Single VPC with Cloud Interconnect; you must allow on-prem hosts to access only Google APIs/services supported by VPC Service Controls via hybrid connectivity with an SLA. What should you do?

To allow on-premises hosts to access Google APIs/services supported by VPC Service Controls via hybrid connectivity with an SLA, you should enable Private Google Access for on-premises hosts and use the restricted.googleapis.com virtual IPs. This approach routes API traffic over your Cloud Interconnect, keeping it private and within Google's network, which is essential for VPC Service Controls and SLA requirements. The restricted.googleapis.com domain ensures that only services protected by VPC Service Controls are accessible. Advertising Google APIs' public virtual IP addresses via Cloud Routers is incorrect because it exposes public IPs and doesn't guarantee traffic stays within Google's network, nor does it inherently support VPC Service Controls. Advertising a default route and using Cloud NAT is for general internet access and doesn't provide private access to Google APIs or support VPC Service Controls. Direct Peering links are not managed by Cloud Router and don't inherently provide the necessary integration for Private Google Access or VPC Service Controls.