How can VPNs be used to bring the cloud inside a perimeter?

By connecting the on-premises private network to a private cloud network with a VPN, so the own data centre is extended by cloud components; or by connecting one private cloud to another private cloud the same way.

* The same tunnel extends the data centre into a private cloud, or joins two private clouds. *

The cloud side is built as a private network (private address range, virtual switches, firewalls) with no public exposure, and a VPN joins it to the on-premises network over the internet. To users and servers, the cloud resources then look like one more internal subnet. Cloud-to-cloud VPNs apply the same idea between two providers or two cloud tenants.

Go deeper:

• Microsoft Learn — About Azure VPN Gateway — a virtual VPN router that links on-premises to a cloud network.
• Virtual private cloud — Wikipedia — an isolated private network inside a public cloud.