3.2 Hybrid Connectivity
Enterprises adopting GCP almost always go through a period of "on-premises plus cloud" coexistence, so how you pick the line back to your own data centre matters. Google's own comparison boils the decision down to something simple:
| Option | Bandwidth | SLA | Best fit |
|---|---|---|---|
| Cloud VPN (HA VPN) | Limited by tunnel count, lower bandwidth | 99.99% (dual-interface) / 99.9% | Cost-sensitive, low bandwidth needs, or still evaluating |
| Dedicated Interconnect | 10 / 100 / 400 Gbps | Google provides an end-to-end SLA directly | Enterprise-grade, needs the highest throughput, and you can arrange colocation yourself |
| Partner Interconnect | 50 Mbps – 50 Gbps, flexible | Provided by the service provider | Enterprise-grade connectivity without a colocation presence |
| Cross-Cloud Interconnect | Depends on the target cloud (up to 400 Gbps for AWS/OCI) | 99.99% (cross-facility) / 99.9% | Direct connectivity to another public cloud (AWS/Azure/OCI/Alibaba), bypassing the public internet |
The general rule: start cheap with Cloud VPN, and only move to Interconnect once you genuinely need the throughput and can commit to a colocation arrangement. Don't let a sales conversation talk you into an expensive Dedicated Interconnect contract before your actual usage is anywhere near it.
The actual Cloud VPN (HA VPN) Terraform lives in network-design/modules/cloud_vpn — an optional module; examples/root gates its creation with the enable_vpn flag, which defaults to false. Organisations with no hybrid-cloud requirement can skip it entirely and no VPN resources are created; only flip enable_vpn = true and fill in the on-premises device's ASN/IP/BGP settings once you actually need on-premises connectivity. Dedicated/Partner/Cross-Cloud Interconnect require a physical circuit provisioning process that Terraform alone can't complete, so there's no corresponding module here.