This document shows you two sample configurations for setting up a global external Application Load Balancer with VM instance group backends in a Shared VPC environment:
Both examples require the same initial configuration to grant permissions, configure the network and subnet in the host project, and set up Shared VPC before you can start creating load balancers.
These are not the only Shared VPC configurations supported by the global external Application Load Balancer. For other valid Shared VPC architectures, see Shared VPC architecture.
If you don't want to use a Shared VPC network, see Set up a global external Application Load Balancer with VM instance group backends.
Setting up a load balancer on a Shared VPC network requires some initial setup and provisioning by an administrator. After the initial setup, a service project owner can do one of the following:
This section summarizes the permissions required to follow this guide to set up a load balancer on a Shared VPC network.
The following roles are required for the following tasks:
These tasks must be performed in the Shared VPC host project. We recommend that the Shared VPC Admin also be the owner of the Shared VPC host project. This automatically grants the Network Admin and Security Admin roles.
After the subnets have been provisioned, the host project owner must grant the Network User role in the host project to anyone (typically service project administrators, developers, or service accounts) who needs to use these resources.
| Task | Required role |
|---|---|
| Use VPC networks and subnets belonging to the host project | Network User |
This role can be granted on the project level or for individual subnets. We recommend that you grant the role on individual subnets. Granting the role on the project provides access to all current and future subnets in the VPC network of the host project.
Service project administrators need the following roles in the service project to create load balancing resources and backends. These permissions are granted automatically to the service project owner or editor.
If your load balancer needs to reference backend services from other service projects, also known as cross-project service referencing, load balancer administrators will require the following role in the service project where the backend service is created.
| Task | Required role |
|---|---|
| Permissions to use services in other projects | Load Balancer Services User |
This role can be granted either at the project level or for individual backend services. For instructions about how to grant this role, see the cross-project service referencing example on this page.
For more information about IAM, see the following guides:
In this section, you need to perform the following steps:
The steps in this section do not need to be performed every time you want to create a new load balancer. However, you must ensure that you have access to the resources described here before you proceed to creating the load balancer.
This example uses the following network, region, and subnet:
Network. The network is named lb-network.
Subnet for load balancer's backends. A subnet
named lb-backend-subnet in the
us-west1 region uses 10.1.2.0/24 for its primary IP range.
All the steps in this section must be performed in the host project.
lb-network.In the Subnets section:
In the New subnet section, enter the following information:
lb-backend-subnetRegion: us-west1
IP address range: 10.1.2.0/24
Click Done.
Click Create.
Create a VPC network with the gcloud compute
networks create command:
gcloud compute networks create lb-network --subnet-mode=custom
Create a subnet in the lb-network network in the us-west1 region:
gcloud compute networks subnets create lb-backend-subnet
--network=lb-network
--range=10.1.2.0/24
--region=us-west1
lb-backend-subnet subnet so that they can provision the load
balancer's backends.
A Shared VPC Admin must grant access to the backend subnet to service project administrators (or developers who deploy resources and backends that use the subnet). For instructions, see Service Project Admins for some subnets.
fw-allow-health-check. An ingress rule, applicable to the instances
being load balanced, that allows all TCP traffic from the Google Cloud
health check probe ranges.
This example uses the target tag load-balanced-backend to identify the
instances to which it should apply.All the steps in this section must be performed in the host project.
In the Google Cloud console, go to the Firewall policies page.
fw-allow-health-checklb-networkload-balanced-backend35.191.0.0/1680 for the port number.As a best practice, limit this rule to just the protocols and ports
that match those used by your health check. If you use tcp:80 for
the protocol and port, Google Cloud can use HTTP on port 80
to contact your VMs, but it cannot use HTTPS on port 443 to
contact them.
Create the fw-allow-health-check firewall rule to allow
Google Cloud health checks. This example allows all TCP traffic
from health check probers. However, you can configure a narrower set
of ports to meet your needs.
gcloud compute firewall-rules create fw-allow-health-check \
--network=lb-network \
--action=allow \
--direction=ingress \
--source-ranges=35.191.0.0/16 \
--target-tags=load-balanced-backend \
--rules=tcp
This step entails enabling a Shared VPC host project, sharing subnets of the host project, and attaching service projects to the host project so that the service projects can use the Shared VPC network. To set up Shared VPC in the host project, see the following pages:
The rest of these instructions assume that you have already set up Shared VPC. This includes setting up IAM policies for your organization and designating the host and service projects.
Don't proceed until you have set up Shared VPC and enabled the host and service projects.
After completing the steps defined in this prerequisites section, you can pursue either of the following setups:
After you have configured the VPC network in the host project and set up Shared VPC, you can switch your attention to the service project, in which you need to create all the load balancing components (backend service, URL map, target proxy, and forwarding rule) and the backends.
This section assumes that you have carried out the prerequisite steps described in the previous section in the host project. In this section, the load balancer's frontend and backend components along with the backends are created in one service project.
The following figure depicts the components of a global external Application Load Balancer in one service project, which is attached to the host project in a Shared VPC network.
These steps should be carried out by the service project administrator (or a developer operating within the service project) and do not require involvement from the host project administrator. The steps in this section are similar to the standard steps to set up a global external Application Load Balancer.
The example on this page explicitly sets a reserved IP address for the global external Application Load Balancer's forwarding rule, rather than allowing an ephemeral IP address to be allocated. As a best practice, we recommend reserving IP addresses for forwarding rules.
The precursor to creating a managed instance group is the creation of an instance template, which is a resource that you can use to create virtual machine (VM) instances. Traffic from clients is load balanced to VMs in an instance group. The managed instance group provides VMs that run the backend servers of an external Application Load Balancer. In this example, the backends serve their own hostnames.
Create an instance template to save the VM instance configuration that is used to provision VM instances for your global external Application Load Balancer's backend.
In the Google Cloud console, go to the Compute Engine Instance templates page.
Click Create instance template.
For Name, enter backend-template.
In the Boot disk section, ensure that the boot disk is set to a Debian image, such as Debian GNU/Linux 12 (bookworm). Click Change to change the image if necessary.
Expand the Advanced options section.
Expand the Networking section, and in the Network tags field, enter
load-balanced-backend.
For Network interfaces, select Networks shared with me (from host
project: HOST_PROJECT_ID).
In the Shared subnetwork list, select the lb-backend-subnet
subnet from the lb-network network.
Expand the Management section, and in the Automation field, specify the following startup script:
#! /bin/bash
apt-get update
apt-get install apache2 -y
a2ensite default-ssl
a2enmod ssl
vm_hostname="$(curl -H "Metadata-Flavor:Google" \
http://metadata.google.internal/computeMetadata/v1/instance/name)"
echo "Page served from: $vm_hostname" | \
tee /var/www/html/index.html
systemctl restart apache2
Click Create.
Create a managed instance group to provide the backend servers that handle requests distributed by the global external Application Load Balancer's backend service.
In the Google Cloud console, go to the Compute Engine Instance groups page.
Click Create Instance Group.
From the options, select New managed instance group (stateless).
For the name of the instance group, enter lb-backend.
In the Instance template list, select the instance template
backend-template that you created in the previous step.
In the Location section, select Single zone, and enter the following values:
For Region, select us-west1.
For Zone, select us-west1-a.
In the Autoscaling section, enter the following values:
For Autoscaling mode, select On: add and remove instances to the group.
For Minimum number of instances, select 2.
For Maximum number of instances, select 3.
In the Port mapping section, click Add port, and enter the following values:
For Port name, enter http.
For Port number, enter 80.
Click Create.
Create an instance template:
gcloud compute instance-templates create backend-template \
--region=us-west1 \
--network=projects/HOST_PROJECT_ID/global/networks/lb-network \
--subnet=projects/HOST_PROJECT_ID/regions/us-west1/subnetworks/lb-backend-subnet \
--tags=load-balanced-backend \
--image-family=debian-12 \
--image-project=debian-cloud \
--metadata=startup-script='#! /bin/bash
apt-get update
apt-get install apache2 -y
a2ensite default-ssl
a2enmod ssl
vm_hostname="$(curl -H "Metadata-Flavor:Google" \
http://metadata.google.internal/computeMetadata/v1/instance/name)"
echo "Page served from: $vm_hostname" | \
tee /var/www/html/index.html
systemctl restart apache2' \
--project=SERVICE_PROJECT_ID
Create a managed instance group and select the instance template that you created in the preceding step:
gcloud compute instance-groups managed create lb-backend \
--zone=us-west1-a \
--size=2 \
--template=backend-template \
--project=SERVICE_PROJECT_ID
Add a named port to the instance group:
gcloud compute instance-groups set-named-ports lb-backend \
--named-ports=http:80 \
--zone=us-west1-a \
--project=SERVICE_PROJECT_ID
Health checks are tests that confirm the availability of backends. Create a
health check that uses the HTTP protocol and probes on port 80. Later, you'll
attach this health check to the backend service referenced by the load balancer.
In the Google Cloud console, go to the Compute Engine Health checks page.
For the name of the health check, enter lb-health-check.
Set the protocol to HTTP.
Click Create.
Create an HTTP health check.
gcloud compute health-checks create http lb-health-check \ --use-serving-port \ --project=SERVICE_PROJECT_ID
Reserve a global static external IP address that can be assigned to the forwarding rule of the load balancer.
In the Google Cloud console, go to the VPC IP addresses page.
Click Reserve external static IP address.
For Name, enter lb-ipv4-1.
Set Network Service Tier to Premium.
Set IP version to IPv4.
Set Type to Global.
Click Reserve.
Create a global static external IP address.
gcloud compute addresses create lb-ipv4-1 \ --ip-version=IPV4 \ --network-tier=PREMIUM \ --global --project=SERVICE_PROJECT_ID
To create the load balancer, you must have an SSL certificate resource that can be attached to the target proxy. The SSL certificate resource can be either a certificate map or a Compute Engine SSL certificate (classic certificate).
You can create a certificate map as described in one of the following documents:
For an HTTPS load balancer, create a Compute Engine SSL certificate resource as described in one of the following documents:
We recommend using a Google-managed certificate.
This section shows you how to create the following resources for a global external Application Load Balancer:
In this example, you can use HTTP or HTTPS as the request-and-response protocol between the client and the load balancer. For HTTPS, you need an SSL certificate resource to configure the proxy. We recommend using a Google-managed certificate.
In the Google Cloud console, go to the Load balancing page.
l7-xlb-shared-vpc.For HTTP traffic:
Click Frontend configuration.
For the name of the load balancer frontend, enter http-fw-rule.
For Protocol, select HTTP.
Set IP version to IPv4.
For IP address, select lb-ipv4-1, which is the IP address that you
reserved earlier.
Set the Port to 80 to allow HTTP traffic.
To complete the frontend configuration, click Done.
Verify that there is a blue check mark next to Frontend configuration before continuing.
For HTTPS traffic:
Click Frontend configuration.
For the name of the load balancer frontend, enter https-fw-rule.
For Protocol, select HTTPS.
Set IP version to IPv4.
For IP address, select lb-ipv4-1, which is the IP address that you
reserved earlier.
Set the Port to 443 to allow HTTPS traffic.
For Choose certificate repository, select Use certificate map or Use classic certificates.
Depending on your selection, select a certificate map or a classic certificate.
To complete the frontend configuration, click Done.
Verify that there is a blue check mark next to Frontend configuration before continuing.
Click Backend configuration.
In the Backend services and backend buckets menu, click Create a backend service.
For the name of the backend service, enter lb-backend-service.
For Backend type, select Instance group.
Set Protocol to HTTP.
In the Named port field, enter http. This is the same port name that
you entered while creating the managed instance group.
To add backends to the backend service, do the following:
In the Backends section, set the Instance group to
lb-backend, which is the managed instance group that you
created in an earlier step.
For Port numbers, enter 80.
To add the backend, click Done.
To add a health check, in the Health check list, select
lb-health-check, which is the health check that you created earlier.
To create the backend service, click Create.
Verify that there is a blue check mark next to Backend configuration before continuing.
lb-backend-service is the
default backend service for any unmatched host and any unmatched path.For information about traffic management, see Set up traffic management.
Click Review and finalize.
Review the frontend and backend settings of the load balancer to ensure that it is configured as desired.
Click Create, and then wait for the load balancer to be created.
Create a backend service to distribute traffic among backends:
gcloud compute backend-services create lb-backend-service \
--load-balancing-scheme=EXTERNAL_MANAGED \
--protocol=HTTP \
--port-name=http \
--health-checks=lb-health-check \
--global \
--project=SERVICE_PROJECT_ID
Add your instance group as the backend to the backend service:
gcloud compute backend-services add-backend lb-backend-service \
--instance-group=lb-backend \
--instance-group-zone=us-west1-a \
--global \
--project=SERVICE_PROJECT_ID
Create a URL map to route incoming requests to the backend service:
gcloud compute url-maps create lb-map \
--default-service=lb-backend-service \
--global \
--project=SERVICE_PROJECT_ID
Create a target proxy.
For HTTP traffic, create a target HTTP proxy to route requests to the URL map:
gcloud compute target-http-proxies create http-proxy \
--url-map=lb-map \
--global \
--project=SERVICE_PROJECT_ID
For HTTPS traffic, create a target HTTPS proxy to route requests to the URL map. The proxy is the part of the load balancer that holds the SSL certificate for an HTTPS load balancer, so you also load your SSL certificate in this step:
gcloud compute target-https-proxies create https-proxy \
--url-map=lb-map \
--ssl-certificates=lb-ssl-cert
--global \
--project=SERVICE_PROJECT_ID
Create a forwarding rule.
For HTTP traffic, create a global forwarding rule to route incoming requests to the target proxy:
gcloud compute forwarding-rules create http-fw-rule \
--load-balancing-scheme=EXTERNAL_MANAGED \
--address=lb-ipv4-1 \
--global \
--target-http-proxy=http-proxy \
--ports=80 \
--project=SERVICE_PROJECT_ID
For HTTPS traffic, create a global forwarding rule to route incoming requests to the target proxy:
gcloud compute forwarding-rules create https-fw-rule \
--load-balancing-scheme=EXTERNAL_MANAGED \
--address=lb-ipv4-1 \
--global \
--target-https-proxy=https-proxy \
--ports=443 \
--project=SERVICE_PROJECT_ID
When the load balancing service is running, you can send traffic to the forwarding rule and watch the traffic be dispersed to different instances.
In the Google Cloud console, go to the Load balancing page.
Click the load balancer that you just created.
Note the load balancer's IP address. This IP address is referred to as
LB_IP_ADDRESS in the following steps.
In the Backend section, confirm that the VMs are healthy.
The Healthy column should be populated, indicating that the VMs are
healthy—for example, if two instances are created, then you should
see a message indicating 2 of 2 with a green check mark next to it. If
you see otherwise, first try reloading the page. It can take a few
minutes for the Google Cloud console to indicate that the VMs are
healthy. If the backends do not appear healthy after a few minutes,
review the firewall configuration and the network tag assigned to your
backend VMs.
After the Google Cloud console shows that the backend instances are
healthy, you can test your load balancer by pointing your web browser to
https://LB_IP_ADDRESS (or
http://LB_IP_ADDRESS). Replace
LB_IP_ADDRESS with the load balancer's IP
address.
If you used a self-signed certificate for testing HTTPS, your browser displays a warning. You must explicitly instruct your browser to accept a self-signed certificate.
Your browser should render a page with content showing the name of the
instance that served the page (for example, Page served from:
lb-backend-example-xxxx). If your browser doesn't render this page,
review the configuration settings in this guide.
Note the IP address that was reserved:
gcloud compute addresses describe IP_ADDRESS_NAME \
--format="get(address)" \
--global
You can test your load balancer by pointing your web browser to
https://LB_IP_ADDRESS (or
http://LB_IP_ADDRESS). Replace
LB_IP_ADDRESS with the load balancer's IP
address.
If you used a self-signed certificate for testing HTTPS, your browser displays a warning. You must explicitly instruct your browser to accept a self-signed certificate.
Your browser should render a page with minimal information about the backend instance. If your browser doesn't render this page, review the configuration settings in this guide.
This section shows you how to configure a load balancer with a cross-project backend service in a Shared VPC environment.
The previous example on this page shows you how to set up a Shared VPC deployment where all the load balancer components and its backends are created in one service project. Global external Application Load Balancers also let you configure Shared VPC deployments where a URL map in one host or service project references backend services (and backends) located across multiple service projects in the Shared VPC environment.
You can use the steps in this section as a reference to configure any of the supported combinations listed here:
While this section uses a Shared VPC environment to configure a cross-project deployment, a Shared VPC environment isn't required. For global external Application Load Balancers, your load balancer frontend can reference backend services or backend buckets from any project within the same organization.
If you haven't already done so, you must complete all of the prerequisite steps to set up Shared VPC and configure the network, subnets, and firewall rules required for this example. For instructions, see the following sections at the beginning of this page:
In this setup, the forwarding rule, target proxy, and URL map are located in one service project, and the backend service and backends are located in another service project.
The following figure depicts a global external Application Load Balancer in which the load balancer's backend service in one service project is referenced by a URL map in another service project.
Cross-project service referencing with a global external Application Load Balancer does not require backend instances to be a part of the same VPC network or a Shared VPC network.
In this example, the backend VMs in the service project are a part of the Shared VPC network that is created in the host project. However, you can also set up a standalone VPC network (that is, an unshared VPC network), along with the required firewall rules, in a service project. You can then create backend instances (for example, an instance group) that are a part of this standalone VPC network. After you create the backend instances, you can follow the remaining steps, as depicted in this example, to create a backend service in the service project and connect it to a URL map in another service project by using cross-project service referencing.
In this section, you need to configure the following backend resources in service project B:
The precursor to creating a managed instance group is the creation of an instance template, which is a resource that you can use to create virtual machine (VM) instances. Traffic from clients is load balanced to VMs in an instance group. The managed instance group provides VMs that run the backend servers of an external Application Load Balancer. In this example, the backends serve their own hostnames.
Create an instance template
In the Google Cloud console, go to the Compute Engine Instance templates page.
Click Create instance template.
For Name, enter backend-template.
In the Boot disk section, ensure that the boot disk is set to a Debian image, such as Debian GNU/Linux 12 (bookworm). Click Change to change the image if necessary.
Expand the Advanced options section.
Expand the Networking section, and in the Network tags field, enter
load-balanced-backend.
For Network interfaces, select Networks shared with me (from host
project: HOST_PROJECT_ID).
In the Shared subnetwork list, select the lb-backend-subnet
subnet from the lb-network network.
Expand the Management section, and in the Automation field, specify the following startup script:
#! /bin/bash
apt-get update
apt-get install apache2 -y
a2ensite default-ssl
a2enmod ssl
vm_hostname="$(curl -H "Metadata-Flavor:Google" \
http://metadata.google.internal/computeMetadata/v1/instance/name)"
echo "Page served from: $vm_hostname" | \
tee /var/www/html/index.html
systemctl restart apache2
Click Create.
Create a managed instance group
In the Google Cloud console, go to the Compute Engine Instance groups page.
Click Create Instance Group.
From the options, select New managed instance group (stateless).
For the name of the instance group, enter lb-backend.
In the Instance template list, select the instance template
backend-template that you created in the previous step.
In the Location section, select Single zone, and enter the following values:
For Region, select us-west1.
For Zone, select us-west1-a.
In the Autoscaling section, enter the following values:
For Autoscaling mode, select On: add and remove instances to the group.
For Minimum number of instances, select 2.
For Maximum number of instances, select 3.
In the Port mapping section, click Add port, and enter the following values:
For Port name, enter http.
For Port number, enter 80.
Click Create.
Create an instance template:
gcloud compute instance-templates create backend-template \
--region=us-west1 \
--network=projects/HOST_PROJECT_ID/global/networks/lb-network \
--subnet=projects/HOST_PROJECT_ID/regions/us-west1/subnetworks/lb-backend-subnet \
--tags=load-balanced-backend \
--image-family=debian-12 \
--image-project=debian-cloud \
--metadata=startup-script='#! /bin/bash
apt-get update
apt-get install apache2 -y
a2ensite default-ssl
a2enmod ssl
vm_hostname="$(curl -H "Metadata-Flavor:Google" \
http://metadata.google.internal/computeMetadata/v1/instance/name)"
echo "Page served from: $vm_hostname" | \
tee /var/www/html/index.html
systemctl restart apache2' \
--project=SERVICE_PROJECT_B_ID
Create a managed instance group and select the instance template that you created in the preceding step:
gcloud compute instance-groups managed create lb-backend \
--zone=us-west1-a \
--size=2 \
--template=backend-template \
--project=SERVICE_PROJECT_B_ID
Add a named port to the instance group:
gcloud compute instance-groups set-named-ports lb-backend \
--named-ports=http:80 \
--zone=us-west1-a \
--project=SERVICE_PROJECT_B_ID
Health checks are tests that confirm the availability of backends. Create a
health check that uses the HTTP protocol and probes on port 80. Later, you'll
attach this health check to the backend service referenced by the load balancer.
In the Google Cloud console, go to the Compute Engine Health checks page.
For the name of the health check, enter lb-health-check.
Set the protocol to HTTP.
Click Create.
Create an HTTP health check.
gcloud compute health-checks create http lb-health-check \ --use-serving-port \ --project=SERVICE_PROJECT_B_ID
Create a global backend service to distribute traffic among backends. As a part of this step, you need to assign the health check that you created to the backend service and add the instance group as the backend to the backend service.
In the Google Cloud console, go to the Load balancing page.
Go to the Backends section.
Click Create backend service.
For Global backend service, click the Create button next to it.
For the name of the backend service, enter cross-ref-backend-service.
For Backend type, select Instance group.
Set Protocol to HTTP.
In the Named port field, enter http. This is the same port name that
you entered while creating the managed instance group.
To add backends to the backend service, do the following:
In the Backends section, set the Instance group to
lb-backend, which is the managed instance group that you
created in an earlier step.
For Port numbers, enter 80.
To add the backend, click Done.
To add a health check, in the Health check list, select
lb-health-check, which is the health check that you created earlier.
Optional: In the Add permissions section, enter the
IAM principals from other projects (typically an email
address) that have the Compute Load Balancer Admin role
(roles/compute.loadBalancerAdmin) so that they can use this backend
service for load balancers in their own projects. Without this permission,
you can't use cross-project service referencing.
If you don't have permission to set access control policies for backend services in this project, you can still create the backend service now, and an authorized user can perform this step later as described in the section, Grant permissions to the Compute Load Balancer Admin to use the backend service. That section also describes how to grant access to all the backend services in this project, so that you don't have to grant access every time you create a new backend service.
To create the backend service, click Create.
Create a global backend service to distribute traffic among backends:
gcloud compute backend-services create cross-ref-backend-service \
--load-balancing-scheme=EXTERNAL_MANAGED \
--protocol=HTTP \
--port-name=http \
--health-checks=lb-health-check \
--global \
--project=SERVICE_PROJECT_B_ID
Add your instance group as the backend to the backend service:
gcloud compute backend-services add-backend cross-ref-backend-service \
--instance-group=lb-backend \
--instance-group-zone=us-west1-a \
--global \
--project=SERVICE_PROJECT_B_ID
In this section, you need to configure the following frontend resources in service project A:
Reserve a global static external IP address that can be assigned to the forwarding rule of the load balancer.
In the Google Cloud console, go to the VPC IP addresses page.
Click Reserve external static IP address.
For Name, enter cross-ref-ip-address.
Set Network Service Tier to Premium.
Set IP version to IPv4.
Set Type to Global.
Click Reserve.
Create a global static external IP address.
gcloud compute addresses create cross-ref-ip-address \
--ip-version=IPV4 \
--network-tier=PREMIUM \
--global \
--project=SERVICE_PROJECT_A_ID
To create the load balancer, you must have an SSL certificate resource that can be attached to the target proxy. The SSL certificate resource can be either a certificate map or a Compute Engine SSL certificate (classic certificate).
You can create a certificate map as described in one of the following documents:
For an HTTPS load balancer, create a Compute Engine SSL certificate resource as described in one of the following documents:
We recommend using a Google-managed certificate.
In the Google Cloud console, go to the Load balancing page.
cross-ref-lb-shared-vpc.For HTTP:
cross-ref-http-forwarding-rule.HTTP.80.For HTTPS:
If you are using HTTPS between the client and the load balancer, you need one or more SSL certificate resources to configure the proxy.
cross-ref-https-forwarding-rule.HTTPS (includes HTTP/2).443 to allow HTTPS traffic.cross-ref-backend-service.For information about traffic management, see Set up traffic management.
Optional: Before creating a load balancer with cross-referencing backend services, find out whether the backend services you want to refer to can be referenced using a URL map:
gcloud compute backend-services list-usable \
--global \
--project=SERVICE_PROJECT_B_ID
Create a URL map to route incoming requests to the backend service:
gcloud compute url-maps create cross-ref-url-map \
--default-service=projects/SERVICE_PROJECT_B_ID/global/backendServices/cross-ref-backend-service \
--global \
--project=SERVICE_PROJECT_A_ID
Create a target proxy.
For HTTP traffic, create a target HTTP proxy to route requests to the URL map:
gcloud compute target-http-proxies create cross-ref-http-proxy \
--url-map=cross-ref-url-map \
--global \
--project=SERVICE_PROJECT_A_ID
For HTTPS traffic, create a target HTTPS proxy to route requests to the URL map. The proxy is the part of the load balancer that holds the SSL certificate for an HTTPS load balancer, so you also load your SSL certificate in this step:
gcloud compute target-https-proxies create cross-ref-https-proxy \
--url-map=cross-ref-url-map \
--ssl-certificates=lb-ssl-cert \
--global \
--project=SERVICE_PROJECT_A_ID
Create a forwarding rule.
For HTTP traffic, create a global forwarding rule to route incoming requests to the target proxy:
gcloud compute forwarding-rules create cross-ref-http-forwarding-rule \
--load-balancing-scheme=EXTERNAL_MANAGED \
--address=cross-ref-ip-address \
--global \
--target-http-proxy=cross-ref-http-proxy \
--ports=80 \
--project=SERVICE_PROJECT_A_ID
For HTTPS traffic, create a global forwarding rule to route incoming requests to the target proxy:
gcloud compute forwarding-rules create cross-ref-https-forwarding-rule \
--load-balancing-scheme=EXTERNAL_MANAGED \
--address=cross-ref-ip-address \
--global \
--target-https-proxy=cross-ref-https-proxy \
--ports=443 \
--project=SERVICE_PROJECT_A_ID
If you want load balancers to reference backend services in other service
projects, the Load Balancer Admin must have the compute.backendServices.use
permission. To grant this permission, you can use the predefined
IAM role called
Compute Load Balancer Services User (roles/compute.loadBalancerServiceUser).
This role must be granted by the Service Project Admin and can be applied at
the project level or at the individual backend service level.
This step is not required if you already granted the required permissions at the backend service level while creating the backend service. You can either skip this section or continue reading to learn how to grant access to all the backend services in this project so that you don't have to grant access every time you create a new backend service.
In this example, a Service Project Admin from service project B must run one
of the following commands to grant the compute.backendServices.use permission
to a Load Balancer Admin from service project A. This can be done either at the
project level (for all backend services in the project) or per backend service.
Use the following steps to grant permissions to all backend services in your project.
You require the compute.backendServices.setIamPolicy and the
resourcemanager.projects.setIamPolicy permissions to complete this step.
In the Google Cloud console, go to the IAM page.
Select your project.
Click Grant access.
In the New principals field, enter the principal's email address or other identifier.
In the Select a role list, select the Compute Load Balancer Services User.
Optional: Add a condition to the role.
Click Save.
Use the following steps to grant permissions to individual backend services in your project.
You require the compute.backendServices.setIamPolicy permission to
complete this step.
In the Google Cloud console, go to the Backends page.
From the backends list, select the backend service that you want to grant access to and click Permissions.
Click Add principal.
In the New principals field, enter the principal's email address or other identifier.
In the Select a role list, select the Compute Load Balancer Services User.
Click Save.
Use the following steps to grant permissions to all backend services in your project.
You require the compute.backendServices.setIamPolicy and the
resourcemanager.projects.setIamPolicy permissions to complete this step.
gcloud projects add-iam-policy-binding SERVICE_PROJECT_B_ID \
--member="user:LOAD_BALANCER_ADMIN" \
--role="roles/compute.loadBalancerServiceUser"
At the backend service level, Service Project Admins can use either of the
following commands to grant the Compute Load Balancer Services User role
(roles/compute.loadBalancerServiceUser).
You require the compute.backendServices.setIamPolicy permission to
complete this step.
gcloud projects add-iam-policy-binding SERVICE_PROJECT_B_ID \
--member="user:LOAD_BALANCER_ADMIN" \
--role="roles/compute.loadBalancerServiceUser" \
--condition='expression=resource.name=="projects/SERVICE_PROJECT_B_ID/regions/us-west1/backend-services/BACKEND_SERVICE_NAME",title=Shared VPC condition'
or
gcloud compute backend-services add-iam-policy-binding BACKEND_SERVICE_NAME \
--member="user:LOAD_BALANCER_ADMIN" \
--role="roles/compute.loadBalancerServiceUser" \
--project=SERVICE_PROJECT_B_ID \
--region=us-west1
To use these commands, replace LOAD_BALANCER_ADMIN with the
user's principal—for
example, test-user@gmail.com.
You can also configure IAM permissions so that they only apply to a subset of regional backend services by using conditions and specifying condition attributes.
It can take several minutes for the load balancer to be configured. When the load balancing service is running, you can send traffic to the forwarding rule in service project A and watch the traffic be dispersed to different VM instances in service project B.
In the Google Cloud console, go to the Load balancing page in service project A.
Click the load balancer that you just created.
Note the load balancer's IP address. This IP address is referred to as
LB_IP_ADDRESS in the following steps.
You can test your load balancer by pointing your web browser to
https://LB_IP_ADDRESS (or
http://LB_IP_ADDRESS). Replace
LB_IP_ADDRESS with the load balancer's IP
address.
If you used a self-signed certificate for testing HTTPS, your browser displays a warning. You must explicitly instruct your browser to accept a self-signed certificate.
Your browser should render a page with content showing the name of the
instance that served the page (for example, Page served from:
lb-backend-example-xxxx). If your browser doesn't render this page,
review the configuration settings in this guide.
Note the IP address that was reserved:
gcloud compute addresses describe IP_ADDRESS_NAME \
--format="get(address)" \
--global
--project=SERVICE_PROJECT_A_ID
You can test your load balancer by pointing your web browser to
https://LB_IP_ADDRESS (or
http://LB_IP_ADDRESS). Replace
LB_IP_ADDRESS with the load balancer's IP
address.
If you used a self-signed certificate for testing HTTPS, your browser displays a warning. You must explicitly instruct your browser to accept a self-signed certificate.
Your browser should render a page with minimal information about the backend instance. If your browser doesn't render this page, review the configuration settings in this guide.
Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2026-07-17 UTC.