GCP Private Service Connect cost: what private access is worth

Quick answer

Private Service Connect charges roughly 0.01 dollars per hour per consumer endpoint, so about 7.30 dollars per month, plus data processing of about 0.01 dollars per GB in each direction. Routing the same traffic through Cloud NAT costs roughly 0.044 dollars per hour per gateway plus 0.045 dollars per GB processed, so PSC is about four times cheaper per gigabyte. For a workload moving 20 TB per month, PSC costs around 215 dollars against roughly 950 dollars through Cloud NAT. Private Google Access is the free alternative when you only need Google APIs and not a third-party or cross-VPC service.

Reaching a managed service from a private subnet always involves a decision about the path. You can route through a NAT gateway and out over the public endpoint, you can use a provider-specific private access feature, or you can create a private endpoint that puts the service on an IP inside your own network. On Google Cloud, the third option is Private Service Connect, and its pricing is different enough from the alternatives to change the answer.

What PSC is

A PSC endpoint is a forwarding rule in your VPC that maps a private IP address to a service: a Google API bundle, a published service in another VPC, or a partner service such as a managed database vendor. Traffic to that IP never touches the public internet and never leaves Google's network. From the application's perspective it is just another internal address.

The pricing, compared

Path	Fixed cost	Per GB	20 TB/month total
Private Service Connect	about 0.01/hr per endpoint	about 0.01	about 215 USD
Cloud NAT	about 0.044/hr per gateway	about 0.045	about 950 USD
Private Google Access	None	None	0 USD
External IP direct	about 0.004/hr per IP	egress rates apply	varies

The per-GB gap is the headline: 0.01 against 0.045 is a factor of 4.5. On 20 TB per month that alone is about 735 dollars. The fixed costs are small enough on both sides to be noise unless you have dozens of endpoints.

Private Google Access is free and often sufficient

Before reaching for PSC, check whether Private Google Access solves the problem. Enabling it on a subnet lets instances without external IPs reach Google APIs and services over internal routing at no charge at all. If your requirement is simply that a VM in a private subnet can call Cloud Storage or BigQuery without a NAT gateway, Private Google Access does that for free.

PSC earns its fee when you need something Private Google Access does not offer: a specific private IP in your own address range rather than a well-known Google range, access to a service published from another VPC or another organization, connectivity from on-premises over interconnect to a Google API using your own addressing, or per-endpoint access control and observability.

The third-party service case

The most common paid use is connecting to a partner-managed service. A managed database, streaming platform, or observability vendor running in their own Google Cloud project publishes a service, and you create a PSC endpoint that reaches it privately. Compared to routing that traffic over the internet through Cloud NAT, you save the NAT processing fee, avoid internet egress if the service is in the same region, remove the need to allowlist public IPs, and get a stable private address.

For a workload sending 10 TB per month to a managed data platform in the same region, the PSC path costs about 107 dollars in data processing plus 7.30 in endpoint hours. The Cloud NAT path costs about 460 dollars in processing plus roughly 32 dollars in gateway hours, and if the service sits in another region or outside Google Cloud, internet egress at around 0.12 dollars per GB adds another 1,200 dollars.

Where it can get expensive

Two patterns inflate PSC cost. The first is endpoint proliferation: teams creating a separate endpoint per service per subnet per environment. Each is only 7.30 dollars per month, but a hundred of them is 730 dollars for forwarding rules that mostly duplicate each other. Consolidate where the access pattern allows.

The second is very high throughput. At 0.01 dollars per GB, a data pipeline moving 500 TB per month through PSC pays about 5,000 dollars in data processing. That is still far better than NAT, but it is large enough to justify checking whether the traffic could stay inside a single VPC via peering, which carries no processing fee in the same region, only standard inter-zone charges where applicable. The equivalent AWS trade-off appears in private link cost.

Choosing

Use Private Google Access when you only need Google APIs and can live with Google-owned addressing; it is free. Use Private Service Connect when you need your own IP space, a third-party published service, or hybrid connectivity, and the per-GB saving against Cloud NAT usually pays for it several times over. Use Cloud NAT only for genuinely public internet destinations that have no private alternative, and keep high-volume traffic off it. Price your network paths against the resource catalog before you build them.

FAQ

How much does Private Service Connect cost?

Roughly 0.01 dollars per hour per consumer endpoint, about 7.30 dollars per month, plus data processing of about 0.01 dollars per GB in each direction. A workload moving 20 TB per month costs around 215 dollars in total, compared to roughly 950 dollars for the same traffic routed through Cloud NAT at 0.045 dollars per GB plus gateway hours.

Is Private Google Access cheaper than PSC?

Yes, it is free. Enabling Private Google Access on a subnet lets instances without external IPs reach Google APIs and services over internal routing at no charge. If your only requirement is that a private VM can call Cloud Storage or BigQuery without a NAT gateway, Private Google Access satisfies it without any per-hour or per-GB fee.

When do I actually need Private Service Connect?

When you need a specific private IP in your own address range rather than a Google-owned range, when you need access to a service published from another VPC or another organization such as a partner-managed database, when connecting from on-premises over interconnect using your own addressing, or when you need per-endpoint access control and observability.

How does PSC compare to Cloud NAT for third-party services?

For 10 TB per month to a managed service in the same region, PSC costs about 107 dollars in processing plus 7.30 in endpoint hours. Cloud NAT costs about 460 dollars in processing plus roughly 32 dollars in gateway hours, and if the service is in another region or outside Google Cloud, internet egress near 0.12 dollars per GB adds about 1,200 dollars more.

Can Private Service Connect get expensive?

Two patterns inflate it. Endpoint proliferation, where teams create a separate endpoint per service per subnet per environment, turns 7.30 dollars each into 730 dollars for a hundred largely duplicate forwarding rules. And very high throughput: at 0.01 dollars per GB, a pipeline moving 500 TB per month pays about 5,000 dollars, enough to justify checking whether VPC peering would serve instead.

How does C3X help with GCP network cost?

C3X prices infrastructure from Terraform before deployment, including Private Service Connect endpoints, Cloud NAT gateways, subnets, and the routing that determines which path traffic takes. Because the difference between a free Private Google Access path and a metered NAT path is a few lines of Terraform, seeing it priced in the pull request is where the cheaper option gets chosen.

What to do next

Choose the cheaper network path before you apply. C3X prices Terraform against a live resource catalog. Start with the quickstart.