A Dataflow job in Project A fails to connect to a Cloud SQL instance in Project B that has no public IP. VPC Service Controls and Shared VPC are not in use. Ensure the pipeline can access Cloud SQL without traversing the public internet. What should you do?

VPC Network Peering allows private IP connectivity between two VPC networks, even across different projects. By peering Project A (Dataflow) and Project B (Cloud SQL), Dataflow workers can access the Cloud SQL instance using its private IP address, ensuring traffic does not traverse the public internet. Deploying a Compute Engine VM as a private proxy is an unnecessary additional layer of complexity and management overhead when peering offers a direct solution. Adding external IP addresses of Dataflow workers to authorized networks would expose the Cloud SQL instance to the public internet, which violates the requirement of not traversing the public internet and is not possible for an instance with no public IP. Setting up peering and then provisioning a VM proxy is redundant; peering alone provides the necessary private connectivity.