Private Service Connect compatibility
Services
You can access the following services by usingPrivate Service Connect.
Google published services
Third-party published services
Self-managed published services
| Source of your service | Service producer configuration | Service consumer configuration |
|---|---|---|
| Cloud Load Balancing | Publish the service |
|
| Google Kubernetes Engine (GKE) | Publish the service: Route requests to your service through an internalLoadBalancer service and publish the service through aServiceAttachment |
|
| Cloud Run and Cloud Run functions (2nd gen) | Choose one of the following:
| Choose the consumer option that corresponds with the service producer configuration:
|
| Cloud Run functions (1st gen) | cloudfunctions.net URL: you don't need additional configuration | Create an endpoint to accesscloudfunctions.net URLs |
| App Engine | You don't need additional configuration | Create an endpoint to accessappspot.com URLs |
Global Google APIs
Endpoints can target a bundle of global Google APIs or a single regional GoogleAPI. Backends can target a single global Google API or a single regional GoogleAPI.
Bundles of global Google APIs
You can use Private Service Connect endpoints to send trafficto a bundle of Google APIs.
When you create an endpoint to access Google APIs and services, you choose which bundle of APIs you need access to—All APIs (all-apis) orVPC-SC (vpc-sc):
The
all-apisbundle provides access to most Google APIs and services, including all*.googleapis.comservice endpoints.The
vpc-scbundle provides access toAPIs and services that support VPC Service Controls.
all-apis is equivalent toprivate.googleapis.com andvpc-sc is equivalent torestricted.googleapis.com.The API bundles support only HTTP-based protocols over TCP (HTTP, HTTPS, and HTTP/2). All otherprotocols, including MQTT and ICMP are not supported.
| API bundle | Supported services | Example usage |
|---|---|---|
all-apis | Enables API access to most Google APIs and services regardless of whether they are supported by VPC Service Controls. Includes API access to Google Maps, Google Ads, Google Cloud, and most other Google APIs, including the lists below. Does not support Google Workspace web applications such as Gmail and Google Docs. Does not support any interactive websites. Domain names that match:
| Choose
|
vpc-sc | Enables API access toGoogle APIs and services that are supported by VPC Service Controls. Blocks access to Google APIs and services that do not supportVPC Service Controls. Does not support Google Workspace APIs or Google Workspace web applications such as Gmail and Google Docs. | Choose |
vpc-sc, as it provides additional risk mitigation for data exfiltration. Usingvpc-sc denies access to Google APIs and services that are not supported by VPC Service Controls. SeeSetting up private connectivity in the VPC Service Controls documentation for more details.Single global Google API
You can use Private Service Connect backends to send requeststo a single supported global Google API. The following APIs are supported:
- Bigtable:
bigtable.googleapis.comandbigtableadmin.googleapis.com - Cloud Logging:
logging.googleapis.com - Spanner:
spanner.googleapis.com - Cloud Storage:
storage.googleapis.com - Pub/Sub:
pubsub.googleapis.com
Regional Google APIs
You can use endpoints or backends to access regional Google APIs.For a list of supported regional Google APIs, seeRegional serviceendpoints.
Types
The following tables summarize compatibility information for differentPrivate Service Connect configurations.
In the following tables, a checkmark indicatesthat a feature is supported, and a no symbolindicates that a feature isn't supported.
Endpoints and published services
This section summarizes the configuration options that are available forconsumers and producers when using endpoints to access published services.
Consumer configuration
This table summarizes the supported configuration options and capabilities ofendpoints that access published services based on target producer type.
Endpoints that access a published service have the following limitations:
You can't create an endpoint in the same VPC network as thepublished service that you are accessing.
Packet Mirroring can't mirror packets for Private Service Connect published services traffic.
Not all static routes with load balancer next hops are supported with Private Service Connect. For more information, seeStatic routes with load balancer next hops.
Connectivity Tests can't test connectivity between an IPv6 endpoint and a published service.
Producer configuration
This table summarizes the supported configuration options and capabilities ofpublished services that are accessed by endpoints.
| Producer type | Producer configuration (published service) | |||
|---|---|---|---|---|
| Supported producer backends | PROXY protocol (TCP traffic only) | IP version | ||
| Cross-region internal Application Load Balancer |
|
| ||
| Internal passthrough Network Load Balancer |
|
| ||
| Internal protocol forwarding (target instance) |
|
| ||
| Port mapping services |
|
| ||
| Regional internal Application Load Balancer |
|
| ||
| Regional internal proxy Network Load Balancer |
|
| ||
| Secure Web Proxy |
|
| ||
Published services have the following limitations:
- Load balancers that are configured with multiple protocols—protocol set to
L3_DEFAULT—are not supported. - Packet Mirroring can't mirror packets for Private Service Connect published services traffic.
- You must use the Google Cloud CLI or the API to create a service attachment that points to a forwarding rule that is used forinternal protocol forwarding.
For issues and workarounds, seeKnown issues.
Different load balancers support different port configurations; some loadbalancers support a single port, some support a range of ports, and some supportall ports. For more information, seePortspecifications.
Backends and published services
A Private Service Connect backend for published services requires two load balancers—a consumer load balancer and a producer load balancer. This section summarizes the configuration options that are available for consumers and producers when using backends to access published services.
Consumer configuration
This table describes the consumer load balancers that are supported by Private Service Connect backends for published services, including which backend service protocols can be used with each consumer load balancer. The consumer load balancers can access published services that are hosted onsupported producer load balancers.
| Consumer load balancer | Protocols | IP version | Cross-region failover |
|---|---|---|---|
| IPv4 | ||
| IPv4 | ||
Global external Application Load Balancer Note:
|
| IPv4 | |
Global external proxy Network Load Balancer To associate this load balancer with a Private Service Connect NEG, use the Google Cloud CLI or send an API request. Note: Classic proxy Network Load Balancer is not supported. |
| IPv4 | |
| IPv4 | ||
| IPv4 | ||
| IPv4 | ||
| IPv4 |
Producer configuration
This table describes the configuration for producer load balancersthat are supported by Private Service Connect backends forpublished services.
| Producer type | Producer configuration (published service) | |||||
|---|---|---|---|---|---|---|
| Supported producer backends | Forwarding rule protocols | Forwarding rule ports | PROXY protocol | IP version | Private Service Connect health support | |
| Cross-region internal Application Load Balancer |
|
| Supports one, multiple, or all ports | IPv4 | ||
| Internal passthrough Network Load Balancer |
|
| SeeProducer port configuration | IPv4 | ||
| Regional internal Application Load Balancer |
|
| Supports a single port | IPv4 | ||
Regional internal proxy Network Load Balancer Note: Connections from consumer global external Application Load Balancers aren't supported. |
|
| Supports a single port | IPv4 | ||
| Secure Web Proxy |
|
| Not applicable | IPv4 | ||
Published services have the following limitations:
- Load balancers that are configured with multiple protocols—protocol set to
L3_DEFAULT—are not supported. - Packet Mirroring can't mirror packets for Private Service Connect published services traffic.
- You must use the Google Cloud CLI or the API to create a service attachment that points to a forwarding rule that is used forinternal protocol forwarding.
For issues and workarounds, seeKnown issues.
For an example backend configuration that uses a global external Application Load Balancer, seeAccess published services throughbackends.
To publish a service, seePublishservices.
Endpoints and global Google APIs
This table summarizes the features that are supported byendpoints used toaccess Google APIs.
To create this configuration, seeAccess Google APIsthrough endpoints.
| Configuration | Details |
|---|---|
| Consumer configuration (endpoint) | |
| Global reachability | Uses an internal global IP address |
| Cloud Interconnect traffic | |
| Cloud VPN traffic | |
| Access through VPC Network Peering | |
| Connection propagation through NCC | |
| Automatic DNS configuration | |
| IP version | IPv4 |
| Producer | |
| Supported services | Supported global Google APIs |
Backends and global Google APIs
Preview
This product or feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of theService Specific Terms. Pre-GA products and features are available "as is" and might have limited support. For more information, see thelaunch stage descriptions.
This table describes which load balancers can use aPrivate Service Connect backend to a global Google API.
| Configuration | Details |
|---|---|
| Consumer configuration (Private Service Connect backend) | |
| Supported consumer load balancers |
|
| IP version | IPv4 |
| Producer | |
| Supported services |
|
Endpoints and regional Google APIs
This table summarizes the features that are supported byendpoints used toaccess regional GoogleAPIs.
| Configuration | Details |
|---|---|
| Consumer configuration (endpoint) | |
| Global reachability | If global access is enabled |
| Cloud Interconnect traffic | |
| Cloud VPN traffic | |
| Access through VPC Network Peering | |
| Connection propagation through NCC | |
| DNS configuration | Manual DNS configuration |
| IP version | IPv4 or IPv6 |
| Producer | |
| Supported services | Supported regional Google APIs |
Backends and regional Google APIs
This table describes which load balancers can use aPrivate Service Connectbackend to access regionalGoogle APIs.
For an example backend configuration that uses an internal Application Load Balancer,seeAccess regional Google APIs throughbackends.
| Configuration | Details |
|---|---|
| Consumer configuration (Private Service Connect backend) | |
| Supported consumer load balancers |
|
| IP version | IPv4 |
| Producer | |
| Supported services | Supported regional Google APIs |
What's next
- Learn aboutaccessing published services through endpoints.
- Learn aboutaccessing global Google APIs through endpoints.
- Learn aboutaccessing regional Google APIs through endpoints.
- Learn aboutbackends.
- Learn aboutpublishing services.
Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2026-02-18 UTC.