Build and operate the data processing systems behind analytics and ML on Google Cloud, including BigQuery, Dataflow, and Pub/Sub, and track your readiness for the Professional Data Engineer exam.
Advanced
Prepare and test your skills
Advanced
Prepare and test your skills
Google Cloud feature
Private Google Access
Topic in 3 exam domains
- Private Google Access · Feature
- private Google access · Feature · VPC feature
Also called: Google Private Access, PGA, private access to the Google Cloud APIs, Private Google Access for on-premises hosts
A networking feature that allows VMs and Pods with internal IP addresses to reach Google APIs and services without public IPs.
Where this appears on the exam
2 objectives in 2 of 5 domains
Related topics
FoundationsThis topicWorks alongsideAppliedCloud VPNServiceVPC Service ControlsServiceApplication Default CredentialsFeatureManaged Service for Apache AirflowService
Private Google AccessFeature
BigQueryServiceCloud LoggingServiceCloud MonitoringServicePub/SubServicePrivate Service ConnectFeatureCloud NATServiceArtifact RegistryServiceGKEServiceCloud InterconnectServiceVirtual Private CloudServiceManaged Service for Apache SparkServiceDataflowServiceCompute EngineServiceCloud Data FusionServicePoints to what builds on itWorks with or alternative toHover or tap a line to see what connects the two
- Private Google Access is an alternative to Private Service Connect From the official documentation: “Private Service Connect to access Google APIs is an alternative to using Private Google Access or the public domain names for Google APIs.”
- Managed Service for Apache Spark depends on Private Google Access From the official documentation: “Managed Service for Apache Spark batch workloads and interactive sessions run on VMs with internal IP addresses only and on a regional subnet with [Private Google Access (PGA)](/vpc/docs/configure-private-google-access) enabled automatically on the subnet.”
- Cloud NAT is an alternative to Private Google Access From the official documentation: “If you disable public IP addresses, you must set up Private Google Access or Cloud NAT on your network.”
- Artifact Registry works with Private Google Access From the official documentation: “Clusters are automatically configured with [Private Google Access](/vpc/docs/private-google-access), which, for example, permits clusters to pull images from Artifact Registry.”
- Cloud Interconnect works with Private Google Access From the official documentation: “With Private Google Access, your on-premises or Google Cloud VMware Engine hosts connect to Google Cloud APIs through a Cloud VPN tunnel or Cloud Interconnect.”
- Managed Service for Apache Spark works with Private Google Access From the official documentation: “Managed Service for Apache Spark automatically enables Private Google Access on the regional subnet used by Managed Service for Apache Spark clusters created with image version `2.2` and later.”
- Private Google Access depends on Cloud VPN From the official documentation: “Optional: [Configure Private Google Access to let your Pods access Google Cloud APIs and services by using Cloud VPN](/vpc/docs/configure-private-google-access-hybrid).”
- Cloud Logging works with Private Google Access From the official documentation: “Cloud Logging captures all API requests made from VM instances in subnets that have Private Google Access enabled.”
- Cloud VPN works with Private Google Access From the official documentation: “With Private Google Access, your on-premises or Google Cloud VMware Engine hosts connect to Google Cloud APIs through a Cloud VPN tunnel or Cloud Interconnect.”
- BigQuery works with Private Google Access From the official documentation: “Secure API access | Private Google Access | Lets workers reach Cloud Storage and BigQuery privately.”
- Cloud Data Fusion depends on Private Google Access From the official documentation: “To [access resources through internal IP addresses](/dataproc/docs/concepts/configuring-clusters/network#create_a_cluster_with_internal_ip_addresses_only), Cloud Data Fusion must create the Managed Service for Apache Spark clusters and run the data pipelines in a subnet that…”
- Cloud Monitoring works with Private Google Access From the official documentation: “To make sure that your VM can access Google Cloud APIs and services, such as Cloud Monitoring, without needing an internet route you must enable Private Google Access for the VM's subnet.”
- Compute Engine depends on Private Google Access From the official documentation: “Enable [Private Google Access](/database-migration/docs/postgresql-to-alloydb/vpc/docs/configure-private-google-access#enabling-pga) on the subnet used for the proxy. This is required to allow the Compute Engine instance to download the necessary Docker images from the Google…”
- Compute Engine works with Private Google Access From the official documentation: “Compute Engine instance with only an internal IP address tries to reach the external IP address of Google APIs and services, but Private Google Access is not enabled in the instance's subnet.”
- Dataflow depends on Private Google Access From the official documentation: “Workflow failed. Causes: Subnetwork SUBNETWORK on project PROJECT_ID network NETWORK in region REGION does not have Private Google Access, which is required for usage of private IP addresses by the Dataflow workers.”
- Dataflow works with Private Google Access From the official documentation: “Enable Private Google Access and specify one of the following options in your Dataflow job:”
- GKE works with Private Google Access From the official documentation: “When a cluster or node pool is created or updated with the `--enable-private-nodes` flag, GKE automatically enables Private Google Access on this subnet.”
- Managed Service for Apache Spark configures Private Google Access From the official documentation: “Managed Service for Apache Spark enables [Private Google Access (PGA)](/vpc/docs/private-google-access) on the specified subnet.”
- Private Google Access configures Dataflow From the official documentation: “However, to allow Dataflow workers with private IP addresses to access the external IP addresses that Google Cloud APIs and services use, you must also manually enable Private Google Access for the subnet.”
- Cloud Interconnect is an alternative to Cloud VPN From the official documentation: “Accessible by using hybrid connectivity (Cloud Interconnect or Cloud VPN).”
- Application Default Credentials secures BigQuery From the official documentation: “To authenticate to BigQuery, set up Application Default Credentials.”
- BigQuery depends on Application Default Credentials From the official documentation: “To authenticate to BigQuery, set up Application Default Credentials.”
- Dataflow depends on Application Default Credentials From the official documentation: “To authenticate to Dataflow, set up Application Default Credentials.”
- Application Default Credentials works with Pub/Sub From the official documentation: “To authenticate to Pub/Sub, set up Application Default Credentials.”
- BigQuery works with Cloud Logging From the official documentation: “BigQuery utilizes Cloud Logging for some of your log data.”
- Application Default Credentials works with BigQuery From the official documentation: “Create a BigQuery client using application default credentials.”
- Application Default Credentials secures Pub/Sub From the official documentation: “To authenticate to Pub/Sub, set up Application Default Credentials.”
- Pub/Sub depends on Application Default Credentials From the official documentation: “To authenticate to Pub/Sub, set up Application Default Credentials.”
- BigQuery works with Dataflow From the official documentation: “Read from BigQuery to Dataflow”
- Application Default Credentials works with Dataflow From the official documentation: “To authenticate to Dataflow, set up Application Default Credentials.”
- Application Default Credentials works with Compute Engine From the official documentation: “To authenticate to Compute Engine, set up Application Default Credentials.”
- VPC Service Controls secures BigQuery From the official documentation: “BigQuery data is protected with VPC Service Controls”
- BigQuery works with Cloud Monitoring From the official documentation: “You can use Monitoring to export your metrics to BigQuery.”
- Dataflow works with Pub/Sub From the official documentation: “Pub/Sub notifies Dataflow about the upload.”
- Cloud Data Fusion works with Managed Service for Apache Spark From the official documentation: “Deployed Cloud Data Fusion pipelines run on Managed Service for Apache Spark clusters by default.”
- Application Default Credentials secures Compute Engine From the official documentation: “To authenticate to Compute Engine, set up Application Default Credentials.”
- BigQuery is an alternative to Pub/Sub From the official documentation: “To keep audit logs for a longer period of time or to use more powerful search capabilities, you can route copies of your audit logs to Cloud Storage, BigQuery, or Pub/Sub.”
- Cloud Logging works with GKE From the official documentation: “Enable Cloud Logging on GKE Clusters”
- Compute Engine is an alternative to GKE From the official documentation: “To use TPU7x, you can use Google Kubernetes Engine (GKE) or Compute Engine.”
- Cloud Monitoring depends on Application Default Credentials From the official documentation: “To authenticate to Monitoring, set up Application Default Credentials.”
- Cloud Monitoring works with GKE From the official documentation: “Enable Cloud Monitoring on GKE Clusters”
- Dataflow works with Managed Service for Apache Airflow From the official documentation: “Launch Dataflow pipelines with Cloud Composer”
- BigQuery works with Managed Service for Apache Spark From the official documentation: “This means you can quickly read and write BigQuery data to and from Managed Service for Apache Spark.”
- BigQuery works with Pub/Sub From the official documentation: “createBigQuerySubscription creates a Pub/Sub subscription that exports messages to BigQuery.”
- Cloud Interconnect works with Cloud VPN From the official documentation: “You must enable high-availability (HA) VPN functionality when using Cloud Interconnect<br>with Cloud VPN.”
- Cloud Logging works with Managed Service for Apache Airflow From the official documentation: “You can use [Cloud Monitoring](/monitoring/docs) and [Cloud Logging](/logging/docs) with Managed Service for Apache Airflow.”
- Application Default Credentials secures Dataflow From the official documentation: “To authenticate to Dataflow, set up Application Default Credentials.”
- BigQuery works with Managed Service for Apache Airflow From the official documentation: “You can use Managed Airflow to orchestrate services in your data pipelines, such as triggering a job in BigQuery or starting a Dataflow pipeline.”
- Cloud Monitoring works with Managed Service for Apache Airflow From the official documentation: “You can use [Cloud Monitoring](/monitoring/docs) and [Cloud Logging](/logging/docs) with Managed Service for Apache Airflow.”
- BigQuery is an alternative to Managed Service for Apache Spark From the official documentation: “Run queries against your federated data using BigQuery or Managed Service for Apache Spark.”
- Cloud Logging depends on Application Default Credentials From the official documentation: “To authenticate to Logging, set up Application Default Credentials.”
- Cloud Logging works with Pub/Sub From the official documentation: “Pub/Sub writes various log entries to Cloud Logging in the Google Cloud console.”
- Cloud Monitoring works with Dataflow From the official documentation: “Dataflow is fully integrated with Cloud Monitoring.”
- Cloud VPN works with Virtual Private Cloud From the official documentation: “If you are connecting to a Virtual Private Cloud (VPC) network by using Cloud VPN, the Pod and Service CIDR blocks must not conflict with any CIDR blocks on your VPC network.”
- Dataflow is an alternative to Managed Service for Apache Spark From the official documentation: “For more complex data loads into your Cloud SQL for PostgreSQL database, consider using Dataflow or Managed Service for Apache Spark, which involves creating an ETL process.”
- VPC Service Controls secures Managed Service for Apache Airflow From the official documentation: “Managed Airflow can be selected as a secured service inside a VPC Service Controls perimeter.”
- Application Default Credentials works with Managed Service for Apache Spark From the official documentation: “To authenticate to Managed Service for Apache Spark, set up Application Default Credentials.”
- Application Default Credentials secures Managed Service for Apache Spark From the official documentation: “To authenticate to Managed Service for Apache Spark, set up Application Default Credentials.”
- Artifact Registry is an alternative to Cloud NAT From the official documentation: “You can download the image and push to Artifact Registry or use [Cloud NAT](/nat/docs/overview) to provide outbound internet access for certain private nodes.”
- Artifact Registry works with Compute Engine From the official documentation: “Compute Engine can pull containers directly from Artifact Registry repositories.”
How learners score on this topic
Last updated