Your organization has on-premises hosts that need to access Google Cloud APIs. You must enforce private connectivity between these hosts, minimize costs, and optimize for operational efficiency…

VPC peering is for connecting two Google Cloud VPC networks, not for connecting on-premises networks directly to Google Cloud over the internet in a private manner for API access.

Using an IPsec VPN tunnel provides private connectivity between your on-premises network and your Google Cloud VPC network. When combined with Private Google Access enabled on the VPC subnet, on-premises hosts can access Google Cloud APIs and services privately over the VPN tunnel, bypassing the public internet. This solution is generally more cost-effective than Dedicated/Partner Interconnect for smaller bandwidth requirements and offers good operational efficiency for establishing secure private access.

Enforcing a security policy to encrypt data with Cloud KMS is important for data security but does not address the requirement for private connectivity from on-premises hosts to Google Cloud APIs.

Dedicated or Partner Interconnect provides high-bandwidth, low-latency private connectivity, but it is typically more expensive and complex to set up than an IPsec VPN tunnel, thus not minimizing costs for potentially less demanding private API access.