How can VPNs be used to bring the cloud inside a perimeter?

By connecting the on-premises private network to a private cloud network with a VPN, so the own data centre is extended by cloud components; or by connecting one private cloud to another private cloud the same way.

The cloud side is built as a private network (private address range, virtual switches, firewalls) with no public exposure, and a VPN joins it to the on-premises network over the internet. To users and servers, the cloud resources then look like one more internal subnet. Cloud-to-cloud VPNs apply the same idea between two providers or two cloud tenants.