4.4 Deploying Models to Public and Private Endpoints
Key Takeaways
A public endpoint is reachable over the internet at a Google-managed address and is still authenticated and authorized by IAM; "public" describes the network path, not the access control.
Private Service Connect endpoints expose the model through a private IP inside the consumer VPC, so traffic never traverses the internet.
VPC Service Controls add an exfiltration perimeter that IAM alone cannot provide, blocking data movement to projects outside the perimeter even for authorized principals.
Private endpoints require DNS and connectivity design — private DNS zones, and Cloud VPN or Interconnect for on-premises callers.
Regional endpoints must match the data residency requirement; a private path does not by itself satisfy a residency obligation.
4.4 Deploying Models to Public and Private Endpoints
Blueprint reference: Section 4.2, "Deploying models to public and private endpoints."
The word "public" causes more confusion than any other term in this area, so start there.
Public Does Not Mean Unauthenticated
A public endpoint is reachable at a Google-managed regional address over the internet. Every request is still authenticated with Google Cloud credentials and authorized by IAM. A caller without the appropriate role gets a 403 regardless of where it sits on the network.
So "public endpoint" is a statement about the network path, not about access control. When a scenario objects that an endpoint is "exposed", the real requirement is almost always one of:
- Traffic must not traverse the public internet (a network path requirement).
- Data must not be able to leave a defined boundary (an exfiltration requirement).
- Callers live on-premises or in a peered VPC and must reach the model privately (a connectivity requirement).
Each maps to a different control, and conflating them is how wrong answers get chosen.
The Three Controls and What Each Actually Solves
| Requirement | Control | What it does |
|---|---|---|
| Who may call the model | IAM | Grants or denies the caller's identity |
| Traffic must stay off the public internet | Private Service Connect endpoint | Exposes the service through a private IP in the consumer VPC |
| Data must not leave a boundary, even for authorized users | VPC Service Controls | Defines a service perimeter; blocks reads and copies across it |
| On-premises callers must reach a private endpoint | Cloud VPN / Cloud Interconnect | Provides the network route into the VPC |
| Name resolution for the private address | Cloud DNS private zone | Resolves the service name to the private IP |
The exam's favourite pairing is IAM versus VPC Service Controls. IAM answers may this identity access this resource. VPC Service Controls answers may this data move to that place. An insider with legitimate read access is exactly the case IAM cannot address and VPC-SC can.
Private Service Connect for Inference
Private Service Connect (PSC) publishes the inference service into the consumer's VPC behind a private IP address. Requests originate inside the VPC, resolve to that private address, and reach the model without egressing to the internet.
Design elements that accompany it:
- A reserved internal IP in the consumer VPC for the endpoint.
- A private DNS zone so application code can use a hostname rather than a hard-coded IP.
- Firewall rules permitting the application subnets to reach the endpoint address.
- Routes from on-premises, if applicable, through Cloud VPN or Interconnect, plus DNS forwarding so on-premises resolvers can resolve the private zone.
The most common operational failure is DNS: connectivity is correct, the firewall allows the traffic, and the application still fails because the hostname resolves to the public address. When a scenario says "we configured a private endpoint but calls still leave the VPC," DNS resolution is the first thing to check.
Private Endpoints and Latency
There is a secondary benefit worth knowing: a private path can reduce and stabilize latency by avoiding internet routing variability, particularly for callers already inside Google Cloud. It is not the primary reason to choose PSC, and a scenario that only mentions latency is usually pointing at hardware, autoscaling, or regional placement instead.
Residency Is a Separate Axis
Making a path private does not make it compliant with a data residency rule. Residency is satisfied by deploying the endpoint in a region permitted by the requirement, and by ensuring the model, its logs, and its monitoring data also stay in that region. A private endpoint in the wrong region still violates residency; a public endpoint in the right region may satisfy it while failing a separate network-path requirement.
Related controls that show up in the same scenarios:
- CMEK for organization-controlled encryption of the model and its data.
- Request-response logging destination — prediction logs land in BigQuery, and that dataset's location is part of the residency story.
- Access Transparency and audit logs for evidencing who called what.
Choosing, in Practice
Callers are Google Cloud services in the same org, no network-path restriction
→ public endpoint + IAM (simplest, fully authenticated)
Security policy forbids inference traffic on the public internet
→ Private Service Connect endpoint + private DNS + firewall rules
Regulators require that data cannot be copied out of a defined boundary
→ add VPC Service Controls perimeter (with or without PSC)
Callers are on-premises
→ PSC + Cloud VPN/Interconnect + DNS forwarding
Data must remain in a specific country
→ choose the region; verify logs and monitoring destinations too
Exam Traps
- Believing a public endpoint is unauthenticated. IAM always applies.
- Using IAM to stop exfiltration. That is VPC Service Controls' job.
- Assuming a private endpoint satisfies residency. Region does that.
- Forgetting DNS when configuring Private Service Connect.
- Overlooking log destinations when reasoning about where data lives.
A security team objects that an inference endpoint is "publicly exposed." On investigation, all callers authenticate with service account credentials and unauthorized callers receive 403 responses. The team's actual policy is that inference traffic must not traverse the public internet. What should be implemented?
Tighten IAM so that only the two application service accounts hold the prediction role on the endpoint.
Deploy the model to a Private Service Connect endpoint with a private IP in the consumer VPC, backed by a private DNS zone and firewall rules.
Enable VPC Service Controls around the project so that the endpoint is no longer reachable from outside the perimeter.
Move the endpoint to a region closer to the callers so that traffic is routed within Google's network.
A regulator requires that training data and predictions cannot be copied into any project outside an approved boundary, even by employees who hold valid read permissions. Which control satisfies this?
Customer-managed encryption keys on all datasets and buckets within the boundary.
IAM conditions restricting access to requests originating from corporate IP ranges.
A VPC Service Controls perimeter enclosing the Agent Platform, BigQuery, and Cloud Storage resources, blocking data movement across the perimeter boundary.
Private Service Connect endpoints for every service so that all traffic stays on private addresses.
A team configures a Private Service Connect endpoint for their model, reserves the internal IP, and opens the firewall. Application calls still succeed but network traces show traffic leaving the VPC. What is the most likely cause?
The reserved internal IP is in a subnet range that overlaps the endpoint's managed range.
Private Service Connect only supports batch prediction, so online requests fall back to the public path.
The endpoint requires VPC Service Controls to be enabled before the private path becomes active.
The application hostname still resolves to the public endpoint address because no private DNS zone was configured for it.
A workload must keep all data physically within one country. The team deploys a Private Service Connect endpoint but the compliance review still fails. What did they most likely miss?
The endpoint and its prediction logging destination must be in a region located in that country; a private network path does not by itself constrain where data resides.
They needed to apply customer-managed encryption keys, without which residency cannot be asserted.
They needed to disable request-response logging entirely, since any logging violates residency.
They needed a VPC Service Controls perimeter, which is the mechanism that enforces regional residency.
Sections you finish are checked off in the contents.