Private Service Connect (PSC) is a Google Cloud networking capability that allows on-premises systems to reach Google APIs and services using internal IP addresses without crossing the public internet. Network administrators deploy PSC endpoints directly inside subnets of a Virtual Private Cloud (VPC) network. Traffic originating from on-premises hosts travels across a dedicated Cloud Interconnect or Cloud VPN connection, arrives at the VPC network, and targets the PSC endpoint's assigned internal IP address. The PSC endpoint then forwards the request directly to the target managed service, such as Vertex AI, keeping all data within Google's private network backbone.
VPC Service Controls works alongside PSC to establish security perimeters that prevent sensitive data from leaving authorized environments. When a perimeter encloses the services accessed through PSC, it evaluates every request against identity and network access policies before granting entry. The perimeter blocks unauthorized requests even if they successfully reach the PSC internal IP address from an on-premises network. Combining these technologies ensures that workloads can communicate privately with Google services while enforcing strict boundaries against data exfiltration.
Deploying PSC endpoints with VPC Service Controls requires specific configuration dependencies. The chosen VPC subnet must have sufficient available IP address space to assign to the endpoint. The VPC Service Controls perimeter configuration must explicitly include both the PSC endpoint and the target Google Cloud managed services. In addition, Identity and Access Management (IAM) policies must grant the appropriate service accounts and principals permission to use the PSC communication path.
Private Google Access for on-premises hosts allows systems outside Google Cloud to reach Google services without routing traffic over the public internet. This architecture directs API calls across hybrid connections, such as Cloud Interconnect or Cloud VPN, directly into a VPC network. By keeping traffic off public routes, organizations maintain secure network boundaries while accessing managed services like Vertex AI.
Cloud Router uses custom Border Gateway Protocol (BGP) route advertisements to publish Google service Virtual IP (VIP) address ranges to on-premises routing equipment. Administrators configure Cloud Router to broadcast the IP address ranges assigned to private.googleapis.com and restricted.googleapis.com across the hybrid link. When an on-premises application resolves a Google service name to one of these VIP ranges, the local router identifies the matching BGP route advertisement. The router then sends the traffic over the Cloud Interconnect or Cloud VPN link straight to Google Cloud.
On-premises applications accessing Google Cloud APIs must complete identity verification and hold proper IAM permissions before executing requests. Workloads authenticate by using Application Default Credentials (ADC) paired with workload identity federation or by assuming dedicated service accounts. After identity verification succeeds, the caller must possess required IAM permissions, such as the Service Usage Consumer role (roles/serviceusage.serviceUsageConsumer), to consume project resources and interact with Vertex AI. Applying the principle of least privilege ensures that on-premises identities only access the exact services necessary for their workloads.
High-availability hybrid connectivity maintains uninterrupted API routing by protecting against individual hardware failures or local network disruptions. Resilient architectures deploy redundant Cross-Site Interconnect connections in the same metropolitan area across distinct edge availability domains. Configuring and managing these hybrid infrastructure components requires administrative privileges, such as the Compute Network Admin role (roles/compute.networkAdmin). When a primary physical link fails, the secondary connection maintains active BGP sessions with Cloud Router to preserve the API traffic path without downtime.
Hybrid DNS forwarding is a routing design that allows on-premises systems to resolve Google service domain names directly to private Google VIP addresses. This design uses a combination of on-premises DNS rules and Google Cloud DNS settings to translate public domain names into private destination addresses. Consequently, hybrid workloads resolve domains like *.googleapis.com to internal routes rather than public internet addresses.
Hybrid DNS infrastructure connects on-premises name resolution systems directly to Google Cloud DNS. The architecture requires a Cloud DNS inbound server policy applied to a VPC network, which instructs Cloud DNS to listen for and respond to DNS queries sent from on-premises IP ranges. On-premises DNS servers are configured with conditional forwarding rules that match Google domain names, such as *.googleapis.com. When an on-premises client initiates an API request, the local DNS server intercepts the query and forwards it across the hybrid network connection to
Professional Cloud Network Engineer
Prepare and test your skills
Prepare and test your skills
StudyCerts
StudyCerts