3

I have many microservices in app engine only for internal use. But, by default, app engine opens service-project.appspot.com domain to public, and anyone can access them via http or https. Is there a way to restrict access only for certain IP address?

The trivial way i can think of is checking source IP address in application code. Or, I can create custom docker image with nginx configuration which checks source ip address. But, these are not quite clean solutions because access control is actually independent from application, and I don't want to hard code static IP address inside the container.

I assumed there is a way to setup firewall rule for app engine, but I could not find it. Identity-Aware Proxy seems like another option, but it is not available for app engine flex.

splash
  • 13,037
  • 1
  • 44
  • 67
essis
  • 77
  • 8

1 Answers1

2

I know this is cold comfort, but we're working on re-enabling App Engine flex support for IAP. It's going to be more than just a few days, though.

https://cloud.google.com/appengine/docs/flexible/java/migrating#users has some options that might be more palatable than hardcoding IPs. You won't be able to use GCE firewall rules because the appspot.com traffic is coming through Cloud HTTP Load Balancer, so the GCE instance firewall only sees the IP of the load balancer. If you do want to verify IPs within your app, use X-Forwarded-For as described at https://cloud.google.com/compute/docs/load-balancing/http/#components .

Hope this helps! --Matthew, Cloud IAP engineer

Matthew Sachs
  • 1,545
  • 6
  • 9
  • Thanks for the answer. I was trying to use X-Forwarded-For to get client IP address, and allow only internal IP addresses such as 10.128.16.0/20. However, client IP addresses of internal call using `http://xxx.appspot.com` are also external IP addresses. So i couldn't tell if it's from outside or inside. It should be routed locally if I use `appspot.com` domain name according to this document. https://cloud.google.com/appengine/docs/standard/java/microservice-performance – essis Jun 22 '17 at 17:13