## Set up Google Private Service Connect

URL: https://docs.atlan.com/apps/connectors/data-warehouses/google-bigquery/how-tos/set-up-google-private-service-connect

> Keep Atlan's BigQuery API traffic off the public internet with Google Private Service Connect - Atlan builds the private endpoint; you paste one DNS name.

Keep Atlan's BigQuery API traffic off the public internet. Atlan builds the private endpoint; you paste one DNS name. Unlike AWS or Azure private links, **there is no approval handshake on your side**.

:::note New to PSC?

Read [How BigQuery connectivity works](https://docs.atlan.com/llms/connectors/google-bigquery/how-bigquery-connectivity-works/llms.txt) first (5 minutes). Short version: PSC is a private on-ramp from Atlan's network onto Google's internal backbone. Because BigQuery is a Google-managed service, Google approves the endpoint automatically - you never see a "pending connection" to approve.

:::

## Prerequisites

- An Atlan tenant. PSC availability depends on your tenant's deployment - confirm in your support ticket if unsure.
- A working authentication setup - see [Set up authentication for Google BigQuery](https://docs.atlan.com/llms/connectors/google-bigquery/set-up-authentication-for-google-bigquery/llms.txt). PSC changes the network path only; credentials are unchanged.
- If you use VPC Service Controls: **PSC does not replace perimeter rules.** A tenant with PSC can still hit VPC-SC denials. Complete [VPC Service Controls & allowlisting](https://docs.atlan.com/llms/connectors/google-bigquery/vpc-service-controls-and-allowlisting/llms.txt) as well.

## Four phases at glance

| Phase | What happens | Owner | Typical time |
|---|---|---|---|
| 1. Request | One support ticket with your tenant URL | Atlan User | 10 minutes |
| 2. Build | Atlan creates the PSC endpoint in its network | Atlan support | A few business days |
| 3. Configure | Point the connection at the private DNS name | Atlan User | 10 minutes |
| 4. Verify | Test connection, small crawl, full crawl | Atlan User | 30 minutes |

## Phase 1 - Raise the request

**Owner:** Atlan User

[Raise a support request](https://docs.atlan.com/support/submit-request) from within Atlan: *"Please provision (or share the existing) Private Service Connect endpoint for BigQuery for this tenant, and reply with its DNS name and port."* Include:

- Your **Atlan tenant URL** (e.g. `tenant.atlan.com`)
- The **GCP region(s)** your BigQuery datasets live in
- Whether this is for a **new connection or an existing one** you're switching to private

:::tip Ask whether one already exists

PSC endpoints are provisioned per tenant and are reused by *every* BigQuery connection on that tenant. If your organization set one up before, you only need its DNS name.

:::

## Phase 2 - Atlan builds the endpoint

**Owner:** Atlan support

Atlan creates the PSC endpoint inside its own network and replies with a DNS name in the documented format:

```
Hostname: https://bigquery-example-tenant.p.googleapis.com
Port: 443 (default)
```

There is nothing to approve, click, or configure in your Google Cloud console for this phase:

1. **Requested** - you file the ticket (Phase 1)
2. **Auto-approved** - Google-managed services accept PSC endpoints automatically; there is no pending state
3. **DNS in hand** - proceed to Phase 3

:::info Nobody on your side needs to "approve" anything

Teams familiar with AWS PrivateLink or Azure Private Link often wait for an approval request that never comes. For BigQuery PSC the approval is automatic on Google's side. If days pass with no DNS name, the ticket is just in progress; nudge it.

:::

## Phase 3 - Configure the connection

**Owner:** Atlan User

1. In the crawler setup, under connectivity choose **Private Network Link** (instead of Public Network).
2. Enter the DNS name from Phase 2 as the host, keep port **443** unless support says otherwise.
3. Authentication fields stay exactly as in [Set up authentication](https://docs.atlan.com/llms/connectors/google-bigquery/set-up-authentication-for-google-bigquery/llms.txt) - key file or WIF both work over PSC.

:::note Existing public connections keep working

The PSC endpoint sits in Atlan's network and is used by BigQuery connections configured with the private host. Switching an existing connection = editing its connectivity option and host; credentials and filters are untouched.

:::

## Phase 4 - Verify

**Owner:** Atlan User

- **Test connection** passes with the private host
- Preflight checks pass
- A crawl scoped to one small dataset completes
- A full crawl and a miner run complete

:::caution nslookup from your laptop will fail - that's normal

The private DNS name resolves only *inside Atlan's network*. You cannot verify it from your own machine; the **Test connection** button is the verification tool. If it fails, reply on your PSC ticket and ask support to confirm the endpoint from their side.

:::

## Next steps

[Crawl Google BigQuery](https://docs.atlan.com/llms/connectors/google-bigquery/crawl-google-bigquery/llms.txt): Configure and run the crawler to extract metadata from BigQuery

---