VMs in a custom VPC have only internal IPs and no internet access. They must access an object in a Cloud Storage bucket within the project. What should you do?

Enabling Private Google Access on the subnet allows VMs with only internal IP addresses to reach Google APIs and services, including Cloud Storage, without traversing the public internet. This is the most direct and secure solution for this scenario. Private Service Access is for connecting your VPC network to a service producer's network, not for internal VMs accessing Google services. VPC Service Controls create security perimeters to prevent data exfiltration but don't provide connectivity for internal IPs to Google services. Cloud NAT provides outbound internet access for VMs without external IPs, but Private Google Access is specifically designed for accessing Google services privately and is generally preferred for security and performance when applicable.