We are planning to use Big Query and Cloud Storage but have questions regarding access via VPN/VPC.
As Big Query, GCS are managed services is it correct to assume that it is not possible to restrict access to project level buckets and data sets to connections inbound to the VPC.
As we understand it, these services authenticate against Googles Global API Infrastructure and by definition are publicly exposed.
Is it possible to restrict access to Google Managed Services to a inbound VPC connection and remove public / internet based authentication and authorization for our projects?
I think this can be achieved through something now called "Private Service Connect" under GCP
https://cloud.google.com/vpc/docs/private-service-connect
https://medium.com/google-cloud/private-service-connect-c99e3e94537b