Private Service Connect

GCP Private Service Connect (PSC) exposes a Managed deployment through a service attachment, a private service connection for consumers. Consumers in your project or other permitted projects create PSC endpoints in their VPCs. Traffic stays within Google's network and does not cross the public internet.

Why Private Service Connect

PSC provides the GCP equivalent of AWS PrivateLink. It exposes a service rather than connecting two entire VPCs. The connection has these properties:

• Consumer and deployment address ranges can overlap.
• You can permit other GCP projects without sharing VPCs.
• Consumers connect to the deployment. The connection does not let the deployment reach into consumer VPCs.
• Multiple consumers can connect independently.

How It Works

A connection follows this sequence:

1. You create a service attachment for the deployment.
2. LaserData creates it behind the deployment's internal load balancer.
3. Consumers create PSC endpoints with the attachment URI.
4. Traffic passes privately through Google's network from those endpoints to the deployment.

Prerequisites

You need a running Managed GCP deployment on Enterprise. The account plan must enable private networking.

Creating a Service Attachment

From the Console

1. Open your deployment's Networking tab.
2. Click Add Private Service Connect.
3. Enter an attachment name that is unique within the deployment.
4. Choose manual or automatic acceptance. Manual acceptance is the default.
5. If access is limited to selected projects, add their IDs to the consumer accept list.
6. If the connection header needs the original client IP, enable proxy protocol.
7. Click Create.

Manual acceptance requires approval before traffic can flow. Automatic acceptance approves connections without a separate action. With an empty consumer accept list, any project can request access under the selected policy.

LaserData returns the attachment URI, such as projects/ld-prod/regions/us-central1/serviceAttachments/my-attachment. Consumers use this URI to create endpoints.

What Gets Created

LaserData creates and configures these resources:

• A GCP PSC Service Attachment linked to the deployment's internal load balancer.
• NAT subnets for the attachment.
• The acceptance policy and consumer accept lists.
• An attachment URI for consumers to use.

Connecting as a Consumer

After the attachment exists, configure an endpoint in the consumer's GCP project.

Step 1 - Create the PSC Endpoint

In the consumer project:

1. Open Google Cloud Console.
2. Open Network services, then Private Service Connect.
3. Click Connect to a published service.
4. Enter the attachment URI from its owner.
5. Select a subnet and IP address in your VPC.
6. Click Add endpoint.

Step 2 - Accept the Connection (if manual)

With accept_manual, a connection remains pending until the owner accepts it. Open the attachment's pending connections in LaserData Console. Accept the connection to permit traffic.

Step 3 - Connect

When the status is accepted, applications use the endpoint's assigned private IP address. The consumer does not need an internet gateway or NAT for this connection.

Managing Service Attachments

The Networking tab lists attachment URIs, acceptance policies, consumer accept lists, NAT subnets, and connection statuses. Deleting an attachment removes the GCP service attachment. Connected endpoints then stop working. Consumers must remove their endpoint resources separately.

Plan Limits

Audit

The audit log records attachment creation, configuration details, and the requester. It also records who deleted an attachment and when.

API Reference

Use API keys for these requests. Creating and deleting attachments require deployment:network:manage. Listing attachments, instructions, and connections requires deployment:network:read.

Create a Service Attachment

curl -X POST {supervisor_url}/deployments/{deployment_id}/network/gcp/psc \
  -H "ld-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "iggy-psc-attachment",
    "connection_preference": "accept_manual",
    "consumer_accept_lists": [
      "my-gcp-project-123"
    ],
    "enable_proxy_protocol": false,
    "remarks": "PSC for production consumers"
  }'

A successful request returns 204 No Content.

List Service Attachments

curl {supervisor_url}/deployments/{deployment_id}/network/gcp/psc \
  -H "ld-api-key: YOUR_API_KEY"

[
  {
    "id": 1,
    "name": "iggy-psc-attachment",
    "attachment_id": "psc-abc123def456",
    "service_attachment_uri": "projects/ld-prod/regions/us-central1/serviceAttachments/iggy-psc-attachment",
    "target_service": "projects/ld-prod/regions/us-central1/backendServices/ld-backend",
    "connection_preference": "accept_manual",
    "consumer_accept_lists": ["my-gcp-project-123"],
    "nat_subnets": ["projects/ld-prod/regions/us-central1/subnetworks/psc-nat-subnet"],
    "enable_proxy_protocol": false,
    "state": "active",
    "remarks": "PSC for production consumers",
    "created_at": "2026-03-20T10:30:00Z",
    "updated_at": "2026-03-20T10:30:00Z"
  }
]

Attachment states are pending, active, and closed. Connection statuses are pending, accepted, rejected, closed, and needs_attention.

Get Setup Instructions

The response explains how a consumer connects to the attachment:

curl {supervisor_url}/deployments/{deployment_id}/network/gcp/psc/{attachment_id}/instructions \
  -H "ld-api-key: YOUR_API_KEY"

{
  "service_attachment_uri": "projects/ld-prod/regions/us-central1/serviceAttachments/iggy-psc-attachment",
  "connection_preference": "accept_manual",
  "instructions": [
    "In your GCP project, navigate to Network services → Private Service Connect",
    "Click 'Connect to a published service' and enter the target service: projects/ld-prod/regions/us-central1/serviceAttachments/iggy-psc-attachment",
    "Select a subnet and IP address in your VPC for the PSC endpoint",
    "Click 'Add endpoint' to create the PSC connection",
    "The connection preference is ACCEPT_MANUAL - your connection will be pending until accepted by the service producer",
    "Once the connection status is ACCEPTED, use the assigned private IP to reach the service"
  ]
}

List Connections

The response lists the attachment's current PSC endpoint connections:

curl {supervisor_url}/deployments/{deployment_id}/network/gcp/psc/{attachment_id}/connections \
  -H "ld-api-key: YOUR_API_KEY"

[
  {
    "id": 1,
    "connection_id": "psc-conn-xyz789",
    "consumer_project_id": "my-gcp-project-123",
    "consumer_network": "projects/my-gcp-project-123/global/networks/default",
    "consumer_forwarding_rule": "projects/my-gcp-project-123/regions/us-central1/forwardingRules/psc-fr-1",
    "status": "accepted",
    "error_info": null,
    "created_at": "2026-03-21T14:00:00Z",
    "updated_at": "2026-03-21T14:05:00Z"
  }
]

Delete a Service Attachment

curl -X DELETE {supervisor_url}/deployments/{deployment_id}/network/gcp/psc/{attachment_id} \
  -H "ld-api-key: YOUR_API_KEY"

A successful request returns 204 No Content.