You need Cloud SQL access from VPC VM instances that have no public IPs. Which two steps are required?

To allow VPC VM instances without public IPs to access Cloud SQL privately, you need to establish a private connection. This involves two key steps. First, you must enable the Service Networking API in your project. This API is essential for managing private connections between your VPC network and Google's service producer networks, where services like Cloud SQL reside. Second, you need to create a private connection to the service producer (Cloud SQL) for private IP. This sets up a dedicated, private network path, often using VPC Service Controls or Private Service Connect, ensuring that traffic between your VMs and Cloud SQL stays within Google's network and doesn't traverse the public internet. Enabling the Cloud Datastore API is irrelevant as Cloud Datastore is a different service. Creating a custom static route is not the standard or recommended method for private Cloud SQL access; private service access handles routing automatically. Enabling Private Google Access for the subnet allows VMs without external IPs to reach public Google APIs, but Cloud SQL private IP access requires a direct private connection to the service producer network, not just access to public API endpoints.