Create and manage network attachments

This page describes how consumer network administrators can create and manage Private Service Connect network attachments. Network attachments let service producer VPC networks initiate connections to consumer VPC networks.

Before you begin

You must enable the Compute Engine API in your project.
If you want to manually specify which projects can connect to a network attachment, you need to know the IDs of the projects.

Roles

To get the permissions that you need to create, view, and delete network attachments, ask your administrator to grant you the Compute Network Admin (roles/compute.networkAdmin) IAM role on your project. For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

Create a subnet

When you create a network attachment, you assign it a single regular subnet. This subnet must be in the same region as the network attachment. One subnet can be shared across multiple network attachments. Subnets with the dual-stack or IPv6-only stack type must use internal IPv6 address ranges.

For more information about creating subnets, see Create and manage VPC networks.

Create network attachments

Network attachments are regional resources that represent the consumer side of a Private Service Connect interface connection. A network attachment must be in the same region as the associated Private Service Connect interface's VM.

The network attachment's authorization policy determines whether a network attachment can accept a connection from a Private Service Connect interface.

You can update the subnet, accept list, reject list, and description of a network attachment.

Create a network attachment that manually accepts connections

You can create a network attachment that manually accepts connections. Before you create an attachment of this type, make sure that you know either the project IDs or the service class IDs of the producers that you want to accept.

The accept and reject lists can contain either project IDs or service class IDs, but not a mix of both.

Console

In the Google Cloud console, go to the Private Service Connect page:

Go to Private Service Connect
Click Network attachments.
Click Create network attachment.
Enter a Name.
Select a Network.
Select a Region.
Select a Subnetwork.
Do one of the following:
- To accept connections based on project ID:
  1. Select Accept connections for selected projects.
  2. For each project that you want to accept, click Add accepted project, and then enter the project ID to accept.
  3. Optional: For each project that you want to explicitly reject, click Add rejected project, and then enter the project ID to reject.
- To accept connections based on service class ID:
  1. Select Accept connections for selected service classes.
  2. For each service class that you want to accept, click Add accepted service class, and then select the service class to accept.
  3. Optional: For each service class that you want to explicitly reject, click Add rejected service class, and then select the service class to reject.
Click Create network attachment.

gcloud

Use the network-attachments create command.

gcloud compute network-attachments create ATTACHMENT_NAME \
    --region=REGION \
    --connection-preference=ACCEPT_MANUAL \
    --producer-accept-list=ACCEPTED_PRODUCERS \
    --producer-reject-list=REJECTED_PRODUCERS \
    --subnets=SUBNET_NAME

Replace the following:

ATTACHMENT_NAME: the name of the network attachment.
REGION: the region of the network attachment.
ACCEPTED_PRODUCERS: a comma-separated list of producers that are authorized to connect to this network attachment. You can specify producers in one of the following ways:
- By project ID: for example, project-id-1,project-id-2.
- By service class ID: each ID must use the serviceclasses/ prefix—for example, serviceclasses/service-class1,serviceclasses/service-class2.
REJECTED_PRODUCERS: a comma-separated list of project IDs or service class IDs that are explicitly rejected from connecting to this network attachment. Specify producers using the same format as the consumer accept list.
SUBNET_NAME: the name of the subnet to associate with this network attachment.

API

Make a POST request to the networkAttachments.insert method.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/networkAttachments
{
  "connectionPreference": "ACCEPT_MANUAL",
  "name": "ATTACHMENT_NAME",
  "producerAcceptLists": [
    "ACCEPTED_PRODUCERS"
  ],
  "producerRejectLists": [
    "REJECTED_PRODUCERS"
  ],
  "subnetworks": [
    "https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/subnetworks/SUBNET_NAME"
  ]
}

Replace the following:

PROJECT_ID: the ID of the project to create the network attachment in.