Add a GCP Pub/Sub Private Service Connect Connection

Set up GCP Service Account Access.

Follow the procedure described in Set Up and Manage GCP Service Account Access.

Note the Service Account ID for use later in this procedure.

Grant the following roles at both the project and topic levels:

• Publisher Role

• Viewer Role

For more information, see the Pub/Sub documentation.

In Atlas, go to the Users page.

1. If it's not already displayed, select your desired organization from the Organizations menu in the navigation bar.

2. Click All Projects in the sidebar under the Identity & Access section, and select your desired project.

3. Click Project Identity & Access in the sidebar under the Security section.

The Users page displays.

Configure a Service Account.

Create a service account.

Grant this service account the following roles within your Atlas Stream Processing project:

• Project Owner

• Project Stream Processing Owner

Create the Private Link Connection.

The Atlas Administration API provides an endpoint to Create One Private Link.

For a Google Cloud Pub/Sub Private Service Connect connection, set the following key-value pairs:

Use Return All Private Link Connections to check the state of your endpoint. When it reaches a DONE state, note the value of the _id field.

Create the GCP Pub/Sub Private Service Connect Connection.

The Atlas Administration API provides an endpoint to Create One Stream Connection.

For a Google Cloud Pub/Sub Private Service Connect connection, set the following key-value pairs:

Set up GCP Service Account Access.

Follow the procedure described in Set Up and Manage GCP Service Account Access.

Note the Service Account ID for use later in this procedure.

Grant the following roles at both the project and topic levels:

• Publisher Role

• Viewer Role

For more information, see the Pub/Sub documentation.

In Atlas, go to the Users page.

1. If it's not already displayed, select your desired organization from the Organizations menu in the navigation bar.

2. Click All Projects in the sidebar under the Identity & Access section, and select your desired project.

3. Click Project Identity & Access in the sidebar under the Security section.

The Users page displays.

Configure a Service Account.

Create a service account.

Grant this service account the following roles within your Atlas Stream Processing project:

• Project Owner

• Project Stream Processing Owner

Create the Private Link Connection.

To a Private Link endpoint for a stream processor connection using the Atlas CLI, run the following command:

atlas streams privateLinks create [options]

To learn more about the command syntax and parameters, see the Atlas CLI documentation for atlas streams privateLinks create.

In your configuration file, set the following key-value pairs:

Use atlas streams privateLinks list command to check the state of your endpoint. When it reaches a DONE state, note the value of the _id field.

Create the Google Cloud Pub/Sub connection.

To create one connection for the stream processing workspace you specify using the Atlas CLI, run the following command:

atlas streams connections create [connectionName] [options]

To learn more about the command syntax and parameters, see the Atlas CLI documentation for atlas streams connections create.

In your configuration file, set the following key-value pairs:

Set up GCP Service Account Access.

Follow the procedure described in Set Up and Manage GCP Service Account Access.

Note the Service Account ID for use later in this procedure.

Grant the following roles at both the project and topic levels:

• Publisher Role

• Viewer Role

For more information, see the Pub/Sub documentation.

In Atlas, go to the Database & Network Access page for your project.

1. If it's not already displayed, select the organization that contains your project from the Organizations menu in the navigation bar.

2. If it's not already displayed, select your project from the Projects menu in the navigation bar.

3. In the sidebar, click Database & Network Access under the Security heading.

The Database & Network Access page displays.

Navigate to the Atlas Stream Processing private endpoint interface.

1. In the sidebar, click Private Endpoint.

2. Click the Atlas Stream Processing tab.

   If you have not created an Atlas Stream Processing private endpoint previously, click Create endpoint. If you have, click Add ASP Endpoint.

Select your cloud provider and vendor.

1. Set Cloud Provider to GCP.

2. Set Vendor to Pub/Sub.

3. Click Next, enter service details

Provide your Google Cloud endpoint region.

Your endpoint must be both:

• In the same region as your Atlas Google Cloud cluster

• In the same region in which you intend to host the stream processors that use it.

1. Click Next, generate endpoint ID

In Atlas, go to the Stream Processing page for your project.

1. If it's not already displayed, select the organization that contains your project from the Organizations menu in the navigation bar.

2. If it's not already displayed, select your project from the Projects menu in the navigation bar.

3. In the sidebar, click Stream Processing under the Streaming Data heading.

The Stream Processing page displays.

Go to the Connection Registry.

1. Locate the overview panel of the stream processing workspace you want to modify and click Manage.

2. In the sidebar, click Connection Registry.

Add a new connection.

1. Click + Add connection.

2. Select a GCP Pub/Sub connection.

3. Provide a Connection Name. Each connection name must be unique within a stream processing workspace. This is the name used to reference the connection in Atlas Stream Processing aggregations.

4. Click the Private Service Connect button.

5. Toggle Enable Private Service Connect Networking on.

6. From the dropdown menu, select the private endpoint you created earlier.

7. From the GCP Service Account dropdown, select the ID of the unified access role you authorized in a prior step.

8. Click Add connection.