let's imagine a simple system deployed on GCP. There is public, authenticated (token, IP whitelisting) API exposed by our system. There is a protected resource R (SQL database) that is accessible by API. We would like to add to our system additional possibility accessing via VPN for some our clients, it means that part of R should be accessible only via VPN and, other part of R should accessible still via public API. Can you hint me how to correctly design it?
Generally, you put a public server in a demilitarized zone (DMZ).
Optimally, you configure public services and private services to different interfaces/IP addresses. Alternatively, you can use different TCP ports (e.g. port 443 to public HTTPS access and port 8443 for private/administrative HTTP access).
On the public-facing firewall, you permit traffic to the public IP/port (possibly using port forwarding/destination NAT, depending on design). On the firewall facing the private network, you can permit traffic to more services.
Then you can add a VPN gateway, allowing VPN peers access to more than the public services.