Create and manage Private Service Connect interfaces (original) (raw)

Skip to main content

This page describes how producer network administrators can create and manage Private Service Connect interfaces. Private Service Connect interfaces let service producer Virtual Private Cloud (VPC) networks initiate connections to consumer VPC networks.

Before you begin

Roles

To get the permissions that you need to create Private Service Connect interfaces, ask your administrator to grant you the following IAM roles on your project:

For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

The Compute Instance Admin (v1) role contains thecompute.instances.pscInterfaceCreate permission, which is required to create Private Service Connect interfaces.

Create VMs with Private Service Connect interfaces

To create a Private Service Connect interface connection, you need a virtual machine (VM) instance that has at least two network interfaces. The first interface connects to a producer subnet. The other interfaces can be Private Service Connect interfaces that request connections tonetwork attachments in different consumer VPC networks.

If a connection is accepted, Google Cloud assigns to the Private Service Connect interface an internal IP address from the subnet that is specified by the network attachment.

When you create a VM with multiple Private Service Connect interfaces, each Private Service Connect interface must connect to a different network attachment that is in a different VPC network.

If you create a Private Service Connect interface that refers to a network attachment that's configured tomanually accept connectionsand the interface's project is not in the network attachment's accept list, creation of the Private Service Connect interface's VM fails. In this case, work with the consumer organization to add your project to the accept list, and then create a Private Service Connect interface.

When you create a Private Service Connect interface, you can optionally assign to it one or more internal alias IP ranges. If you plan to assign alias IP ranges, contact the consumer organization to determine the appropriate IP address ranges.

To assign an alias IP range, specify the prefix length of the range in CIDR notation. When you assign one or more alias IP ranges to a Private Service Connect interface, Google Cloud allocates the alias IP ranges from the primary IP address range of the subnet that's associated with the network attachment. The Private Service Connect interface's primary IP address is allocated from outside of any alias IP ranges. If there aren't enough IP addresses in the network attachment's subnet to allocate the primary IP address and alias IP ranges, creation of the Private Service Connect interface's VM fails. You can find the specific IP addresses that are assigned bydescribing the interface's VM.

Console

Create a VM instance

  1. In the Google Cloud console, go to the VM instances page:
    Go to VM instances
  2. Click Create instance.
  3. Enter a name.
  4. Click Region, and then select the region of the network attachment that you want to connect to.
  5. Select a zone.
  6. To configure the VM's default network interface, do the following:
    1. Click Networking.
    2. In the Network interfaces section, click the first network interface, which is the default network interface.
    3. Select a network.
    4. Select a subnet that is in the same region as the Private Service Connect interface's network attachment.
    5. Select an IP stack type.
  7. Click Done.

Add Private Service Connect interfaces

You can repeat these steps for each interface that you want to add.

Add a virtual Private Service Connect interface

  1. Click Add a network interface.
  2. For Interface type, select Private Service Connect.
  3. Enter the URL of this interface's network attachment.
  4. Select anIP stack typefor the interface. The network attachment's subnet determines the possible stack types.
  5. Optional: To add an alias IP range, do the following:
    1. In the Alias IP ranges section, click Add IP range.
    2. In the Prefix length box, enter the prefix length—for example, /30. You can add multiple alias IP ranges by clickingAdd IP range, and then entering the prefix length for each additional alias IP range that you want to add.
  6. Click Done.

Add a dynamic Private Service Connect interface

  1. Click Add a dynamic network interface.
  2. For Interface type, select Private Service Connect.
  3. Select a parent network interface.
  4. Enter a VLAN ID.
  5. Select anIP stack typefor the interface. The network attachment's subnet determines the possible stack types.
  6. Optional: To add an alias IP range, do the following:
    1. In the Alias IP ranges section, click Add IP range.
    2. In the Prefix length box, enter the prefix length—for example, /30. You can add multiple alias IP ranges by clickingAdd IP range, and then entering the prefix length for each additional alias IP range that you want to add.
  7. Click Done.

To create the VM, click Create.

gcloud

gcloud compute instances create producer-vm \  
    --zone=us-west-1a \  
    --network-interface='subnet=producer-subnet,no-address' \  
    --network-interface='network-attachment=projects/consumer-project/regions/us-west-1/networkAttachments/consumer-1-network-attachment,vlan=2' \  
    --network-interface='network-attachment=projects/consumer-project/regions/us-west-1/networkAttachments/consumer-2-network-attachment,vlan=3' \  
    --network-interface='network=producer-vpc-2,subnet=producer-subnet-2' \  
    --network-interface='network-attachment=projects/consumer-project/regions/us-west-1/networkAttachments/consumer-3-network-attachment,vlan=4' \  
    --network-interface='network-attachment=projects/consumer-project/regions/us-west-1/networkAttachments/consumer-4-network-attachment'

API

{  
  "machineType": "zones/us-west-1a/machineTypes/e2-medium",  
  "name": "producer-vm",  
  "disks": [  
    {  
      "initializeParams": {  
        "sourceImage": "projects/debian-cloud/global/images/family/debian-11"  
    },  
    "boot": true  
  }  
  ],  
  "networkInterfaces": [  
    {  
      "network": "https://www.googleapis.com/compute/v1/projects/producer-project-id/global/networks/producer-vpc-1",  
      "subnetwork": "https://www.googleapis.com/compute/v1/projects/producer-project-id/regions/us-west-1/subnetworks/producer-subnet"  
    },  
    {  
      "networkAttachment": "projects/consumer-project1/regions/us-west-1/networkAttachments/consumer-1-network-attachment",  
      "vlan": 2  
    },  
    {  
      "networkAttachment": "projects/consumer-project2/regions/us-west-1/networkAttachments/consumer-2-network-attachment",  
      "vlan": 3  
    },  
    {  
      "network": "https://www.googleapis.com/compute/v1/projects/producer-project-id/global/networks/producer-vpc-2",  
      "subnetwork": "https://www.googleapis.com/compute/v1/projects/producer-project-id/regions/us-west-1/subnetworks/producer-subnet-2"  
    },  
    {  
      "networkAttachment": "projects/consumer-project3/regions/us-west-1/networkAttachments/consumer-3-network-attachment",  
      "vlan": 4  
    },  
    {  
      "networkAttachment": "projects/consumer-project4/regions/us-west-1/networkAttachments/consumer-4-network-attachment"  
    }  
  ]  
}

```

For more information about creating VM instances, seeCreate and start a VM instance.

Add dynamic Private Service Connect interfaces to existing VMs

You can add a dynamic Private Service Connect interface to an existing VM without restarting the VM.

You must configure routingbefore traffic can flow through a new Private Service Connect interface.

Console

  1. In the Google Cloud console, go to the VM instances page:
    Go to VM instances
  2. Click the name of the VM that you want to update.
  3. Click Edit.
  4. In the Networking section, click Add a dynamic network interface.
  5. For Interface type, select Private Service Connect.
  6. Select a parent network interface.
  7. Enter a VLAN ID.
  8. Enter the URL of this interface's network attachment.
  9. Select an IP stack type for the interface. The network attachment's subnet determines the possible stack types.
  10. Optional: To add an alias IP range, do the following:
  11. In the Alias IP ranges section, click Add IP range.
  12. In the Prefix length box, enter the prefix length—for example, /30. You can add multiple alias IP ranges by clickingAdd IP range, and then entering the prefix length for each additional alias IP range that you want to add.
  13. Click Done.
  14. Click Save.

gcloud

To add a single dynamic Private Service Connect interface to an existing VM, use thegcloud compute instances network-interfaces add command.

To add multiple dynamic Private Service Connect interfaces, repeat the command for each interface that you want to add.

gcloud compute instances network-interfaces add INSTANCE_NAME
--zone=ZONE
--vlan=VLAN_ID
--parent-nic-name=PARENT_NIC_NAME
--network-attachment=ATTACHMENT_URI

Replace the following:

API

To add a single dynamic Private Service Connect interface to an existing VM, send a request to theinstances.addNetworkInterface method.

To add multiple dynamic Private Service Connect interfaces, repeat the request for each interface that you want to add.

HTTP method and URL:

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_NAME/addNetworkInterface

Request JSON body:

{ "networkAttachment": "ATTACHMENT_URI", "parentNicName": "PARENT_NIC_NAME", "vlan": VLAN_ID }

Replace the following:

Migrate from virtual to dynamic Private Service Connect interfaces

To configure your service to use dynamic Private Service Connect interfaces instead of virtual Private Service Connect interfaces, do the following.

  1. Create a VM that uses dynamic Private Service Connect interfaces.
  2. Configure routing for the new VM.
  3. Update your service to use the new VM.
  4. Delete the VM that uses virtual Private Service Connect interfaces.

Create and manage Private Service Connect interfaces by using instance templates

You can create and manage Private Service Connect interfaces by using instance templates.

After you create an instance template, you can use it to:

To create instance templates that use alias IP ranges or multiple Private Service Connect interfaces, use the same approach ascreating VMs with Private Service Connect interfaces. Instance templates only support specifying alias IP ranges by prefix length.

Console

  1. In the Google Cloud console, go to the Instance templates page:
    Go to Instance templates
  2. Click Create instance template.
  3. Enter a Name for the instance template.
  4. Click Advanced options.
  5. Click Networking.
  6. In the Network interfaces section, click the expander arrow.
  7. Select a network and subnetwork for the instance template's primary network interface.
  8. Click Done.
  9. To add a Private Service Connect interface, do the following. You can repeat these steps for each interface that you want to add:
    • For a virtual Private Service Connect interface, do the following:
      1. Click Add a network interface.
      2. For Interface type, select Private Service Connect.
    • For a dynamic Private Service Connect interface, do the following:
      1. Click Add dynamic network interface.
      2. For Interface type, select Private Service Connect.
      3. Select a parent network interface.
      4. Enter a VLAN ID.
  10. To complete the configuration of your Private Service Connect interface, do the following:
  11. Enter the URL of this interface's network attachment.
  12. Select an IP stack type for the interface. The network attachment's subnet determines the possible stack types.
  13. Optional: To add an alias IP range, do the following:
    1. In the Alias IP ranges section, click Add IP range.
    2. In the Prefix length box, enter the prefix length—for example, /30. You can add multiple alias IP ranges by clickingAdd IP range, and then entering the prefix length for each additional alias IP range that you want to add.
  14. Click Done.
  15. To create the VM, click Create.

gcloud

API

For more information about creating instance templates, seeCreate instance templates.

Describe a Private Service Connect interface

You can describe a VM to view the details of its Private Service Connect interfaces. Each interface's name, IP address, alias IP ranges, network attachment, and consumer subnet are listed in the network interfaces section of the VM's description.

Console

  1. In the Google Cloud console, go to the VM instances page.
    Go to VM instances
  2. Click the VM that has your Private Service Connect interface.
  3. In the Network interfaces section, view the details of your Private Service Connect interface.

gcloud

gcloud compute instances describe VM_NAME --zone=ZONE

Replace the following:

API

GET https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/instances/VM_NAME

Replace the following:

Terminate Private Service Connect interface connections

To terminate a connection between a virtual Private Service Connect interface and a network attachment, delete the interface's VM.

To terminate a connection between a dynamic Private Service Connect interface and a network attachment, do one of the following:

Remove a dynamic Private Service Connect interface

You can remove a dynamic Private Service Connect interface without restarting the associated VM.

Console

  1. In the Google Cloud console, go to the VM instances page:
    Go to VM instances
  2. Click the name of the VM that you want to update.
  3. Click Edit.
  4. In the Dynamic network interfaces section, clickDelete next to the interface that you want to delete.

gcloud

Use the gcloud compute instances network-interfaces delete command.

gcloud compute instances network-interfaces delete INSTANCE_NAME
--zone=ZONE
--network-interface=INTERFACE_NAME

Replace the following:

API

Send a request to theinstances.deleteNetworkInterface method.

HTTP method and URL:

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_NAME/deleteNetworkInterface?networkInterfaceName=INTERFACE_NAME

Replace the following:

Delete a VM with a Private Service Connect interface

Deleting a VM terminates any Private Service Connect interface connections.

For information about deleting a VM, seeDelete an instance.

What's next?

Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2026-06-15 UTC.