# Egress Private Service Connect Endpoints Setup Guide: First-Party Services on Google Cloud for Confluent Cloud Use this guide to set up Egress Private Service Connect Endpoints for the first-party services on Google Cloud to enable fully managed connectors in Confluent Cloud using Google Cloud Private Service Connect. First-party services are the services that Google Cloud directly offers and supports. For a list of Google Cloud first-party services, see the Google Cloud documentation for a list of all [Google published services that integrate with Google Cloud Private Service Connect](https://cloud.google.com/vpc/docs/private-service-connect-compatibility#google-services). ## Requirements A Confluent Cloud Dedicated cluster must be set up, and the cluster is running within a Private Services Connect network. ## Step 1: Create an Egress Private Service Connect Endpoint 1. In the Confluent Cloud Console, navigate to the **Network Management** tab of the desired Confluent Cloud environment. 2. Click the Confluent Cloud network to which you want to add the Private Service Connect Endpoint. Verify that the **Connection Type** of the network is “Private Service Connect”. 3. Click **Create endpoint** in the **Egress connections** tab. 4. Provide the Service, Endpoint name, and Private Service Connect Endpoint Target. * To connect to the All APIs bundle for global Google APIs, follow these steps. The All APIs bundle (`all-apis`) is for the HTTP-based Google Cloud services. For a list of the `all-apis` bundle, see [Google Cloud published services that integrate with Google Cloud Private Service Connect](https://cloud.google.com/vpc/docs/private-service-connect-compatibility#google-apis-global). 1. Click **Global Google APIs** as the service you want to connect to. 2. Follow the guided steps to specify the field values, including: * **Service**: The name of the Private Service Connect service you retrieved in [Obtain Google Cloud Private Service Connect Endpoint target](../../networking/gcp-egress-psc.md#gcp-psc-egress-obtain-target). * **Endpoint name**: Name of the Private Service Connect Endpoint. * **Private Service Connect Endpoint Target:** When **Global Google APIs** was selected in the previous step, this value is preset to **all-google-apis**. * To connect to a different published service other than Google’s API bundle, follow these steps. Example services are CloudSQL and AlloyDB. 1. Click **Other** as the service you want to connect to. 2. Follow the guided steps to specify the field values, including: * **Service**: The name of the Private Service Connect service you retrieved in [Obtain Google Cloud Private Service Connect Endpoint target](../../networking/gcp-egress-psc.md#gcp-psc-egress-obtain-target). * **Endpoint name**: Name of the Private Service Connect Endpoint. * **Private Service Connect Endpoint Target:** Some services, such as AlloyDB, expose the full attachment URI rather than the standard shortened URI. For those services, you need to provide a shortened attachment URI in this field. For example, if you get the following AlloyDB attachment URI: ```text https://www.googleapis.com/compute/v1/projects/v2506d189674f594cp-tp/regions/europe-north1/serviceAttachments/alloydb-ab6c881c-8eb-peter-fmc-test-p-sa ``` Provide the URI without the `https://www.googleapis.com/compute/v1/` prefix in this field. ```text projects/v2506d189674f594cp-tp/regions/europe-north1/serviceAttachments/alloydb-ab6c881c-8eb-peter-fmc-test-p-sa ``` 5. Follow the guided steps to specify the field values, including: * **Service**: The name of the Private Service Connect service you retrieved in [Obtain Google Cloud Private Service Connect Endpoint target](../../networking/gcp-egress-psc.md#gcp-psc-egress-obtain-target). * **Endpoint name**: Name of the Private Service Connect Endpoint. * **Private Service Connect Endpoint Target:** When **Global Google APIs** was selected in the previous step, the value is preset to **all-google-apis**. 6. Click **Create endpoint** to create the Private Service Connect Endpoint. ## Step 2: Create the DNS record 1. When the Egress Private Service Connect Endpoint status transitions to “Ready”, click **Create record** under the DNS records section.  2. On the **DNS record** page, ensure that the **Domain** field is set accordingly. * If not using OAuth authentication, set the **Domain** field to **googleapis.com**, which should be the pre-populated value.  * If OAuth is used for connector authentication against the external system, update the **Domain** field specific to the Google Cloud service that the connector will be connecting to. For example: * For BigQuery: **bigquery.googleapis.com** * For Pub/Sub: **pubsub.googlesapis.com** #### NOTE The connector will fail with the following error message if OAuth is in use and there is an existing DNS record of **googleapis.com**: ```text io.confluent.connect.oauth.ConnectOAuthException: An error occurred when attempting to refresh access_token. ``` To resolve the error, remove the **googlesapis.com** DNS record and replace with service-specific DNS record. 3. Click **Save**. ## Step 3: Create the connector 1. When the Endpoint and DNS Record status transitions to “Ready”, proceed to create the connector. 2. For the steps to create the connector, refer to the connector-specific documentation that is listed for your specific connector in [Supported connectors](../overview.md#supported-connectors).