Private Access: The Backdoor Keys

In a modern cloud architecture, you constantly consume services: Cloud SQL, MongoDB Atlas, Snowflake, or even Google’s own APIs. The naive way to connect is over the public internet. The professional way is to keep it private.

The Trio of Private Connectivity

Google Cloud offers three distinct ways to do this, and mixing them up is a guaranteed way to fail the exam.

1. Private Google Access (PGA) -> “I need to reach Google Storage”
  • Direction: From VPC -> Google APIs (Public).
  • Mechanism: Routing trickery. Traffic is sent to private.googleapis.com but stays on Google’s backbone.
  • Target: Google services without private IPs (Storage, BigQuery, Pub/Sub).
2. Private Service Access (PSA) -> “I need to reach Cloud SQL”
  • Direction: From VPC -> Google Managed Service (Private).
  • Mechanism: VPC Peering.
  • How it works: You allocate a /24 range (e.g., 10.50.0.0/24) and give it to Google. Google creates a VPC for your Cloud SQL instance using that range and peers it back to you.
  • The Catch: It relies on Peering, so Transitivity rules apply! If you have a Hub-and-Spoke topology, the Spokes cannot reach Cloud SQL in the Hub unless you engage in complex export/import of custom routes.
3. Private Service Connect (PSC) -> “The Modern Standard”
  • Direction: From VPC -> Any Service (Google, Partner, or Your Own).
  • Mechanism: NAT / Forwarding Rule.
  • How it works: You create an endpoint (IP address) inside your subnet (e.g., 10.0.0.99). Any traffic sent to .99 is NAT’d and forwarded to the service attachment.
  • The Benefit: It is transitive (because it’s just an IP in your subnet). It doesn’t use Peering. It solves the IP overlap problem perfectly.

Serverless VPC Access

What if you are running a Cloud Function (Serverless) and it needs to talk to that private Cloud SQL instance? Cloud Functions live outside your VPC.

  • The Bridge: Serverless VPC Access Connector.
  • It creates a hidden group of VMs (Connector instances) inside your VPC.
  • Your Cloud Function tunnels through these connector instances to reach the RFC1918 IPs of your database.

Exam Tip: If the question mentions “IP overlap” or “Connecting to a 3rd party SaaS,” the answer is Private Service Connect (PSC). If it mentions “Connecting to Cloud SQL managed service,” it is historically PSA, but PSC is supported there too now. Stick to PSA for legacy data services unless specified otherwise.

Related Posts