automatically scales connector instances between configured minimum and maximum instance counts based on throughput demand. - **Private Google API integration**: Seamlessly connects serverless compute with **Private Service Connect** and internal load balancers without exposing workloads externally. ### Why this is optimal This approach directly satisfies the need for private VPC connectivity while accommodating the architectural requirement of Private Service Connect endpoints assigned privately used external IP spaces.

StudyCerts

Cloud Run Serverless Vpc Access Psc Egress | Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam! | StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Cloud Run Serverless Vpc Access Psc Egress

Section: Cloud-native network configuration for compute resources (e.g., Compute Engine, GKE, serverless networking, and Google Cloud VMware Engine)

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

Your company runs containerized backend workloads on Cloud Run in the us-central1 region. These serverless applications must communicate securely with the following resources:

Internal backend database instances hosted on Compute Engine virtual machines (VMs) with private RFC 1918 IP addresses in your Virtual Private Cloud (VPC) network.
Google Cloud APIs accessed privately through a Private Service Connect (PSC) endpoint configured with a privately used external IP address inside the VPC network.

All traffic between Cloud Run, the internal VMs, and Google APIs must traverse the VPC network without being routed over the public internet.

How should you configure the Cloud Run networking architecture to satisfy these requirements?

Create a Serverless VPC Access connector in us-central1 attached to the VPC network, configure the Cloud Run service to use the connector, and set the VPC egress setting to Route all traffic to the VPC.

Configure a Cloud NAT gateway on the VPC subnet, associate the subnet with Cloud Run, and enable Private Google Access on the subnet without provisioning a connector.

Create an internal Application Load Balancer with a Private Service Connect backend NEG, and configure Cloud Run ingress to internal-and-cloud-load-balancing.

Create a Serverless VPC Access connector in us-central1 attached to the VPC network, configure the Cloud Run service to use the connector, and keep the default VPC egress setting to Route only requests to private IPs to the VPC.

Professional Cloud Architect

Cloud Run Serverless Vpc Access Psc Egress

Related questions