By default, virtual machines instances that have an external IP address can access Google APIs. Not all instances will have a public IP address and your instances may need access to Google APIs and services. Private Google access allows your instances to reach Google APIs and services using an internal IP address rather than a public IP address. This makes it possible for you to use private access to allow virtual machines to reach Google services. Services such as BigQuery, Cloud Bigtable, container registry, Cloud Dataproc, cloud storage, and many more can all be reached internally through Private Google access.
You can enable Private Google access on a subnet level and any VMs on that subnet can access Google APIs ...
