Configure Private Google Access
This page describes how to enable and configure Private Google Access. By default, when a Compute Engine VM lacks an external IP address assigned to its network interface, it can only send packets to other internal IP address destinations. You can allow these VMs to connect to the set of external IP addresses used by Google APIs and services by enabling Private Google Access on the subnet used by the VM's network interface.
Private Google Access also allows access to the external IP addresses used by App Engine, including third-party App Engine-based services.
To view the eligible APIs and services that you can use with Private Google Access, see Domain options.
For information about other private connectivity options offered by Google Cloud, including Private Service Connect and Private Google Access, see Private access options for services.
Specifications
A VM interface can send packets to the external IP addresses of Google APIs and services using Private Google Access if all these conditions are met:
The VM interface is connected to a subnet where Private Google Access is enabled.
The VPC network that contains the subnet meets the network requirements for Google APIs and services.
The VM interface does not have an external IP address assigned.
The source IP address of packets sent from the VM matches one of the following IP addresses.
- The VM interface's primary internal IPv4 address
- The VM interface's internal IPv6 address
- An internal IPv4 address from an alias IP range
A VM with an external IPv4 or IPv6 address assigned to its network interface doesn't need Private Google Access to connect to Google APIs and services. However, the VPC network must meet the requirements for accessing Google APIs and services.
Network requirements
Private Google Access has the following requirements:
If needed, you enable the API for the services that you want to access:
If you're accessing a Google API service endpoint, you must enable the API for that service.
For example, to create a Cloud Storage bucket through the storage.googleapis.com API service endpoint or a client library, you must enable the Cloud Storage API.
If you're accessing other types of resources, you might not need to enable any APIs.
For example, to access a Cloud Storage bucket in another project through its storage.googleapis.com URL, you don't need to enable the Cloud Storage API.
If you want to connect to Google APIs and services using IPv6, you must meet both of these requirements:
Your VM must be configured with a
/96IPv6 address range.The software running on the VM must send packets whose sources match one of those IPv6 addresses from that range.
- Depending on your chosen configuration, you might need to update DNS entries, routes, and firewall rules. For more information, see Summary of configuration options.
- Because Private Google Access is enabled on a per-subnet basis, you must use a VPC network. Legacy networks are not supported because they don't support subnets.
Permissions
Project owners, editors, and Identity and Access Management principals with the Network Admin role can create or update subnets and assign IP addresses.
For more information on roles, read the IAM roles documentation.
Logging
Cloud Logging captures all API requests made from VM instances in subnets that have Private Google Access enabled. Log entries identify the source of the API request as an internal IP address of the calling instance.
You can configure daily usage and monthly rollup reports to be delivered to a Cloud Storage bucket. See the Viewing Usage Reports page for details.
Summary of configuration options
The following table summarizes the different ways that you can configure Private Google Access. For more detailed configuration information, see Network configuration.
If you want to access Firestore with MongoDB compatibility API
(firestore.goog), see Configure Private Google Access in
Firestore with MongoDB
compatibility.
| Domain option | DNS configuration | Routing configuration | Firewall configuration |
|---|---|---|---|
| Default domains | You access Google APIs and services through their public IP addresses, so no special DNS configuration is required. | Ensure that your VPC network can route traffic to the IP address ranges that are used by Google APIs and services.
|
Ensure that your firewall rules allow egress to the IP address ranges used by Google APIs and services. The default allow egress firewall rule allows this traffic, if there is no higher priority rule that blocks it. |
private.googleapis.com
|
Configure DNS records in a private DNS zone to send requests to the following IP addresses: For IPv4 traffic:
For IPv6 traffic:
|
Ensure that your VPC network has routes to the following IP ranges: For IPv4 traffic:
For IPv6 traffic:
|
Ensure that your firewall rules allow egress to the following IP ranges: For IPv4 traffic:
For IPv6 traffic:
|
restricted.googleapis.com
|
Configure DNS records to send requests to the following IP addresses: For IPv4 traffic:
For IPv6 traffic:
|
Ensure that your VPC network has routes to the following IP ranges: For IPv4 traffic:
For IPv6 traffic:
|
Ensure that your firewall rules allow egress to the following IP ranges: For IPv4 traffic:
For IPv6 traffic:
|
Network configuration
This section describes the basic network requirements you must meet in order for a VM in your VPC network to access Google APIs and services.
Domain options
Choose the domain that you want to use to access Google APIs and services.
The private.googleapis.com and restricted.googleapis.com virtual IP
addresses (VIPs) support only HTTP-based protocols over TCP (HTTP, HTTPS, and HTTP/2). All other
protocols, including MQTT and ICMP, are not supported.
Interactive websites and features that use the internet—for example, for redirects or
retrieving content—are not supported.
| Domain and IP address ranges | Supported services | Example usage |
|---|---|---|
Default domains. All domain names for Google APIs and services except for
Various IP address ranges—you can determine a set of IP ranges that contains the possible addresses used by the default domains by referencing IP addresses for default domains. |