A service producer published a Private Service Connect service attachment and wants to restrict which consumer projects can connect. Which producer-side configuration accomplishes that?

The correct option is to set the service attachment to allow only explicitly whitelisted consumer project IDs. Private Service Connect (PSC) service attachments offer explicit control over which consumer projects can establish connections. By default, a service attachment can be configured to accept connections from all projects, specific projects, or projects within specific organizations. Whitelisting specific consumer project IDs directly enforces this restriction at the PSC service attachment level. Applying a Google Cloud IAM allow policy on the service attachment resource is incorrect because IAM controls who can manage the service attachment, not which consumer projects can connect to the service. Requiring VPC Network Peering is incorrect; PSC is designed to provide private connectivity without the need for direct VPC peering between producer and consumer networks. Blocking consumers by enabling Private Google Access on the producer VPC is also incorrect, as Private Google Access allows VMs in a VPC to reach Google APIs and services privately, and does not control incoming connections to a PSC service.