How to access BigQuery with Private Service Connect

[muktesh_arya]

Hi,

We have following requirement

1. Hub and spoke network topology, with PaloAlto as firewall and f5 for WAF in Transit VPC and shared VPC for applications.

2. VPC reside in Network Project, compute in Application project and analytics in Data project.

3. Give access to 3rd party to read data from BigQuery in Data project. 

Since 3rd party is also in GCP one way is to enable Private Google Access on consumer project and use Google's backbone network rather than internet. 

How can I use Private Service Connect to make request go via PaloAlto to inspect traffic? 

[Poala_Tenorio]

By following these steps, you can use Private Service Connect to route traffic via PaloAlto for inspection while maintaining a secure and private connection between your consumer project and the BigQuery service in your Data project:

Set up Private Service Connect endpoints for BigQuery in your Data project and your consumer project. This establishes a private connection between them, bypassing the public internet.

Update the routing tables in your VPCs to route traffic destined for the BigQuery service through the Private Service Connect endpoint. This ensures that traffic intended for BigQuery is directed through the private connection.

Configure the PaloAlto firewall to intercept and inspect traffic passing through it. You'll need to configure policies on the PaloAlto to allow traffic from the Private Service Connect endpoints. This ensures that traffic is inspected before reaching its destination.

Ensure that the necessary IAM roles and permissions are configured to allow traffic from your consumer project to access the BigQuery service. This ensures that authorized users can access the data they need while maintaining security.

After configuration, thoroughly test the setup to ensure that traffic is correctly routed through PaloAlto for inspection. Set up monitoring to detect any issues or anomalies in the traffic flow and ensure that traffic is being inspected as expected.