title: Confusion Around Creating a VPC Access Connector
body: <p>I am trying to <a href="https://cloud.google.com/functions/docs/connecting-vpc" rel="noreferrer">set up Serverless VPC access</a></p>
  
  <blockquote>
    <p>Serverless VPC Access enables you to connect from your Cloud Functions directly to Compute Engine VM instances, Memorystore instances, Cloud SQL instances,</p>
  </blockquote>
  
  <p>Sounds great. But the documentation is not super friendly to a beginner. Step 2 is to create a connector, about which I have a couple of questions:</p>
  
  <blockquote>
    <p>In the Network field, select the VPC network to connect to.</p>
  </blockquote>
  
  <p>My dropdown here contains only "Default". Is this normal? What should IO expect to see here?</p>
  
  <blockquote>
    <p>In the IP range field, enter an unused CIDR /28 IP range. Addresses in this range are used as source addresses for traffic sent through the connector. This IP range must not overlap with any existing IP address reservations in your VPC network.</p>
  </blockquote>
  
  <p>I don't know what to do here. I tried using the information in the <a href="https://console.cloud.google.com/networking/networks/list?_ga=2.139749936.-2023556673.1577146001" rel="noreferrer">linked document</a> to first) enter an IP from the region I had selected, and, second) enter an IP from outside that region. Both resulted in connectors that were created with the error. "<code>Connector is in a bad state, manual deletion is recommended</code>"</p>
  
  <p>The documentation continues with a couple of troubleshooting steps if the creation fails:</p>
  
  <blockquote>
    <p>Specify an IP range that does not overlap with any existing IP address reservations in the VPC network.</p>
  </blockquote>
  
  <p>I don't know what this means. Maybe like, if I have other connectors I should be sure the IP range for the new one doesn't overlap with those. That's just a guess, but anyway I have none.</p>
  
  <blockquote>
    <p>Grant your project permission to use Compute Engine VM images from the project with ID serverless-vpc-access-images. See Setting image access constraints for information on how to update your organization policy accordingly.</p>
  </blockquote>
  
  <p>This leads me to <a href="https://cloud.google.com/compute/docs/images/restricting-image-access#trusted_images" rel="noreferrer">another document</a> about updating my organization's "Image Policy". This one has me so out of my depth, I don't even think I should be here.</p>
  
  <p>This has all started with just <a href="https://stackoverflow.com/questions/59537323/using-cloud-sql-proxy-from-firebase-function">wanting to connect to a SQL Server instance from Firebase</a>. Creating the VPC connector seems like a good step, but I've just fallen at every hurdle. Can a cloud-dweller please help me with a few of these points of confusion? </p>