A company runs a legacy application on a Compute Engine VM. The VM must remain private (no external IP address) but needs to download security…

The core requirement is to provide outbound internet access to a Compute Engine VM that has no external IP address. Cloud NAT is a managed Google Cloud service designed specifically for this purpose. It allows instances in a private subnet to initiate outbound connections to the internet for tasks like downloading updates or patches, while preventing unsolicited inbound connections. It is the most direct, secure, and minimal cloud-native component to fulfill this requirement without exposing the VM to the internet.

A. A Cloud VPN connection to an on-premises NAT gateway.

This is a complex solution that creates an unnecessary dependency on on-premises infrastructure. While technically feasible, it is not the minimum or most efficient cloud-native component for this task.

B. A VPC Service Control perimeter.

VPC Service Controls are a security feature used to prevent data exfiltration from Google-managed services (like BigQuery or Cloud Storage), not to provide general internet egress for Compute Engine VMs.

C. Private Google Access enabled on the subnet.

Private Google Access allows private VMs to access the external IPs of Google APIs and services only (e.g., Cloud Storage, Container Registry). It does not grant access to the general internet for third-party patch repositories.

1. Google Cloud Documentation - Cloud NAT overview: "Cloud NAT (network address translation) lets certain resources without external IP addresses create outbound connections to the internet. Cloud NAT provides outbound connectivity for the following resources: Compute Engine virtual machine (VM) instances without external IP addresses..." This document explicitly states the purpose of Cloud NAT, which directly matches the question's scenario.

2. Google Cloud Documentation - Configure Private Google Access: "Private Google Access lets VM instances that only have internal IP addresses reach the external IP addresses of Google APIs and services." This reference clarifies that Private Google Access is limited to Google services and is not a solution for general internet access.

3. Google Cloud Documentation - VPC Service Controls overview: "VPC Service Controls helps you mitigate the risk of data exfiltration from your Google Cloud services such as Cloud Storage and BigQuery." This confirms that VPC Service Controls is a data security feature, irrelevant to providing network connectivity.

4. Google Cloud Documentation - Cloud VPN overview: "Cloud VPN securely connects your peer network to your Virtual Private Cloud (VPC) network through an IPsec VPN connection." This shows that Cloud VPN's primary purpose is to connect networks, making it an indirect and overly complex solution for the stated problem.