Private Service Connect (PSC) lets a workload with only a private IP in your VPC access supported Google APIs through an internal endpoint IP—including Google Maps APIs. Google explicitly includes Maps in PSC’s all-apis bundle. docs.cloud.google.com
For example:
| Component | Example |
|---|---|
| Application VM | Private IP 10.10.1.5; no external IP |
| PSC endpoint | Internal IP 10.100.0.10 |
| API requested | maps.googleapis.com |
| Private DNS | Resolves the API hostname to the PSC endpoint IP |
You create a PSC endpoint targeting all-apis, configure private DNS for the API hostname, and allow HTTPS traffic to the endpoint. The application continues using the API’s hostname and HTTPS; DNS directs its requests to the private IP. Cloud NAT or an external IP is unnecessary for that API traffic. docs.cloud.google.com
A few distinctions matter:
- Choose
all-apisfor Maps. Thevpc-scbundle permits only APIs supported by VPC Service Controls. - PSC provides connectivity. API keys or other required authentication, API enablement, and billing still apply.
- Maps API access differs from the interactive Google Maps website. PSC’s API bundles do not support interactive websites. docs.cloud.google.com
A publicly offered Google API can be consumed through a private IP endpoint in your VPC.
How does this differ from Private Google Access (PGA) ?
Private Google Access supports the same basic use case: a VM with only a private IP calling Google APIs without Cloud NAT. The main difference is the destination IP it uses.
| Aspect | Private Google Access | PSC for Google APIs |
|---|---|---|
| Configuration | Enable on the VM’s subnet; ensure appropriate routes and firewall rules | Create a PSC endpoint and configure DNS |
| API destination IP | Google’s API IP addresses—default public addresses or dedicated Google API VIPs | An internal IP you reserve in your VPC |
| Private endpoint in your VPC | No | Yes |
| External IP or Cloud NAT needed | No | No |
| Traffic traverses public internet | No | No |
PGA uses Google’s API endpoints while keeping traffic within Google’s network. PSC gives you a VPC-specific internal destination for that traffic. docs.cloud.google.com
For your Google Maps API example:
- With PGA: Your VM calls
maps.googleapis.comusing Google’s API IP addresses. Enabling PGA on its subnet allows the private-only VM to reach the supported API. - With PSC: Private DNS resolves
maps.googleapis.comto your PSC endpoint, such as10.100.0.10, targeting theall-apisbundle. docs.cloud.google.com
One subtle point: PGA’s private.googleapis.com VIPs (199.36.153.8/30) are reachable only through Google’s network, but they are not internal IP addresses allocated in your VPC. The word “private” describes the access path. docs.cloud.google.com
For simply allowing a private VM to call Maps, PGA is usually sufficient. Choose PSC when you specifically want a controlled internal endpoint IP in your VPC.
