Shared VPC is an optional deployment model that lets an organization
connect resources from multiple projects to a common VPC network. Organization
administrators can use Shared VPC to delegate administrative
responsibilities while maintaining centralized control over network resources,
such as subnets, routes, and firewalls.

> [!NOTE]
> **Note:** Private clusters and Shared VPC are independent features. You can use a private cluster either in a standard VPC network or in a Shared VPC network.

## Grant the required roles

The [Cloud Workstations Service
Agent](https://docs.cloud.google.com/workstations/docs/service-accounts#workstations-service-agent) allows
Cloud Workstations perform service duties on your project. When you activated
the Cloud Workstations Service in your project, the service agent was
automatically created. To enable Cloud Workstations to use your Shared VPC
network and subnetwork, grant the Cloud Workstations Service Agent for your
project the [Compute Engine Network User
role](https://docs.cloud.google.com/compute/docs/access/iam#compute.networkUser)
(`roles/compute.networkUser`) on the Shared VPC subnet.

1. To retrieve the Cloud Workstations Service Agent for your project, use the
   following command:

       gcloud beta services identity create \
           --service=workstations.googleapis.com \
           --project=WORKSTATIONS_PROJECT_ID

   Replace `WORKSTATIONS_PROJECT_ID` with the ID of the
   project where you will create your workstations cluster.

   The Cloud Workstations Service Agent uses the following format:  

   `service-$WORKSTATIONS_PROJECT_NUMBER@gcp-sa-workstations.iam.gserviceaccount.com`.
2. Grant the Cloud Workstations Service Agent the [Compute Engine Network
   User role](https://docs.cloud.google.com/compute/docs/access/iam#compute.networkUser)
   (`roles/compute.networkUser`) role on the Shared VPC subnet.

## Create workstation clusters using a Shared VPC

When you [create your workstation
cluster](https://docs.cloud.google.com/workstations/docs/create-configuration)
in the Google Cloud console, specify the Shared VPC network and subnetwork.
This step is only possible if the subnet is shared with the user using the
console. For more information, see [Provision
Shared VPC](https://docs.cloud.google.com/vpc/docs/provisioning-shared-vpc)
.

For general information about Shared VPC access, see
[Shared VPC](https://docs.cloud.google.com/vpc/docs/shared-vpc)
.

When you create a workstation cluster, Cloud Workstations associates the cluster
with a particular subnet and all workstations are placed in that subnet. To
enable VPC Flow Logs, make sure that you turn on logging for
that subnet. For more information, see
[Enable VPC Flow Logs for an existing subnet](https://docs.cloud.google.com/vpc/docs/using-flow-logs#enable-logging-existing).

> [!TIP]
> **Tip:** When using Shared VPC, make sure that you add and configure firewall rules for the Shared VPC network. For more information, see [Configure firewall
> rules](https://docs.cloud.google.com/workstations/docs/configure-firewall-rules) .

## What's next

- [Troubleshoot policy and access problems](https://docs.cloud.google.com/vpc/docs/troubleshooting-policy-and-access-problems)
- [Configure VPC Service Controls and private clusters](https://docs.cloud.google.com/workstations/docs/configure-vpc-service-controls-private-clusters)
- [Enable VPC Flow Logs](https://docs.cloud.google.com/vpc/docs/using-flow-logs#enabling-vpc-flow-logs)