Private access

VMs with only internal IP addresses can access a Google API's external IP addresses using Private Google Access. This access is enabled per subnet. This setting does not affect the VMs with external IP addresses. It is also possible to allow private access for your on-premises VMs. This requires a VPN to be configured. Note that not all services are available for private access.

For more details, check out the Google documentation at https://cloud.google.com/vpc/docs/private-access-options.