When securing communications in Google Cloud, two primary methods for establishing private connectivity to Google APIs are Restricted Google Access and Private Service Connect (PSC) . Both are designed to keep traffic off the public internet and within Google's network, but they serve different security models and architectural needs.
Restricted Google Access is a security-focused configuration that uses the restricted.googleapis.com domain. This method limits API access to only a specific subset of Google services that are compatible with VPC Service Controls. It is a prerequisite for enabling service perimeters, as it helps mitigate data exfiltration risk by blocking access to other Google APIs not related to Google Cloud. In practice, you configure DNS so that requests to *.googleapis.com resolve to the restricted.googleapis.com domain, which points to a reserved set of internal IP addresses (199.36.153.8/30). This ensures that traffic from your VMs or on-premises hosts can only reach approved services.
Private Service Connect (PSC) provides a more flexible and service-oriented model for private connectivity. It allows you to create internal endpoints within your VPC network that act as private gateways to Google-managed services. With PSC, you consume services—whether Google APIs like BigQuery or third-party SaaS offerings—as if they were hosted directly within your VPC. This creates a unidirectional, authorized connection where the consumer can only access the specific service endpoint's IP address, not the producer's entire network. PSC is ideal for scenarios requiring granular access control, centralized traffic inspection, or connectivity from on-premises systems over hybrid links.
The key distinction lies in their security approach and use cases. Restricted Google Access is fundamentally about limiting which APIs can be accessed, enforcing a strict allowlist at the DNS level. It is often used as a foundational control for environments with sensitive data protected by VPC Service Controls. Private Service Connect, conversely, is about enabling secure, private consumption of a broader range of services. It abstracts the service behind a private IP in your VPC, which can be integrated with your own load balancers, security policies, and DNS zones for enhanced control and observability.
Choosing between them depends on your security requirements. If your primary goal is to enforce a service perimeter and block all non-essential Google APIs, Restricted Google Access is necessary. If you need to privately and securely consume specific Google or third-party services with more flexibility—such as applying custom certificates, routing traffic through internal firewalls, or accessing services from on-premises—then Private Service Connect is the preferred solution. They are not mutually exclusive and can be used together in a layered security strategy.
Private Google Access and Private Service Connect are key methods for establishing secure, private connectivity between Google Cloud VPC networks and Google APIs without exposing traffic to the public internet.
To implement Private Google Access for on-premises hosts, organizations must establish dedicated connectivity through Cloud Interconnect or VPN tunnels. This setup allows on-premises systems to access Google APIs using private IP addresses rather than traversing the public internet. The configuration requires specific route advertisements that direct API traffic through Google's private network access points, ensuring complete isolation from external networks.
Key implementation steps include:
Private Service Connect enables consumers to access managed services privately from within their VPC network. It provides two primary endpoint types: endpoints for Google APIs and endpoints for published services. This method allows organizations to use customized endpoint names with internal IP addresses, giving fine-grained control over network architecture while maintaining complete privacy of network traffic.
The benefits include:
Restricted Google Access provides additional security by limiting which Google APIs can be accessed and from which networks. When combined with VPC Service Controls, organizations can create secure perimeters that guard against data exfiltration while maintaining granular control over API access. This approach is particularly valuable for organizations handling sensitive data that must remain within specific network boundaries.
Private Google Access is a networking capability that allows Compute Engine virtual machines without external IP addresses to securely reach Google APIs and services. By default, a virtual machine that only possesses a private internal IP address cannot communicate outside its Virtual Private Cloud network. Enabling this feature at the subnet level allows instances to send traffic to Google services through internal Google network paths instead of traversing the public internet. Traffic directed through Private Google Access never leaves Google's dedicated production network, ensuring strong isolation and communication privacy.
To function correctly, several architectural specifications and prerequisites must be satisfied within the network environment. The calling virtual machine must originate traffic from an eligible source, such as its primary internal IPv4 address, an internal IPv6 address, or an alias IP range. Furthermore, the targeted Google Cloud APIs must be enabled within the project, and the subnets must reside inside a modern custom mode or auto mode VPC rather than an unsupported legacy network. Because administrators frequently enforce organizational policies to block public IP assignment on compute instances, Private Google Access serves as the primary mechanism for workloads to access services like Cloud Storage and BigQuery while preventing unauthorized internet exposure.
Configuring network routes properly is essential to route API calls over internal Google infrastructure without establishing general internet connectivity. Traffic destined for Google services must use a route whose next hop is configured as the default internet gateway, even though no external communication actually takes place. In restricted environments where the default route (0.0.0.0/0) is deleted to prevent internet access, administrators must establish custom static routes targeting specific destination IP ranges with the default internet gateway as the next hop:
StudyCerts
StudyCerts199.36.153.8/30 for private.googleapis.com or 199.36.153.4/30 for restricted.googleapis.com34.126.0.0/18 (IPv4) and 2001:4860:8040::/42 (IPv6) for high-performance services that bypass Google Front EndsNetwork security policies and domain name resolution must align with private routing to prevent communication failures and mitigate data exfiltration risks. While the default implied egress firewall permits outbound traffic, hardened enterprise environments often implement a broad egress deny rule to block all outbound traffic to 0.0.0.0/0. To maintain private access under these restrictions, engineers must create high-priority egress allow rules targeting the designated VIP and direct connectivity ranges on TCP port 443. Additionally, configuring a Cloud DNS private zone for googleapis.com maps API requests to either private.googleapis.com or restricted.googleapis.com, where the restricted domain actively denies access to services that are not supported by VPC Service Controls boundaries.
Professional Cloud Security Engineer
Gauge your current knowledge
Gauge your current knowledge