An application on a VM without an external IP must call Google Cloud Storage APIs privately. Which configuration on the VM's subnet enables that without giving the VM an external IP?

Enabling Private Google Access for the subnet allows VMs without external IP addresses to reach Google APIs and services, including Cloud Storage, using internal IP addresses. This is the most direct and secure method for this scenario. Creating a Private Service Connect endpoint is for connecting to managed services in other VPCs, not directly for Google APIs like Cloud Storage from a VM in your own VPC. VPC Network Peering connects two VPCs, not a VPC to Google's internal services for private API access. Assigning a public DNS name and using Cloud NAT would give the VM outbound internet access, which is explicitly what the question aims to avoid by stating "without giving the VM an external IP.