14.2 Public, Dedicated & Private Endpoints

The exam guide lists deploying models to public and private endpoints. Endpoint choice is mostly a networking and security decision, but it also limits payload size, timeouts, streaming, traffic splitting, and logging.

The Four Endpoint Types

Dedicated and PSC endpoints support predict, rawPredict, streamRawPredict, and Chat Completion (Model Garden). gRPC requests must include the x-vertex-ai-endpoint-id header.

Private Service Connect Endpoints

Private Service Connect (PSC) puts a forwarding rule in your VPC that connects to a service attachment exposing Agent Platform inference. Benefits:

• No public IPs, no public internet path, and no peered IP range to plan.
• Serve multiple consumer projects and VPCs privately.
• Reach from on-premises over Cloud Interconnect or VPN.
• Works inside VPC Service Controls perimeters.
• Keeps dedicated-endpoint features such as streaming, gRPC, traffic splitting, and logging.

Google recommends PSC when inference must be private, secure, low latency, and not publicly accessible.

Private Services Access Endpoints (VPC Peering)

The older private option peers your VPC with the Agent Platform service network. Limitations to know:

• One model per endpoint, so no traffic splitting for canaries or A/B tests.
• No request-response or access logging.
• 60-second timeout and no streaming.
• Supports AutoML tabular and custom-trained models.
• Needs a reserved IP range and an active peering connection.

If a scenario needs private access and canary rollouts or logging for monitoring, choose PSC, not VPC peering.

Choosing an Endpoint

Security Layers Beyond the Endpoint Type

• IAM: callers need permission to invoke the endpoint (for example, through the Agent Platform User role or a custom role scoped to prediction). Use service accounts for applications.
• VPC Service Controls: keep endpoints, models, and training data inside a perimeter to reduce exfiltration risk (Chapter 18).
• CMEK: encrypt model artifacts and endpoint resources with customer-managed keys where policy requires.
• Deployed model service account: give the serving container a least-privilege identity for any Google Cloud calls it makes.
• Audit logs: Cloud Audit Logs record administrative actions such as deploy and undeploy.

How Clients Reach a Private Service Connect Endpoint

1. Create the endpoint with Private Service Connect enabled, and list the consumer projects allowed to connect.
2. In each consumer VPC, create a forwarding rule (the PSC endpoint) with an internal IP address that targets the endpoint's service attachment.
3. Optionally create a private DNS record so applications call a stable hostname instead of an IP address.
4. Applications in that VPC, and on-premises systems connected through Cloud Interconnect or VPN, send requests to that internal address with normal IAM authentication.
5. Deploy models and manage traffic splits on the endpoint as usual. The network path stays private.

Migrating Between Endpoint Types

An endpoint's networking type is set when the endpoint is created, so the usual pattern is to create the new endpoint (for example, PSC), deploy the same model version to it, move clients over gradually (DNS or configuration change), and then undeploy from the old endpoint. Keep the Model Registry version identical so predictions don't change during the move.

Common Mistakes

• Choosing a dedicated public endpoint for a workload that must sit inside a VPC Service Controls perimeter.
• Choosing a VPC-peering private endpoint and later discovering that canary rollouts and request logging aren't possible.
• Sending large base64 payloads to a shared public endpoint and hitting the 1.5 MB limit.
• Exposing internal-only models publicly and relying on IAM alone when policy forbids public paths.

Performance Notes

• Dedicated and private endpoints have optimized network latency compared with shared public endpoints.
• Large payloads such as images are better sent as Cloud Storage URIs when possible, even when 10 MB is allowed.
• Use gRPC on dedicated or PSC endpoints for lower serialization overhead at high QPS.
• Keep clients and endpoints in the same region.

Worked Scenario

A hospital network serves an imaging model to clinical apps. Requirements: no public exposure, a VPC Service Controls perimeter around PHI, 4 MB DICOM-derived payloads, gradual rollout of new versions, and request logging for audits.

• Shared public fails the payload limit and public exposure rules. Dedicated public fails VPC Service Controls. VPC-peering private endpoints fail traffic splitting and logging.
• Answer: a dedicated private endpoint using Private Service Connect.