This document describes the options you have for configuring a Cloud SQL instance
to support private IP connections.

Private IP connections offer better security and lower latency than public IP
connections. You can use private IP connections to provide access across regions
to your Cloud SQL instance as well as connections to external sources.

You can connect to your instance using a [Shared VPC](https://docs.cloud.google.com/vpc/docs/shared-vpc.md.txt)
between projects.

For Terraform solutions for Cloud SQL networking, see
[Simplified cloud networking configuration solutions](https://github.com/GoogleCloudPlatform/cloudnetworking-config-solutions).

## Private IP connection options

Use one or both of the following two methods to configure a Cloud SQL
instance with a private IP address:

- [Private Service Connect](https://docs.cloud.google.com/sql/docs/postgres/about-private-service-connect.md.txt):
  gives you the flexibility of connecting from multiple VPC networks,
  including cross-cloud and on-premise VPC networks.
  Private Service Connect is recommended over private services access
  because it provides better IP address space management, scalability and security
  controls. Private Service Connect is the default private IP
  connectivity option in the Google Cloud console for new projects.
  For more information, see the
  [Overview of Private Service Connect in Cloud SQL](https://docs.cloud.google.com/sql/docs/postgres/about-private-service-connect.md.txt).

- [Private services access](https://docs.cloud.google.com/sql/docs/postgres/about-private-services-access.md.txt):
  is an earlier type of private IP connectivity, based on VPC Network Peering.
  Private services access only allows connections from one
  VPC network. You need additional configuration to
  [connect from multiple VPC networks](https://docs.cloud.google.com/sql/docs/postgres/connect-multiple-vpcs.md.txt).
  For more information, see the
  [Overview of private services access in Cloud SQL](https://docs.cloud.google.com/sql/docs/postgres/about-private-services-access.md.txt).
  VPC networks.

When you use the Google Cloud console to create a Cloud SQL
instance, if you choose **Private IP** under **Connections** , then, depending
on your use case, you can select either **Private Service Connect (PSC)**
(default), **Private Service Access (PSA)**, or both.

### Restrictions for private IP connection options

The following restrictions apply to private IP connections:

- Instances configured with Private Service Connect don't have visibility into the IP addresses of clients.
- Instances configured with both Private Service Connect and private services access can't change the [associated VPC network](https://docs.cloud.google.com/sql/docs/postgres/configure-private-services-access.md.txt#change-psa-config) for private services access.

## Requirements for private IP connections

To create and manage private IP connections using either private services
access or Private Service Connect, your network and application
environment must meet certain requirements, and you need to have the right
Identity and Access Management permissions. For the full list of API and IAM
requirements, see the following pages:

- [Configure private services access](https://docs.cloud.google.com/sql/docs/postgres/configure-private-services-access.md.txt)
- [Configure Private Service Connect](https://docs.cloud.google.com/sql/docs/postgres/configure-private-service-connect.md.txt)