Private Service Connect compatibility

Services

You can access the following services by using Private Service Connect.

Google published services

Google service	Access provided
AlloyDB for PostgreSQL	Lets you connect to AlloyDB for PostgreSQL instances .
Apigee	Lets you expose APIs managed by Apigee to the internet . Also lets you connect privately from Apigee to backend target services .
BigQuery connections SAP Datasphere	Lets you increase security when using BigQuery to send queries to SAP Datasphere .
BigQuery Data Transfer Service	Lets you use BigQuery Data Transfer Service for Oracle .
Blockchain Node Engine	Lets you access Blockchain Node Engine nodes .
Chrome Enterprise Premium	Lets the Identity-Aware Proxy access the App Connector Gateway.
Cloud Data Fusion	Lets you connect Cloud Data Fusion instances to resources in VPC networks .
Cloud Composer 2	Lets you access the Cloud Composer tenant project .
Cloud Composer 3	Lets you access the Cloud Composer tenant project .
Cloud SQL	Lets you access your Cloud SQL database privately . Lets you automate creating connections to Cloud SQL instances through service connectivity automation.
Cloud Workstations	Lets you access private workstation clusters .
Database Migration Service	Lets you migrate your data to Google Cloud .
Dataproc Metastore	Lets you access Dataproc Metastore services .
Eventarc	Lets you receive events from Eventarc .
Google Cloud Contact Center as a Service (CCaaS)	Lets your agents and supervisors privately access the Google Cloud Contact Center as a Service interface . Lets your Google Cloud Contact Center as a Service instance privately access other systems via a VPC network .
Google Cloud Managed Service for Apache Kafka	Lets you access Managed Service for Apache Kafka clusters .
Google Kubernetes Engine (GKE) public clusters and private clusters	Lets you privately connect nodes and the control plane for a public or private cluster .
Integration Connectors	Lets Integration Connectors access your managed services privately .
Looker (Google Cloud core)	Lets you access Looker (Google Cloud core) instances .
Memorystore for Redis Cluster	Lets you automate creating connections to Memorystore for Redis Cluster instances through service connectivity automation.
Memorystore for Valkey	Lets you automate creating connections to Memorystore for Valkey instances through service connectivity automation.
Ray on Vertex AI	Lets you access Ray clusters .
Vertex AI Pipelines	Lets you create pipeline runs .
Vertex AI Training	Lets you access custom jobs and persistent resources .
Vertex AI Vector Search	Lets you automate creating connections to Vector Search endpoints through service connectivity automation.
Vertex AI predictions	Lets you access Vertex AI online prediction .

Third-party published services

Third-party service	Access provided
Aiven	Provides private access to Aiven Kafka clusters .
Axoflow	Provides private access to Axoflow Platform .
Citrix DaaS	Provides private access to Citrix DaaS .
ClickHouse	Provides private access to ClickHouse services .
Confluent Cloud	Provides private access to Confluent Cloud clusters .
Couchbase	Provides private access to Capella clusters .
Databricks	Provides private access to Databricks clusters .
Datadog	Provides private access to Datadog intake services .
Datastax Astra	Provides private access to Datastax Astra DB databases .
dbt	Provides private access to the dbt multi-tenant environment .
Elasticsearch	Provides private access to Elastic Cloud .
Groq	Provides private access to Groq Cloud .
JFrog	Provides private access to JFrog SaaS instances .
MongoDB Atlas	Provides private access to MongoDB Atlas .
Neo4j Aura	Provides private access to Neo4j Aura .
Pega Cloud	Provides private access to Pega Cloud .
Redis Enterprise Cloud	Provides private access to Redis Enterprise clusters .
Redpanda	Provides private access to Redpanda Cloud .
Snowflake	Provides private access to Snowflake .
Striim	Provides private access to Striim Cloud .
Zenoss	Provides private access to Zenoss Cloud .

Self-managed published services

Global Google APIs

Endpoints can target a bundle of global Google APIs or a single regional Google API. Backends can target a single global Google API or a single regional Google API.

Bundles of global Google APIs

You can use Private Service Connect endpoints to send traffic to a bundle of Google APIs.

When you create an endpoint to access Google APIs and services, you choose which bundle of APIs you need access to— All APIs( all-apis ) or VPC-SC( vpc-sc ):

• The all-apis bundle provides access to most Google APIs and services, including all *.googleapis.com service endpoints.

• The vpc-sc bundle provides access to APIs and services that support VPC Service Controls.

The API bundles support only HTTP-based protocols over TCP (HTTP, HTTPS, and HTTP/2). All other protocols, including MQTT and ICMP are not supported.

Single global Google API

You can use Private Service Connect backends to send requests to a single supported global Google API. The following APIs are supported:

• Bigtable : bigtable.googleapis.com and bigtableadmin.googleapis.com
• Cloud Logging : logging.googleapis.com
• Spanner : spanner.googleapis.com
• Cloud Storage : storage.googleapis.com
• Pub/Sub : pubsub.googleapis.com

Regional Google APIs

You can use endpoints or backends to access regional Google APIs. For a list of supported regional Google APIs, see Regional service endpoints .

Types

The following tables summarize compatibility information for different Private Service Connect configurations.

In the following tables, a checkmark indicates that a feature is supported, and a no symbol indicates that a feature isn't supported.

Endpoints and published services

This section summarizes the configuration options that are available for consumers and producers when using endpoints to access published services.

Consumer configuration

This table summarizes the supported configuration options and capabilities of endpoints that access published services based on target producer type.

Endpoints that access a published service have the following limitations:

• You can't create an endpoint in the same VPC network as the published service that you are accessing.

• Packet Mirroring can't mirror packets for Private Service Connect published services traffic.

• Not all static routes with load balancer next hops are supported with Private Service Connect. For more information, see Static routes with load balancer next hops .

• Connectivity Tests can't test connectivity between an IPv6 endpoint and a published service.

Producer configuration

This table summarizes the supported configuration options and capabilities of published services that are accessed by endpoints .

Published services have the following limitations:

• Load balancers that are configured with multiple protocols —protocol set to L3_DEFAULT —are not supported.
• Packet Mirroring can't mirror packets for Private Service Connect published services traffic.
• You must use the Google Cloud CLI or the API to create a service attachment that points to a forwarding rule that is used for internal protocol forwarding .

For issues and workarounds, see Known issues .

Different load balancers support different port configurations; some load balancers support a single port, some support a range of ports, and some support all ports. For more information, see Port specifications .

Backends and published services

A Private Service Connect backend for published services requires two load balancers—a consumer load balancer and a producer load balancer. This section summarizes the configuration options that are available for consumers and producers when using backends to access published services.

Consumer configuration

This table describes the consumer load balancers that are supported by Private Service Connect backends for published services, including which backend service protocols can be used with each consumer load balancer. The consumer load balancers can access published services that are hosted on supported producer load balancers .

Producer configuration

This table describes the configuration for producer load balancers that are supported by Private Service Connect backends for published services.

Published services have the following limitations:

• Load balancers that are configured with multiple protocols —protocol set to L3_DEFAULT —are not supported.
• Packet Mirroring can't mirror packets for Private Service Connect published services traffic.
• You must use the Google Cloud CLI or the API to create a service attachment that points to a forwarding rule that is used for internal protocol forwarding .

For issues and workarounds, see Known issues .

For an example backend configuration that uses a global external Application Load Balancer, see Access published services through backends .

To publish a service, see Publish services .

Endpoints and global Google APIs

This table summarizes the features that are supported by endpoints used to access Google APIs .

To create this configuration, see Access Google APIs through endpoints .

Backends and global Google APIs

This table describes which load balancers can use a Private Service Connect backend to a global Google API.

Endpoints and regional Google APIs

This table summarizes the features that are supported by endpoints used to access regional Google APIs .

Backends and regional Google APIs

This table describes which load balancers can use a Private Service Connect backend to access regional Google APIs.

For an example backend configuration that uses an internal Application Load Balancer, see Access regional Google APIs through backends .

What's next

• Learn about accessing published services through endpoints .
• Learn about accessing global Google APIs through endpoints .
• Learn about accessing regional Google APIs through endpoints .
• Learn about backends .
• Learn about publishing services .