Associate Cloud Engineer

By Google · Question Mode

QuestionQ5

Configuring access and security

You are hosting an application on bare-metal servers in your own data center. The application needs access to Cloud Storage. However, security policies prevent the servers hosting the application from having public IP addresses or access to the internet. You want to follow Google-recommended practices to provide the application with access to Cloud Storage. What should you do?

Explanation

Google's documented solution for this scenario is Private Google Access for on-premises hosts. It requires establishing private connectivity between the on-premises network and a Google Cloud VPC using Cloud VPN or Cloud Interconnect, then using Cloud Router to advertise a custom route for the restricted.googleapis.com virtual IP range (199.36.153.4/30) over that tunnel so on-premises traffic destined for Google APIs is routed privately rather than over the public internet. On the on-premises side, DNS must be configured so that requests to *.googleapis.com (including storage.googleapis.com) resolve via a CNAME to restricted.googleapis.com, which resolves to the 199.36.153.4/30 VIP range. Because this IP range is never announced publicly and is only reachable through the private VPN/Interconnect link, on-premises bare-metal servers can reach Cloud Storage without ever having a public IP address or open internet egress, while restricted.googleapis.com additionally limits access to only APIs/services supported by VPC Service Controls, reducing data-exfiltration risk. See Google Cloud's documentation, 'Private Google Access for on-premises hosts' and 'Configure Private Google Access for on-premises hosts.'

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!