启用对大多数 Google API 和服务的 API 访问权限，无论这些 Google API 和服务是否受 VPC Service Controls 支持。包括对 Google 地图、Google Ads、 Google Cloud以及大多数其他 Google API（包括以下列表）的 API 访问权限。不支持 Gmail 和 Google 文档等 Google Workspace Web 应用。不支持任何交互式网站。
阻止对不支持 VPC Service Controls 的 Google API 和服务进行访问。不支持 Google Workspace API 或 Google Workspace Web 应用（例如 Gmail 和 Google 文档）。
如果您只需要访问 VPC Service Controls 支持的 Google API 和服务，请选择 vpc-sc。vpc-sc 软件包不允许访问不支持 VPC Service Controls 的 Google API 和服务。1
1
如果您需要将用户限制为只可使用支持 VPC Service Controls 的 Google API 和服务，请使用 vpc-sc，因为它会针对数据渗漏提供额外的风险缓释措施。使用 vpc-sc 可拒绝对 VPC Service Controls 不支持的 Google API 和服务的访问权限。如需了解详情，请参阅 VPC Service Controls 文档中的设置专用连接。
单一全球 Google API
您可以使用 Private Service Connect 后端向单个受支持的全球 Google API 发送请求。支持以下 API：
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-07-26。"],[],[],null,["# Private Service Connect compatibility\n=====================================\n\nServices\n--------\n\nYou can access the following services by using\nPrivate Service Connect.\n\n### Google published services\n\n\n\u003cbr /\u003e\n\n### Third-party published services\n\n\n\u003cbr /\u003e\n\n### Self-managed published services\n\n### Global Google APIs\n\nEndpoints can target a bundle of global Google APIs or a single regional Google\nAPI. Backends can target a single global Google API or a single regional Google\nAPI.\n\n#### Bundles of global Google APIs\n\nYou can use Private Service Connect endpoints to send traffic\nto a bundle of Google APIs.\n\n\nWhen you create an endpoint to access\nGoogle APIs and services, you choose which bundle of APIs you need\naccess to---**All APIs** (`all-apis`) or\n**VPC-SC** (`vpc-sc`):\n\n- The `all-apis` bundle provides access to most Google APIs and services,\n including all `*.googleapis.com` service endpoints.\n\n- The `vpc-sc` bundle provides access to\n [APIs\n and services that support VPC Service Controls.](/vpc-service-controls/docs/supported-products#supported_products)\n\n| **Note:** Note: These bundles provide access to the same APIs that are available through the [Private Google Access VIPs](/vpc/docs/configure-private-google-access#domain-options)---`all-apis` is equivalent to `private.googleapis.com` and `vpc-sc` is equivalent to `restricted.googleapis.com`.\n\n\u003cbr /\u003e\n\n\nThe API bundles support only HTTP-based protocols over TCP (HTTP, HTTPS, and HTTP/2). All other\nprotocols, including MQTT and ICMP are not supported.\n\n^1^ If you need to restrict users to just the Google APIs and services that support [VPC Service Controls](/vpc-service-controls/docs), use `vpc-sc`, as it provides additional risk mitigation for data exfiltration. Using `vpc-sc` denies access to Google APIs and services that are not supported by VPC Service Controls. See [Setting up private\nconnectivity](/vpc-service-controls/docs/set-up-private-connectivity) in the VPC Service Controls documentation for more details.\n\n\u003cbr /\u003e\n\n#### Single global Google API\n\nYou can use Private Service Connect backends to send requests\nto a single supported global Google API. The following APIs are supported:\n\n\n- [Bigtable](/bigtable/docs/apis): `bigtable.googleapis.com` and `bigtableadmin.googleapis.com`\n- [Cloud Logging](/logging/docs/apis): `logging.googleapis.com`\n- [Spanner](/spanner/docs/apis): `spanner.googleapis.com`\n- [Cloud Storage](/storage/docs/apis): `storage.googleapis.com`\n- [Pub/Sub](/pubsub/docs/apis): `pubsub.googleapis.com`\n\n\u003cbr /\u003e\n\n### Regional Google APIs\n\nYou can use endpoints or backends to access regional Google APIs.\nFor a list of supported regional Google APIs, see [Regional service\nendpoints](/vpc/docs/regional-service-endpoints).\n\nTypes\n-----\n\nThe following tables summarize compatibility information for different\nPrivate Service Connect configurations.\n\nIn the following tables, a checkmark indicates\nthat a feature is supported, and a no symbol\nindicates that a feature isn't supported.\n\n### Endpoints and published services\n\nThis section summarizes the configuration options that are available for\nconsumers and producers when using endpoints to access published services.\n\n#### Consumer configuration\n\n\nThis table summarizes the supported configuration options and capabilities of\n[endpoints that access published\nservices](/vpc/docs/about-accessing-vpc-hosted-services-endpoints) based on target producer type.\n\n\u003cbr /\u003e\n\n\n\u003cbr /\u003e\n\n\nEndpoints that access a published service have the following limitations:\n\n- You can't create an endpoint in the same\n VPC network as the\n [published service](/vpc/docs/configure-private-service-connect-producer) that you\n are accessing.\n\n- [Packet Mirroring](/vpc/docs/packet-mirroring) can't mirror packets\n for Private Service Connect published services traffic.\n\n- Not all static routes with load balancer next hops are supported with\n Private Service Connect. For more information, see [Static routes with load\n balancer next hops](/vpc/docs/about-accessing-vpc-hosted-services-endpoints#routing).\n\n- [Connectivity Tests](/network-intelligence-center/docs/connectivity-tests/concepts/overview) can't test connectivity between an IPv6 endpoint and a published\n service.\n\n\u003cbr /\u003e\n\n#### Producer configuration\n\nThis table summarizes the supported configuration options and capabilities of\n[published services that are accessed by endpoints](/vpc/docs/about-vpc-hosted-services).\n\n\n\u003cbr /\u003e\n\n\nPublished services have the following limitations:\n\n- Load balancers that are configured with [multiple protocols](/load-balancing/docs/internal/setting-up-ilb-multiple-protocols)---protocol set to `L3_DEFAULT`---are not supported.\n- [Packet Mirroring](/vpc/docs/packet-mirroring) can't mirror packets for Private Service Connect published services traffic.\n- You must use the Google Cloud CLI or the API to create a service attachment that points to a forwarding rule that is used for [internal protocol forwarding](/load-balancing/docs/protocol-forwarding).\n\nFor issues and workarounds, see\n[Known issues](/vpc/docs/configure-private-service-connect-producer#known-issues).\n\n\u003cbr /\u003e\n\n\nDifferent load balancers support different port configurations; some load\nbalancers support a single port, some support a range of ports, and some support\nall ports. For more information, see [Port\nspecifications](/load-balancing/docs/forwarding-rule-concepts#port_specifications).\n\n### Backends and published services\n\n\nA\n[Private Service Connect backend for published services](/vpc/docs/private-service-connect-backends)\nrequires two load balancers---a consumer load balancer and a producer load\nbalancer. This section summarizes the configuration options that are available for\nconsumers and producers when using backends to access published services.\n\n\u003cbr /\u003e\n\n#### Consumer configuration\n\n\nThis table describes the consumer load balancers that are supported by\nPrivate Service Connect backends for published services, including\nwhich backend service protocols can be used with each consumer load balancer.\nThe consumer load balancers can access published services that are hosted on\n[supported producer load balancers](#producer-configuration-backends).\n\n\u003cbr /\u003e\n\n\n\u003cbr /\u003e\n\n#### Producer configuration\n\n\nThis table describes the configuration for producer load balancers\nthat are supported by Private Service Connect backends for\npublished services.\n\n\n| **Note:** To support access by a Private Service Connect backend in a global or cross-regional load balancer, the producer load balancer must have [global access](/load-balancing/docs/internal/setting-up-internal#ilb-global-access) turned on before the service attachment is created.\n\n\u003cbr /\u003e\n\n\nPublished services have the following limitations:\n\n- Load balancers that are configured with [multiple protocols](/load-balancing/docs/internal/setting-up-ilb-multiple-protocols)---protocol set to `L3_DEFAULT`---are not supported.\n- [Packet Mirroring](/vpc/docs/packet-mirroring) can't mirror packets for Private Service Connect published services traffic.\n- You must use the Google Cloud CLI or the API to create a service attachment that points to a forwarding rule that is used for [internal protocol forwarding](/load-balancing/docs/protocol-forwarding).\n\nFor issues and workarounds, see\n[Known issues](/vpc/docs/configure-private-service-connect-producer#known-issues).\n\n\u003cbr /\u003e\n\nFor an example backend configuration that uses a global external Application Load Balancer, see\n[Access published services through\nbackends](/vpc/docs/configure-private-service-connect-services-controls).\n\nTo publish a service, see [Publish\nservices](/vpc/docs/configure-private-service-connect-producer).\n\n### Endpoints and global Google APIs\n\nThis table summarizes the features that are supported by [endpoints used to\naccess Google APIs](/vpc/docs/about-accessing-google-apis-endpoints).\n\nTo create this configuration, see [Access Google APIs\nthrough endpoints](/vpc/docs/configure-private-service-connect-apis).\n\n\n\u003cbr /\u003e\n\n### Backends and global Google APIs\n\n|\n| **Preview**\n|\n|\n| This product or feature is subject to the \"Pre-GA Offerings Terms\" in the General Service Terms section\n| of the [Service Specific Terms](/terms/service-terms#1).\n|\n| Pre-GA products and features are available \"as is\" and might have limited support.\n|\n| For more information, see the\n| [launch stage descriptions](/products#product-launch-stages).\n\nThis table describes which load balancers can use a\nPrivate Service Connect backend to a global Google API.\n\n\n\u003cbr /\u003e\n\n### Endpoints and regional Google APIs\n\nThis table summarizes the features that are supported by [endpoints used to\naccess regional Google\nAPIs](/vpc/docs/about-accessing-regional-google-apis-endpoints).\n\n\n\u003cbr /\u003e\n\n### Backends and regional Google APIs\n\nThis table describes which load balancers can use a\n[Private Service Connect\nbackend](/vpc/docs/private-service-connect-backends) to access regional\nGoogle APIs.\n\nFor an example backend configuration that uses an internal Application Load Balancer,\nsee [Access regional Google APIs through\nbackends](/vpc/docs/configure-private-service-connect-controls).\n\n\n\u003cbr /\u003e\n\nWhat's next\n-----------\n\n- Learn about [accessing published services through endpoints](/vpc/docs/about-accessing-vpc-hosted-services-endpoints).\n- Learn about [accessing global Google APIs through endpoints](/vpc/docs/about-accessing-google-apis-endpoints).\n- Learn about [accessing regional Google APIs through endpoints](/vpc/docs/about-accessing-google-apis-endpoints).\n- Learn about [backends](/vpc/docs/private-service-connect-backends).\n- Learn about [publishing services](/vpc/docs/about-vpc-hosted-services)."]]
