Configure Private Service Connect Endpoints

Sign in to the Google Cloud Management Console.

Select the Google Cloud Platform (GCP) project that you want to access from the top navigation bar.

Navigate to VPC network console available at https://console.cloud.google.com/networking.

In the navigation panel, select VPC networks to access the VPC networks created for the selected GCP project.

Copy the name of the VPC network that you want to examine, listed in the Name column.

Navigate to Network services console available at https://console.cloud.google.com/net-services.

In the navigation panel, choose Private Service Connect and select the CONNECTED ENDPOINTS tab.

In the Endpoints section, click inside the Filter box, select Network, paste the name of your VPC network copied at step no. 5, and press Enter to list only the endpoints configured for the selected VPC network. Check the Target column for an entry set to All Google APIs or Google APIs secured by VPC Service Controls. If no such endpoint is returned, Private Service Connect is not configured for Google APIs access for the selected VPC network.

Navigate to Cloud DNS console available at https://console.cloud.google.com/net-services/dns/zones.

Check whether a private managed zone for googleapis.com exists, is associated with the VPC network identified at step no. 5, and contains a record that resolves googleapis.com (or a wildcard *.googleapis.com) to the internal IP address of the Private Service Connect endpoint identified at step no. 8. If no such zone or record exists, DNS resolution for Google APIs is not configured to use the Private Service Connect endpoint.

Repeat steps no. 5 – 10 for each VPC network created for the selected project.

Repeat steps no. 2 – 11 for each GCP project deployed in your Google Cloud account.

Run projects list command (Windows/macOS/Linux) with custom query filters to list the IDs of the Google Cloud Platform (GCP) projects currently available in your Google Cloud account:

gcloud projects list
  --format="table(projectId)"

The command output should return the requested GCP project identifiers (IDs):

PROJECT_ID
cc-main-project-123123
cc-data-project-112233

Run compute networks list command (Windows/macOS/Linux) with the ID of the GCP project that you want to examine as identifier parameter and custom query filters to describe the name of each VPC network created within the selected project:

gcloud compute networks list
  --project cc-main-project-123123
  --format="table(name)"

The command output should return the names of the VPC networks created for the specified project:

NAME
tm-main-vpc-network
tm-project5-vpc

Run compute addresses list command (Windows/macOS/Linux) with custom filtering to check whether a Private Service Connect (PSC) internal IP address is reserved for your VPC network:

gcloud compute addresses list
  --project cc-main-project-123123
  --filter="purpose=PRIVATE_SERVICE_CONNECT AND network~tm-main-vpc-network"
  --format=json

The command output should return an array with the matching PSC addresses:

[]

If the compute addresses list command output returns an empty array, i.e. [], as shown in the example above, there is no Private Service Connect (PSC) address reserved for the selected VPC network, therefore the VPC network is not using Private Service Connect for Google APIs access. If the command output returns one or more addresses, note the reserved address (IP) value and proceed to the next step to verify the associated forwarding rule.

Run compute forwarding-rules list command (Windows/macOS/Linux) with the --global parameter to list the global forwarding rules configured within the selected project:

gcloud compute forwarding-rules list
  --project cc-main-project-123123
  --global
  --format=json

The command output should return an array with the configured global forwarding rules. Find the entry whose "IPAddress" attribute value matches the address identified at step no. 6, and check its "target" attribute value:

[
    {
        "name": "tmgoogleapis",
        "IPAddress": "10.2.0.20",
        "network": "https://www.googleapis.com/compute/v1/projects/cc-main-project-123123/global/networks/tm-main-vpc-network",
        "target": "https://www.googleapis.com/compute/v1/projects/cc-main-project-123123/global/targetGoogleApis/all-apis"
    }
]

The example above shows a compliant forwarding rule, since its "target" attribute value references all-apis. If the "target" attribute value of the matching forwarding rule does not reference all-apis or vpc-sc, the forwarding rule is not configured to provide Private Service Connect access to Google APIs.

Run dns managed-zones list command (Windows/macOS/Linux) with custom filtering to list the private Cloud DNS zones created for googleapis.com:

gcloud dns managed-zones list
  --project cc-main-project-123123
  --filter="dnsName=googleapis.com. AND visibility=private"
  --format=json

The command output should return an array with the matching private managed zones:

[]

If the dns managed-zones list command output returns an empty array, i.e. [], there is no private DNS zone configured for googleapis.com. If the command output returns one or more zones, check the "privateVisibilityConfig.networks" attribute value of each zone to determine if it is associated with the VPC network identified at step no. 4, and proceed to the next step to verify the zone's DNS records.

Run dns record-sets list command (Windows/macOS/Linux) to check whether the private zone identified at step no. 10 contains a record that resolves to the Private Service Connect endpoint IP address identified at step no. 6:

gcloud dns record-sets list
  --project cc-main-project-123123
  --zone=tm-googleapis-private-zone
  --format=json

The command output should return an array with the configured DNS records. Check the "rrdatas" attribute value of the A or CNAME record for googleapis.com (or *.googleapis.com) to confirm that it resolves to the Private Service Connect endpoint IP address identified at step no. 6. If no such record exists, or the record does not resolve to the PSC endpoint IP address, DNS resolution is not configured to use Private Service Connect for Google APIs.

Repeat steps no. 5 – 12 for each VPC network created for the selected project.

Repeat steps no. 3 – 13 for each GCP project deployed in your Google Cloud account.

Sign in to the Google Cloud Management Console.

Select the Google Cloud Platform (GCP) project that you want to access from the top navigation bar.

Navigate to Network services console available at https://console.cloud.google.com/net-services and choose Private Service Connect from the navigation panel.

Select the CONNECTED ENDPOINTS tab and choose CONNECT ENDPOINT to set up a new Private Service Connect (PSC) endpoint for Google APIs access.

On the Connect endpoint setup page, perform the following actions:

1. For Target, choose All Google APIs (or Google APIs secured by VPC Service Controls if your organization uses VPC Service Controls).
2. Enter a unique name for your new PSC endpoint in the Endpoint name box.
3. For Network, choose your VPC network.
4. Click inside the IP address box, choose CREATE IP ADDRESS, and reserve a new static internal IPv4 address.
5. Choose ADD ENDPOINT to deploy your new Private Service Connect (PSC) endpoint.

Navigate to Cloud DNS console available at https://console.cloud.google.com/net-services/dns/zones and choose CREATE ZONE.

On the Create a DNS zone page, perform the following actions:

1. For Zone type, choose Private.
2. Enter a unique name for your new zone in the Zone name box.
3. In the DNS name box, enter googleapis.com.
4. For Networks, choose the VPC network configured at step no. 5.
5. Choose CREATE to deploy your new private DNS zone.

Select your newly created zone, choose ADD STANDARD, and create an A record for googleapis.com and a CNAME record for *.googleapis.com that both resolve to the internal IP address of the Private Service Connect endpoint created at step no. 5.

Navigate to Firewall policies console available at https://console.cloud.google.com/net-security/firewall-manager/firewall-policies and create or update a firewall rule that restricts access to the Private Service Connect endpoint IP address to only the specific subnets or service accounts that require access to Google APIs.

If required, repeat steps no. 4 – 9 to create and configure new Private Service Connect endpoints for Google APIs access.

Repeat steps no. 2 – 10 for each GCP project deployed within your Google Cloud account.

Run compute addresses create command (Windows/macOS/Linux) with the --global and --purpose=PRIVATE_SERVICE_CONNECT parameters to reserve the internal IPv4 address required for the PSC endpoint:

gcloud compute addresses create tm-google-apis-ipv4
  --project cc-main-project-123123
  --global
  --purpose=PRIVATE_SERVICE_CONNECT
  --addresses=10.2.0.20
  --network=tm-main-vpc-network

The command output should return the internal IPv4 address URI:

Created [https://www.googleapis.com/compute/v1/projects/cc-main-project-123123/global/addresses/tm-google-apis-ipv4].

Run compute forwarding-rules create command (Windows/macOS/Linux) with the --target-google-apis-bundle parameter set to all-apis to create your new Private Service Connect (PSC) endpoint for Google APIs:

gcloud compute forwarding-rules create tmgoogleapis
  --project cc-main-project-123123
  --global
  --network=tm-main-vpc-network
  --address=tm-google-apis-ipv4
  --target-google-apis-bundle=all-apis

The command output should return the Private Service Connect (PSC) endpoint URI:

Created [https://www.googleapis.com/compute/v1/projects/cc-main-project-123123/global/forwardingRules/tmgoogleapis].

Run dns managed-zones create command (Windows/macOS/Linux) to create a private Cloud DNS zone for googleapis.com associated with your VPC network:

gcloud dns managed-zones create tm-googleapis-private-zone
  --project cc-main-project-123123
  --description="Private zone for Google APIs access via Private Service Connect"
  --dns-name=googleapis.com.
  --visibility=private
  --networks=tm-main-vpc-network

Run dns record-sets transaction commands (Windows/macOS/Linux) to add an A record for googleapis.com and a CNAME record for *.googleapis.com, both resolving to the internal IP address reserved at step no. 1:

gcloud dns record-sets transaction start
  --project cc-main-project-123123
  --zone=tm-googleapis-private-zone

gcloud dns record-sets transaction add 10.2.0.20
  --project cc-main-project-123123
  --zone=tm-googleapis-private-zone
  --name=googleapis.com.
  --ttl=300
  --type=A

gcloud dns record-sets transaction add googleapis.com.
  --project cc-main-project-123123
  --zone=tm-googleapis-private-zone
  --name="*.googleapis.com."
  --ttl=300
  --type=CNAME

gcloud dns record-sets transaction execute
  --project cc-main-project-123123
  --zone=tm-googleapis-private-zone

Run compute firewall-rules create command (Windows/macOS/Linux) to restrict access to the Private Service Connect endpoint IP address to only the subnets that require access to Google APIs:

gcloud compute firewall-rules create tm-allow-google-apis-access
  --project cc-main-project-123123
  --network=tm-main-vpc-network
  --direction=INGRESS
  --action=ALLOW
  --rules=tcp:443
  --source-ranges=10.2.1.0/24
  --destination-ranges=10.2.0.20/32

If required, repeat steps no. 1 – 7 to create and configure new Private Service Connect endpoints for Google APIs access.

Repeat steps no. 1 – 8 for each GCP project deployed in your Google Cloud account.