You run a batch Dataflow pipeline that reads from Cloud Storage and writes to BigQuery. Organizational policy requires Compute Engine VMs to use internal IPs only. How do you deploy Dataflow workers to access Cloud Storage and BigQuery without external IPs?

The correct option is to enable Private Google Access on the subnetwork and run Dataflow workers with only internal IPs. Private Google Access allows VMs with internal IP addresses to reach Google APIs and services, including Cloud Storage and BigQuery, without traversing the internet. This satisfies the organizational policy requiring internal IPs. The other options are incorrect because: Giving Dataflow workers network tags that allow access to Cloud Storage and BigQuery is insufficient. Network tags control firewall rules but don't inherently provide private access to Google services for internal-IP-only VMs. Ensuring firewall rules permit access to Cloud Storage and BigQuery is also insufficient. While necessary, firewall rules alone do not enable internal-IP-only VMs to reach external Google services; Private Google Access is required for that. Creating a VPC Service Controls perimeter enhances security by preventing data exfiltration but does not, by itself, enable internal-IP-only VMs to connect to Google services. Private Google Access is still needed for connectivity.