BigQuery regional endpoints

This page describes how you can usePrivate Service Connect regionalendpointsto access resources in BigQuery. Regional endpoints letyou run your workloads in a manner that complies withdataresidency and data sovereigntyrequirements, where your request traffic is routed directly to the regionspecified in the endpoint.

Overview

Regional endpoints are request endpoints that help restrict requests to proceedonly if the affected resource exists in the location specified by the endpoint.For example, if you use the endpointhttps://bigquery.us-central1.rep.googleapis.com in a delete datasetrequest, then the request only proceeds if the dataset is located inUS-CENTRAL1.

Unlike global endpoints, where requests can be routed through a differentlocation from where the resource resides, regional endpoints can help torestrict your requests to the location specified by the endpoint where theresource resides. Regional endpoints terminate TLS sessions in the locationspecified by the endpoint for requests received from the Internet, otherGoogle Cloud resources (such as Compute Engine virtual machines), on-premiseservices using VPN or Interconnect, and Virtual Private Clouds (VPCs).

Regional endpoints help to ensure data residency by keeping your at-rest andin-transit table data within the location specified by the endpoint. Thisexcludes resource metadata, such as dataset names andIAM policies. For more information, seeNote on servicedata.

BigQuery includes multiple APIs. The following APIs are availablefor use with regional endpoint:

Supported locations

You can use regional endpoints to keep your data within the following locations:

• Asia-Pacific

  • Delhiasia-south2
  • Mumbaiasia-south1

• Europe

  • Belgiumeurope-west1
  • Frankfurteurope-west3
  • Londoneurope-west2
  • Milaneurope-west8
  • Pariseurope-west9
  • Züricheurope-west6

• Middle East

  • Dammamme-central2

• United States

  • Iowaus-central1
  • South Carolinaus-east1
  • Northern Virginiaus-east4
  • Columbus, Ohious-east5
  • Dallasus-south1
  • Oregonus-west1
  • Los Angelesus-west2
  • Salt Lake Cityus-west3
  • Las Vegasus-west4

Supported operations

Regional endpoints can only be used to perform operations that access or mutateresources stored in the location specified by the endpoint.Regional endpoints cannot be used to perform operations that access or mutateresources outside of the location specified by the endpoint.

For example, when you use the regional endpointhttps://bigquery.us-central1.rep.googleapis.com, you can read tables indatasets located inUS-CENTRAL1, and copy a table from a source dataset to adestination dataset only when both datasets are located inUS-CENTRAL1. If youattempt to read or copy a table from outsideUS-CENTRAL1, you get anerror.

Limitations and restrictions

Regional endpoints cannot be used to perform the following operations:

• Operations that access or mutate resources outside of the location specifiedby the endpoint
• Copying, replicating, or rewriting resources from one location to another.

Keep in mind the following restrictions when using regional endpoints:

• Regional endpoints don't supportmutual Transport Layer Security (mTLS).
• Using a regional endpoint won't restrict the creation of resources outside ofthe endpoint region. To restrict resource creation, useOrganization Policy Serviceresource locations constraint.
• Cross-region dataset replication andcross-region table copyingaren't restricted by endpoint protection.

Tools for using regional endpoints

Restrict global API endpoint usage

To help enforce the use of regional endpoints, use theconstraints/gcp.restrictEndpointUsage organization policy constraint to blockrequests to the global API endpoint. For more information, seeRestricting endpoint usage.