Private Service Connect: Consume Google APIs & Services Privately with Terraform | 2026

What is Private Service Connect (PSC)?

Private Service Connect (PSC) is a unidirectional networking capability in GCP that allows consumer VPC networks to privately access Google APIs or producer services hosted in another VPC using an internal IP address assigned from the consumer's local subnet.

Think of VPC Peering like building a physical bridge between two office buildings — both buildings must share IP address space, and employees can walk back and forth. PSC is like installing a secure private mailbox inside your own office wall. You drop letters into your local mailbox (internal IP), and the delivery service routes it straight to the provider without anyone entering your building or sharing room numbers.

PSC vs PSA vs Private Google Access — Architectural Matrix

Legacy Private Google Access only works for Google APIs and still uses default public IP routes (35.199.192.0/19). Legacy Private Services Access (PSA) requires VPC Peering, which risks IP space exhaustion and limits transitive routing across multi-tenant hubs.

Private Service Connect solves both problems. It brings Google APIs and managed tenant services into your local subnet via standard internal IP addresses without VPC Peering, preventing IP collisions and simplifying multi-tenant network security. Combine with [Private Google Access + Cloud NAT](/tutorial/private-google-access-cloud-nat-zero-public-ips-architecture) and deploy across [Shared VPC topologies](/tutorial/shared-vpc-gcp-terraform-host-service-projects-iam).

Prerequisites

• GCP Project with Compute Engine API (`compute.googleapis.com`) and Cloud DNS API (`dns.googleapis.com`) enabled
• Existing Custom Mode VPC Network and Subnet
• Terraform CLI v1.6+
• gcloud CLI v480.0+ configured

Step-by-Step Guide

Step 1: Allocate Internal IP Address for Private Service Connect

Reserve a static internal IP address in your consumer VPC network for the PSC Google APIs endpoint in Terraform. Reserving an internal IP guarantees that your PSC endpoint address remains static across infrastructure updates.

# psc_ip.tf — Static Internal IP for PSC Google APIs
resource "google_compute_global_address" "psc_google_apis_ip" {
  name         = "psc-google-apis-internal-ip"
  address_type = "INTERNAL"
  purpose      = "PRIVATE_SERVICE_CONNECT"
  network      = google_compute_network.custom_vpc.id
  project      = var.project_id
}

output "psc_ip_address" {
  value       = google_compute_global_address.psc_google_apis_ip.address
  description = "Internal IP allocated for Private Service Connect Google APIs"
}

Step 2: Create Global Forwarding Rule for Google APIs Bundle

Deploy a global forwarding rule in Terraform targeting the `vpc-sc` or `all-apis` Google Service directory URI. The forwarding rule connects your reserved internal IP to Google's internal API service directory backplane.

# psc_forwarding_rule.tf — Global Forwarding Rule for PSC
resource "google_compute_global_forwarding_rule" "psc_google_apis" {
  name                  = "psc-google-apis-forwarding-rule"
  target                = "all-apis" # Or "vpc-sc" for VPC Service Controls bundle
  network               = google_compute_network.custom_vpc.id
  ip_address            = google_compute_global_address.psc_google_apis_ip.id
  load_balancing_scheme = ""
  project               = var.project_id
}

Step 3: Configure Cloud DNS Private Zones for Google APIs Override

Set up a Cloud DNS Private Zone for `googleapis.com` pointing `*.googleapis.com` CNAME records to `google_compute_global_forwarding_rule`. DNS overrides ensure application SDKs automatically resolve API domain names to your private PSC IP without code or environment variable changes.

# psc_dns.tf — Cloud DNS Private Zone for googleapis.com override
resource "google_dns_managed_zone" "googleapis" {
  name        = "googleapis-private-zone"
  dns_name    = "googleapis.com."
  description = "Private DNS override for Private Service Connect"
  visibility  = "private"

  private_visibility_config {
    networks {
      network_url = google_compute_network.custom_vpc.id
    }
  }
  project = var.project_id
}

# CNAME record for wildcard *.googleapis.com pointing to psc.googleapis.com
resource "google_dns_record_set" "cname_wildcard" {
  name         = "*.googleapis.com."
  managed_zone = google_dns_managed_zone.googleapis.name
  type         = "CNAME"
  ttl          = 300
  rrdatas      = ["private.googleapis.com."]
  project      = var.project_id
}

# A record for private.googleapis.com pointing to PSC Internal IP
resource "google_dns_record_set" "a_private" {
  name         = "private.googleapis.com."
  managed_zone = google_dns_managed_zone.googleapis.name
  type         = "A"
  ttl          = 300
  rrdatas      = [google_compute_global_address.psc_google_apis_ip.address]
  project      = var.project_id
}

Step 4: Connect to Managed Producer Services via Regional PSC Endpoint

Deploy a regional forwarding rule in Terraform to connect to a third-party or managed producer service (e.g. Cloud SQL via PSC Service Attachment). Consumer projects can connect to managed producer services privately across separate GCP projects without full VPC Peering.

# psc_producer_endpoint.tf — Regional PSC Endpoint for Managed Service
resource "google_compute_address" "psc_producer_ip" {
  name         = "psc-producer-service-ip"
  subnetwork   = google_compute_subnetwork.app_subnet.id
  address_type = "INTERNAL"
  region       = "europe-west1"
  project      = var.project_id
}

resource "google_compute_forwarding_rule" "psc_producer_endpoint" {
  name                  = "psc-producer-endpoint-forwarding-rule"
  region                = "europe-west1"
  network               = google_compute_network.custom_vpc.id
  subnetwork            = google_compute_subnetwork.app_subnet.id
  ip_address            = google_compute_address.psc_producer_ip.id
  target                = var.producer_service_attachment_uri # Format: projects/PRODUCER/regions/REGION/serviceAttachments/ATTACHMENT_NAME
  load_balancing_scheme = ""
  project               = var.project_id
}

Step 5: Verify Private API Resolution and Traffic Flow

Spin up a test Compute Engine VM inside the private subnet and verify that `storage.googleapis.com` resolves to the PSC internal IP. Empirical verification confirms that DNS resolution and VPC routing successfully keep all Google API traffic on internal private pathways.

# Step 1: SSH into private VM (via IAP or internal bastion)
gcloud compute ssh private-test-vm --zone=europe-west1-b --project=PROJECT_ID

# Step 2: Verify DNS resolution for Storage API
dig storage.googleapis.com

# Expected output:
# ;; ANSWER SECTION:
# storage.googleapis.com. 300 IN CNAME private.googleapis.com.
# private.googleapis.com. 300 IN A     10.0.0.250

# Step 3: Test API call using curl
curl -vvv https://storage.googleapis.com

# Expected output:
# * Trying 10.0.0.250:443...
# * Connected to storage.googleapis.com (10.0.0.250) port 443
# < HTTP/2 405 (Valid TLS handshake with Google API backplane over private IP!)

Verification & Health Check

Best Practices

• Prefer Private Service Connect Over Legacy Private Services Access (PSA)
• Use DNS Override for Seamless SDK Integration

Common Mistakes

• {"errorCode":"PSC_DNS_RESOLUTION_FAILURE","symptoms":"Applications inside the VPC continue to resolve storage.googleapis.com to public 142.250.x.x IPs.","rootCause":"The Cloud DNS private zone was created but not linked to the consumer VPC network in `private_visibility_config`.","fixCommand":"gcloud dns managed-zones update googleapis-private-zone --networks=VPC_NAME","code":"resource \"google_dns_managed_zone\" \"fix_dns\" {\n name = \"googleapis-private-zone\"\n private_visibility_config {\n networks {\n network_url = google_compute_network.custom_vpc.id\n }\n }\n}\n","language":"hcl","filename":"fix_dns_visibility.tf","prevention":"Verify `network_url` linkages in Terraform DNS configuration."}

Cost Analysis

References

• Private Service Connect Overview
• Accessing Google APIs via Private Service Connect
• google_compute_global_forwarding_rule Terraform Resource