Cloud Composer 2 instance runs in a subnet without Internet. A DAG processes one Cloud Storage file at a time; you want it to run reactively on each new file. Which design lets a serverless notifier trigger Composer without Internet access?

The correct option leverages Private Service Connect (PSC) to enable private connectivity from the Cloud Function to the Composer environment, which is crucial since the Composer instance is in a subnet without internet access. Cloud Storage notifications trigger a Cloud Function, which then uses the Airflow REST API to trigger the DAG. PSC provides a private, secure, and direct connection without exposing the Composer webserver to the public internet. The other options are incorrect because: Enabling Private Google Access allows resources within the subnet to reach Google APIs and services, but it doesn't provide a mechanism for external services (like a push subscription or Cloud Function) to reach the Composer webserver privately if it's not exposed. Using VPC Serverless Access with a webserver URL would still require the webserver to be reachable, which is not the case for a private Composer instance without internet access. VPC Serverless Access allows serverless products to connect to resources within a VPC, but it doesn't create a private endpoint for inbound connections to the Composer webserver from an external Cloud Function directly without PSC.