Private IP overview

To keep your database traffic within a private network and minimize your attack surface, you can connect to your AlloyDB for PostgreSQL instances by using private IP addresses. Because private IP addresses are internal to your network and inaccessible from the public internet, they restrict network access to authorized private endpoints.

Private IP connectivity methods

To access your AlloyDB instances using private IP, you can choose either private services access or Private Service Connect. Because each connection method offers distinct advantages and trade-offs, use the information in this document to choose the best approach for your specific requirements.

Private services access

Private services access is implemented as a Virtual Private Cloud (VPC) peering connection between your VPC network and the underlying Google Cloud VPC network where your AlloyDB for PostgreSQL instance resides. The private connection lets VM instances in your VPC network and the services that you access communicate exclusively by using internal IP addresses. VM instances don't need internet access or external IP addresses to reach services that are available through private services access.

To automate the setup of AlloyDB clusters with private services access using Terraform, see Deploy AlloyDB using Terraform.

For more information about using private services access for connectivity, see Private services access overview.

Private Service Connect

Private Service Connect lets you create private and secure connections between your VPC networks and a Google Cloud service, such as AlloyDB for PostgreSQL. You can connect to your AlloyDB instance from multiple VPC networks that belong to different groups, teams, projects, or organizations. When you create an AlloyDB cluster, you can enable it to support Private Service Connect. When creating an AlloyDB instance within the cluster, you specify which projects from your VPC network can access it.

For more information about using Private Service Connect, see Private Service Connect overview and the video What is Private Service Connect?.

Choose between methods to use

Before you decide whether to use private services access or Private Service Connect as your connection method, consider the following comparison:

Private services access Private Service Connect
Requires reserving a CIDR range (/24 at a minimum) from the consumer VPC network. A range of IP addresses is reserved regardless of whether they are in use, locking all IP addresses in the range. Requires a single IP address to create a forwarding rule at the endpoint per VPC network.
Supports connections only from clients in RFC 1918 IP ranges (10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16). If you require connectivity from clients that are outside RFC 1918 ranges, use Private Service Connect. Both RFC 1918 and non-RFC 1918 ranges can be used for endpoints.
Connects to projects within the same VPC network. Connects across multiple VPC networks or projects.
Well-suited for small-scale, single-VPC scenarios. Well-suited for large-scale, multi-VPC setups.
Minimal cost because you use existing VPC peering included in your project. Higher cost compared to private services access due to costs for each endpoint per hour and data transfer per GiB.
Less isolated compared to Private Service Connect due to VPC Network Peering. More isolated due to separation of consumer and producer VPC networks.
Connections are bidirectional, allowing both inbound and outbound traffic. By default, connections are unidirectional, allowing inbound connections only. Additional configuration is required for outbound connections.

What's next