4.4 Deploying Models to Public and Private Endpoints
Key Takeaways
- A public endpoint is reachable over the internet at a Google-managed address and is still authenticated and authorized by IAM; "public" describes the network path, not the access control.
- Private Service Connect endpoints expose the model through a private IP inside the consumer VPC, so traffic never traverses the internet.
- VPC Service Controls add an exfiltration perimeter that IAM alone cannot provide, blocking data movement to projects outside the perimeter even for authorized principals.
- Private endpoints require DNS and connectivity design — private DNS zones, and Cloud VPN or Interconnect for on-premises callers.
- Regional endpoints must match the data residency requirement; a private path does not by itself satisfy a residency obligation.
4.4 Deploying Models to Public and Private Endpoints
Blueprint reference: Section 4.2, "Deploying models to public and private endpoints."
The word "public" causes more confusion than any other term in this area, so start there.
Public Does Not Mean Unauthenticated
A public endpoint is reachable at a Google-managed regional address over the internet. Every request is still authenticated with Google Cloud credentials and authorized by IAM. A caller without the appropriate role gets a 403 regardless of where it sits on the network.
So "public endpoint" is a statement about the network path, not about access control. When a scenario objects that an endpoint is "exposed", the real requirement is almost always one of:
- Traffic must not traverse the public internet (a network path requirement).
- Data must not be able to leave a defined boundary (an exfiltration requirement).
- Callers live on-premises or in a peered VPC and must reach the model privately (a connectivity requirement).
Each maps to a different control, and conflating them is how wrong answers get chosen.
The Three Controls and What Each Actually Solves
| Requirement | Control | What it does |
|---|---|---|
| Who may call the model | IAM | Grants or denies the caller's identity |
| Traffic must stay off the public internet | Private Service Connect endpoint | Exposes the service through a private IP in the consumer VPC |
| Data must not leave a boundary, even for authorized users | VPC Service Controls | Defines a service perimeter; blocks reads and copies across it |
| On-premises callers must reach a private endpoint | Cloud VPN / Cloud Interconnect | Provides the network route into the VPC |
| Name resolution for the private address | Cloud DNS private zone | Resolves the service name to the private IP |
The exam's favourite pairing is IAM versus VPC Service Controls. IAM answers may this identity access this resource. VPC Service Controls answers may this data move to that place. An insider with legitimate read access is exactly the case IAM cannot address and VPC-SC can.
Private Service Connect for Inference
Private Service Connect (PSC) publishes the inference service into the consumer's VPC behind a private IP address. Requests originate inside the VPC, resolve to that private address, and reach the model without egressing to the internet.
Design elements that accompany it:
- A reserved internal IP in the consumer VPC for the endpoint.
- A private DNS zone so application code can use a hostname rather than a hard-coded IP.
- Firewall rules permitting the application subnets to reach the endpoint address.
- Routes from on-premises, if applicable, through Cloud VPN or Interconnect, plus DNS forwarding so on-premises resolvers can resolve the private zone.
The most common operational failure is DNS: connectivity is correct, the firewall allows the traffic, and the application still fails because the hostname resolves to the public address. When a scenario says "we configured a private endpoint but calls still leave the VPC," DNS resolution is the first thing to check.
Private Endpoints and Latency
There is a secondary benefit worth knowing: a private path can reduce and stabilize latency by avoiding internet routing variability, particularly for callers already inside Google Cloud. It is not the primary reason to choose PSC, and a scenario that only mentions latency is usually pointing at hardware, autoscaling, or regional placement instead.
Residency Is a Separate Axis
Making a path private does not make it compliant with a data residency rule. Residency is satisfied by deploying the endpoint in a region permitted by the requirement, and by ensuring the model, its logs, and its monitoring data also stay in that region. A private endpoint in the wrong region still violates residency; a public endpoint in the right region may satisfy it while failing a separate network-path requirement.
Related controls that show up in the same scenarios:
- CMEK for organization-controlled encryption of the model and its data.
- Request-response logging destination — prediction logs land in BigQuery, and that dataset's location is part of the residency story.
- Access Transparency and audit logs for evidencing who called what.
Choosing, in Practice
Callers are Google Cloud services in the same org, no network-path restriction
→ public endpoint + IAM (simplest, fully authenticated)
Security policy forbids inference traffic on the public internet
→ Private Service Connect endpoint + private DNS + firewall rules
Regulators require that data cannot be copied out of a defined boundary
→ add VPC Service Controls perimeter (with or without PSC)
Callers are on-premises
→ PSC + Cloud VPN/Interconnect + DNS forwarding
Data must remain in a specific country
→ choose the region; verify logs and monitoring destinations too
Exam Traps
- Believing a public endpoint is unauthenticated. IAM always applies.
- Using IAM to stop exfiltration. That is VPC Service Controls' job.
- Assuming a private endpoint satisfies residency. Region does that.
- Forgetting DNS when configuring Private Service Connect.
- Overlooking log destinations when reasoning about where data lives.
A security team objects that an inference endpoint is "publicly exposed." On investigation, all callers authenticate with service account credentials and unauthorized callers receive 403 responses. The team's actual policy is that inference traffic must not traverse the public internet. What should be implemented?
A regulator requires that training data and predictions cannot be copied into any project outside an approved boundary, even by employees who hold valid read permissions. Which control satisfies this?
A team configures a Private Service Connect endpoint for their model, reserves the internal IP, and opens the firewall. Application calls still succeed but network traces show traffic leaving the VPC. What is the most likely cause?
A workload must keep all data physically within one country. The team deploys a Private Service Connect endpoint but the compliance review still fails. What did they most likely miss?