Private Service Connect

Private access to cloud services — Azure · AWS · GCP

Concept

Private Service Connect (PSC) allows private, RFC 1918 IP access to Google-managed and third-party services without traversing the public internet. The Azure equivalent is Private Link, and AWS uses VPC Endpoints / PrivateLink.

Cloud-native service access
Private Link / Private Endpoint
VPC Endpoint (Gateway / Interface)
Private Service Connect
Third-party services
Private Link Service
VPC Endpoint Service (PrivateLink)
Private Service Connect (published services)
Consumer IP
Private IP in your VNet
Private IP in your VPC
Private IP in your VPC subnet
Cross-org/account
Yes (Private Link across tenants)
Yes (PrivateLink across accounts)
Yes (PSC across organizations)
Data on Google backbone
N/A
N/A
Yes (always on Google network)
NAT Required
No (direct private IP)
No (direct private IP)
Yes (PSC NAT subnet /28 per region)

Create PSC Service Attachment (GCP Producer)

# Producer creates service attachment
gcloud compute service-attachments create my-svc-attach \
  --region=us-central1 \
  --producer-forwarding-rule=my-forwarding-rule \
  --connection-preference=ACCEPT_AUTOMATIC \
  --nat-subnets=psc-nat-subnet

# Consumer creates endpoint
gcloud compute forwarding-rules create psc-endpoint \
  --region=us-central1 \
  --network=consumer-vpc \
  --address=172.16.1.100 \
  --target-service-attachment=projects/producer-project/regions/us-central1/serviceAttachments/my-svc-attach

Side-by-Side CLI

○ Azure — Azure Private Link

az network private-endpoint create \
  --name myPE --resource-group prod-rg \
  --vnet-name myVNet --subnet mySubnet \
  --private-connection-resource-id \
  /subscriptions/.../storageAccounts/myblob \
  --group-id blob

○ AWS — AWS VPC Endpoint

aws ec2 create-vpc-endpoint \
  --vpc-id vpc-xxx \
  --service-name \
  com.amazonaws.region.s3 \
  --vpc-endpoint-type Gateway \
  --route-table-ids rtb-xxx

○ GCP — GCP PSC

gcloud compute forwarding-rules create \
  psc-ep --region=us-central1 \
  --network=my-vpc \
  --target-service-attachment=\
  projects/PROD/regions/us-central1/\
  serviceAttachments/my-attach