Detections
Analytics

3.9 Ensure Private Service Connect is Used for Access to Google APIs

Information

Ensure that VPCs use Private Service Connect endpoints for access to Google APIs such as Cloud Storage, BigQuery, Pub/Sub, Artifact Registry, and other googleapis.com services, so that traffic from workloads to these APIs stays on the Google private network instead of traversing the public internet. Private Service Connect for Google APIs creates a dedicated endpoint in your VPC with firewall rule enforcement, providing more granular control than Private Google Access.

Accessing Google APIs over the public internet exposes traffic to network-level threats, requires managing NAT gateways or external IPs, and makes it harder to enforce egress controls. Private Service Connect for Google APIs allows workloads to reach googleapis.com services over Google's private network using a dedicated endpoint in your VPC. Combined with VPC firewall rules, PSC ensures only authorized workloads from specific subnets or with specific network tags can access Google APIs, preventing unauthorized API usage and enforcing least-privilege network access. This control eliminates reliance on internet connectivity for API access, enables granular network segmentation per API consumer, supports VPC Service Controls integration, and is essential for zero-trust architectures requiring all Google API traffic to remain on private networks.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

From Google Cloud CLI

 - Create Private Service Connect endpoint for Google APIs

Reserve an internal IP address for the PSC endpoint:

gcloud compute addresses create psc-apis-endpoint \\
 --global \\
 --purpose=PRIVATE_SERVICE_CONNECT \\
 --addresses=192.168.1.5 \\
 --network=projects/PROJECT_ID/global/networks/VPC_NAME

- Choose an IP address from RFC 1918 private range that doesn't conflict with existing subnet ranges in your VPC. Use gcloud compute networks subnets list --network=VPC_NAME to check existing subnet ranges.

2. Create the PSC endpoint forwarding rule targeting Google's all-apis service attachment:

gcloud compute forwarding-rules create pscapis \\
 --global \\
 --network=VPC_NAME \\
 --address=psc-apis-endpoint \\
 --target-google-apis-bundle=all-apis

3. Configure DNS to resolve googleapis.com to PSC endpoint

Create a private DNS zone for googleapis.com:

gcloud dns managed-zones create googleapis-private-zone \\
 --description="Private zone for googleapis.com" \\
 --dns-name=googleapis.com. \\
 --networks=VPC_NAME \\
 --visibility=private

Add wildcard A record pointing to the PSC endpoint IP:

gcloud dns record-sets create '*.googleapis.com.' \\
 --zone=googleapis-private-zone \\
 --type=A \\
 --ttl=300 \\
 --rrdatas=192.168.1.5

- Replace 192.168.1.5 with the PSC endpoint IP from Step 1.
- Optional: If your organization uses Container Registry (gcr.io) or Artifact Registry (pkg.dev), create additional DNS zones following the same pattern:

4. Configure VPC firewall rules to restrict PSC endpoint access

Create firewall rule allowing only specific subnets to access the PSC endpoint:

gcloud compute firewall-rules create allow-psc-apis-from-app-subnet \\
 --network=VPC_NAME \\
 --allow=tcp:443 \\
 --source-ranges=10.0.0.0/24 \\
 --destination-ranges=192.168.1.5/32 \\
 --description="Allow HTTPS to PSC endpoint from application subnet only"

 - Adjust --source-ranges to match your application subnet CIDR.
- Use --source-tags for tag-based restrictions.

5. Test connectivity from a VM

From a VM in the VPC (without external IP), test that Google API calls resolve to the private PSC endpoint:

# Test DNS resolution using getent
getent hosts storage.googleapis.com

# Should return: 192.168.1.5 storage.googleapis.com (PSC endpoint IP, not public IP)

# Test Cloud Storage access
gsutil ls gs://BUCKET_NAME

# Should succeed without requiring external IP or NAT gateway

 - Remove NAT gateway or external IPs (after validation)

Once PSC connectivity is validated, remove unnecessary NAT gateways or external IPs that were previously required for Google API access.

Impact:

Implementing Private Service Connect for Google APIs requires creating PSC endpoints in each VPC and configuring DNS to resolve googleapis.com domains to the private endpoint IP addresses. This introduces per-endpoint charges and operational overhead for DNS management. Migrating from public API access requires updating DNS configurations, may require changes to firewall rules, and testing to ensure all Google API calls resolve correctly to private endpoints. There is no performance impact on API availability or latency. Workloads without proper firewall rules or DNS configuration will be unable to reach Google APIs after migration.

See Also

https://workbench.cisecurity.org/benchmarks/22181

Item Details

Category: SECURITY ASSESSMENT AND AUTHORIZATION, CONFIGURATION MANAGEMENT, CONTINGENCY PLANNING, PLANNING, PROGRAM MANAGEMENT, SYSTEM AND SERVICES ACQUISITION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CA-9, 800-53|CM-7, 800-53|CP-6, 800-53|CP-7, 800-53|PL-8, 800-53|PM-7, 800-53|SA-8, 800-53|SC-7

Plugin: GCP

Control ID: 27b1466b74840c666dcff1c404eb80a78139cd92a79cc58b35dda7e822b5eae9