I have setup a VPC and instances that have no public IP. I have also setup a CloudNAT for the ranges of the subnet. I want the instances to be able to reach GCP services and make sure that the traffic does not leave google's network.
From the documentation it states that PGA should be enabled for all addresses that the NAT is in effect, however the respective property on the subnet is set to false. Is PGA enabled implicitly by default regardless of the subnet property ? What is the best way to verify that the traffic stays within GCP ?