Private Google Access in GCP - Step-by-Step Execution

Process Flow - Private Google Access

Create VPC Network

↓

Create Subnet in VPC

↓

Enable Private Google Access on Subnet

↓

VM in Subnet without Public IP

↓

VM sends request to Google API

↓

Request routed via Google internal network

↓

VM accesses Google services privately

↓

No public internet needed

This flow shows how enabling Private Google Access on a subnet lets VMs without public IPs reach Google services privately through Google's network.

Execution Sample

GCP

resource "google_compute_subnetwork" "subnet" {
  name          = "my-subnet"
  ip_cidr_range = "10.0.0.0/24"
  region        = "us-central1"
  network       = google_compute_network.vpc.id
  private_ip_google_access = true
}

This code creates a subnet with Private Google Access enabled, allowing VMs without public IPs to reach Google APIs privately.

Process Table

Step	Action	Resource State	Network Behavior	Result
1	Create VPC network	VPC network exists	No subnets yet	Ready for subnet creation
2	Create subnet without Private Google Access	Subnet exists, private_ip_google_access=false	VMs cannot access Google APIs privately	VMs need public IP or NAT
3	Enable Private Google Access on subnet	Subnet updated, private_ip_google_access=true	Subnet allows private access to Google APIs	VMs without public IP can access Google APIs
4	Launch VM without public IP in subnet	VM running, no public IP	VM routes Google API requests internally	VM accesses Google services privately
5	VM sends request to Google API	Request sent	Routed via Google internal network	Request succeeds without public internet
6	VM tries to access internet directly	Request sent	No public IP, no NAT	Request fails - no internet access
7	End	Infrastructure stable	Private Google Access active	VMs access Google APIs privately, no public internet needed

💡 Execution stops after VM accesses Google APIs privately without public internet access.

Status Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	Final
private_ip_google_access	undefined	false	true	true	true
VM public IP	undefined	undefined	undefined	none	none
VM Google API access	undefined	no	yes	yes	yes

Key Moments - 3 Insights

Why can't a VM without a public IP access Google APIs before enabling Private Google Access?

Because without Private Google Access, the subnet does not route Google API requests internally, so the VM needs a public IP or NAT to reach Google services (see execution_table step 2).

Does enabling Private Google Access give the VM full internet access?

No, it only allows access to Google APIs via Google's internal network. The VM still cannot access the public internet without a public IP or NAT (see execution_table step 6).

What changes in the subnet configuration enable private access to Google APIs?

Setting 'private_ip_google_access' to true on the subnet enables routing of Google API requests through Google's internal network (see execution_table step 3).

Visual Quiz - 3 Questions

Look at the execution table, at which step is Private Google Access enabled on the subnet?

A Step 2

B Step 3

C Step 4

D Step 5

💡 Hint

Check the 'Action' and 'Resource State' columns in the execution_table rows.

According to the variable tracker, what is the VM's public IP status after step 4?

A No public IP

B Public IP unknown

C Has a public IP

D Public IP assigned later

💡 Hint

Look at the 'VM public IP' row under 'After Step 4' in variable_tracker.

If Private Google Access was not enabled, what would happen when the VM tries to access Google APIs?

A Request succeeds via internal network

B Request succeeds using public IP

C Request fails without public IP or NAT

D Request is blocked by firewall

💡 Hint

Refer to execution_table step 2 and step 6 for network behavior without Private Google Access.

Concept Snapshot

Private Google Access allows VMs without public IPs to reach Google APIs privately.
Enable it by setting 'private_ip_google_access = true' on a subnet.
VMs in that subnet route Google API requests via Google's internal network.
This does NOT provide general internet access.
Useful for secure, private access to Google services.

Full Transcript

Private Google Access is a feature in Google Cloud that lets virtual machines without public IP addresses access Google APIs and services privately. The process starts by creating a VPC network and a subnet. By enabling the 'private_ip_google_access' setting on the subnet, VMs launched inside it can send requests to Google APIs through Google's internal network, even if they do not have public IPs. This setup ensures that the VM's requests to Google services do not go through the public internet, enhancing security. However, this does not grant the VM access to the general internet; for that, a public IP or NAT is still required. The execution table traces these steps, showing how the subnet and VM states change, and how network behavior allows private access to Google APIs. The variable tracker monitors key variables like the private IP access flag and VM public IP status. Key moments clarify common confusions, such as the difference between private Google access and full internet access. The visual quiz tests understanding by referencing specific steps and variable states.