Set up Google Private Service Connect
Keep Atlan's BigQuery API traffic off the public internet with Google Private Service Connect - Atlan builds the private endpoint; you paste one DNS name.
Keep Atlan's BigQuery API traffic off the public internet. Atlan builds the private endpoint; you paste one DNS name. Unlike AWS or Azure private links, there is no approval handshake on your side.
Read How BigQuery connectivity works first (5 minutes). Short version: PSC is a private on-ramp from Atlan's network onto Google's internal backbone. Because BigQuery is a Google-managed service, Google approves the endpoint automatically - you never see a "pending connection" to approve.
Prerequisites
- An Atlan tenant. PSC availability depends on your tenant's deployment - confirm in your support ticket if unsure.
- A working authentication setup - see Set up authentication for Google BigQuery. PSC changes the network path only; credentials are unchanged.
- If you use VPC Service Controls: PSC does not replace perimeter rules. A tenant with PSC can still hit VPC-SC denials. Complete VPC Service Controls & allowlisting as well.
Four phases at glance
| Phase | What happens | Owner | Typical time |
|---|---|---|---|
| 1. Request | One support ticket with your tenant URL | Atlan User | 10 minutes |
| 2. Build | Atlan creates the PSC endpoint in its network | Atlan support | A few business days |
| 3. Configure | Point the connection at the private DNS name | Atlan User | 10 minutes |
| 4. Verify | Test connection, small crawl, full crawl | Atlan User | 30 minutes |
Phase 1 - Raise the request
Owner: Atlan User
Raise a support request from within Atlan: "Please provision (or share the existing) Private Service Connect endpoint for BigQuery for this tenant, and reply with its DNS name and port." Include:
- Your Atlan tenant URL (e.g.
tenant.atlan.com) - The GCP region(s) your BigQuery datasets live in
- Whether this is for a new connection or an existing one you're switching to private
PSC endpoints are provisioned per tenant and are reused by every BigQuery connection on that tenant. If your organization set one up before, you only need its DNS name.
Phase 2 - Atlan builds the endpoint
Owner: Atlan support
Atlan creates the PSC endpoint inside its own network and replies with a DNS name in the documented format:
Hostname: https://bigquery-example-tenant.p.googleapis.com
Port: 443 (default)
There is nothing to approve, click, or configure in your Google Cloud console for this phase:
- Requested - you file the ticket (Phase 1)
- Auto-approved - Google-managed services accept PSC endpoints automatically; there is no pending state
- DNS in hand - proceed to Phase 3
Teams familiar with AWS PrivateLink or Azure Private Link often wait for an approval request that never comes. For BigQuery PSC the approval is automatic on Google's side. If days pass with no DNS name, the ticket is just in progress; nudge it.
Phase 3 - Configure the connection
Owner: Atlan User
- In the crawler setup, under connectivity choose Private Network Link (instead of Public Network).
- Enter the DNS name from Phase 2 as the host, keep port 443 unless support says otherwise.
- Authentication fields stay exactly as in Set up authentication - key file or WIF both work over PSC.
The PSC endpoint sits in Atlan's network and is used by BigQuery connections configured with the private host. Switching an existing connection = editing its connectivity option and host; credentials and filters are untouched.
Phase 4 - Verify
Owner: Atlan User
- Test connection passes with the private host
- Preflight checks pass
- A crawl scoped to one small dataset completes
- A full crawl and a miner run complete
The private DNS name resolves only inside Atlan's network. You cannot verify it from your own machine; the Test connection button is the verification tool. If it fails, reply on your PSC ticket and ask support to confirm the endpoint from their side.
Next steps
Crawl Google BigQuery: Configure and run the crawler to extract metadata from BigQuery