An enterprise is deploying backend application workloads on Compute Engine virtual machine (VM) instances in a dedicated subnet. For security compliance, the VMs are configured with only internal RFC 1918 IP addresses and must remain isolated from unsolicited inbound internet traffic. The workload architecture has the following egress requirements: VM instances must interact directly with Google Cloud services (such as Cloud Storage and BigQuery) without traffic traversing the public internet. VM instances must initiate outbound HTTPS requests to an external, third-party software-as-a-service (SaaS) API for real-time payment validation. Which combination of network configurations should you implement to satisfy these requirements?

Enable Private Google Access on the subnet and deploy a Cloud NAT gateway in the corresponding region.: ### What Private Google Access and Cloud NAT are **Private Google Access (PGA)** is a VPC subnet-level feature that enables VM instances without external IP addresses to reach the external IP addresses of **Google APIs and services** over Google's internal network backbone. **Cloud NAT (Network Address Translation)** is a distributed, software-defined managed service that enables instances without external IP addresses to send outbound packets to the internet while preventing external hosts from initiating direct inbound sessions. ### How it meets the requirements - **Internal Google API access:** Enabling **Private Google Access** on the subnet allows the application VMs to communicate with Cloud Storage, BigQuery, and other Google APIs using internal routing, ensuring traffic never traverses the public internet. - **Outbound SaaS API access:** Provisioning **Cloud NAT** allows the VMs to initiate outbound HTTPS connections to the third-party payment validation service using shared, managed NAT IPs. - **Inbound isolation:** Cloud NAT enforces stateful outbound-only connectivity, satisfying the requirement that external entities cannot initiate unsolicited inbound connections to internal VMs. ### Key advantages and capabilities - **No appliance bottlenecks:** Both Private Google Access and Cloud NAT are built directly into Andromeda (Google Cloud's software-defined network virtualization stack) without requiring intermediate proxy virtual machines. - **Subnet-level granularity:** PGA is toggled per subnet, keeping access controls modular and well-scoped. - **Predictable egress security:** Outbound internet traffic is routed securely without exposing private IP infrastructure to internet scans. - **Simplified routing:** Default internet gateway next-hops handle both PGA routing to Google services and NAT translation to external public IPs. ### Why this is optimal This approach leverages native, fully managed Google Cloud networking services that scale automatically with workload demand, require zero VM re-architecting, and strictly adhere to the principle of least exposure.