0

I'm using a private VM instance in GCP along with Cloud NAT to allow internet access for this instance. Recently I've been trying to access the Google Places API service via this instance, using an API key. The recommended approach is to restrict the use of this API key by IP address in this scenario. Unfortunately I'm getting a REQUEST_DENIED error, stating "This IP, site or mobile application is not authorized to use this API key. Request received from IP address {IPv6 address removed}, with empty referer" when I try to do this - despite GCP not supporting IPv6 addresses in VPCs.

My suspicion is that because enabling Cloud NAT automatically activates Private Google Access there's actually some internal GCP private IPv4 to IPv6 NAT happening before the request hits the API - but obviously I'm unable to confirm this.

My question then is, is anyone aware of a way of enabling IP-based restriction on Google Places API keys in this environment (private VM instance + Cloud NAT/Private Google Access)?

Thanks!

Michael
  • 101
  • 1

1 Answers1

0

  • When establishing private connectivity to Google API services certain procedures have to be followed involving creating a route to restricted.googleapis.com. The relevant additional details which can be referred from the doc.

  • Your observation is right that by enabling NAT leads to activate PGA even though it is not activated manually and Andromeda (provides n/w virtualization for GCP) does the encapsulation of IPv4 and IPv6.

  • As mentioned in doc, when a Private VM sends the packet to the destination address (199.36.153.8/30 or 199.36.153.4/30), then Andromeda encapsulation wraps the IPv4 packet in an Andromeda NAT64 IPv6 packet. This is internally routable. Bits 0 through 31 are the VM's IPv4 internal address; bits 32 through 63 represent a unique 32-bit identifier for the VPC network (called the VNID); bits 64 through 127 are a common 64 bits (8 bytes) for all customers. Thus,each GCP VM has a globally unique IPv6 address, routable within Google's networks.

  • Please try to follow the below setup in APIs & Services -> Credentials.

    1. Select the key.
    2. Under API Restriction, select API type.
    3. Set Application Restriction to None.
    4. Save
Ramesh kollisetty
  • 136
  • 4