### Region ID The `REGION_ID` is an abbreviated code that Google assigns based on the region you select when you create your app. The code does not correspond to a country or province, even though some region IDs may appear similar to commonly used country and province codes. For apps created after February 2020, `REGION_ID.r` is included in App Engine URLs. For existing apps created before this date, the region ID is optional in the URL. Learn more [about region IDs](https://docs.cloud.google.com/appengine/docs/flexible/python/how-requests-are-routed#region-id). OK Security is a core feature of the Google Cloud, but there are still steps you should take to protect your App Engine app and identify vulnerabilities. Use the following features to ensure that your App Engine app is secure. To learn more about the Google Security Model and the available steps that you can take to secure your Google Cloud projects, see [Google Cloud Security](https://cloud.google.com/security). ## HTTPS requests Use HTTPS requests to access to your App Engine app securely. Depending on how your app is configured, you have the following options: `appspot.com` domains : - Use the `https` URL prefix to send HTTPS request to the `default` service of your Google Cloud project, for example: `https://PROJECT_ID.REGION_ID.r.appspot.com` - To target specific resources in your App Engine app, use the `-dot-` syntax to separate each resource you want to target, for example: `https://VERSION-dot-SERVICE-dot-PROJECT_ID.REGION_ID.r.appspot.com` - To convert an HTTP URL to an HTTPS URL, replace the periods between each resource with `-dot-`, for example: `http://SERVICE_ID.PROJECT_ID.REGION_ID.r.appspot.com` `https://SERVICE_ID-dot-PROJECT_ID.REGION_ID.r.appspot.com` For more information about HTTPS URLs and targeting resources, see [How Requests are Routed](https://docs.cloud.google.com/appengine/docs/flexible/how-requests-are-routed). Custom domains : To send HTTPS requests with your custom domain, you can use the managed SSL certificates that are provisioned by App Engine. For more information, see [Securing Custom Domains with SSL](https://docs.cloud.google.com/appengine/docs/flexible/securing-custom-domains-with-ssl). ## Access control In each Google Cloud project, set up access control to determine who can access the services within the project, including App Engine. You can assign different roles to different accounts to ensure each account has only the permissions it needs to support your app. For details see, [Setting Up Access Control](https://docs.cloud.google.com/appengine/docs/flexible/access-control). ## App Engine firewall The [App Engine firewall](https://docs.cloud.google.com/appengine/docs/flexible/creating-firewalls) enables you to control access to your App Engine app through a set of rules that can either allow or deny requests from the specified ranges of IP addresses. You are not billed for traffic or bandwidth that is blocked by the firewall. Create a firewall to: Allow only traffic from within a specific network : Ensure that only a certain range of IP addresses from specific networks can access your app. For example, create rules to allow only the range of IP addresses from within your company's private network during your app's testing phase. You can then create and modify your firewall rules to control the scope of access throughout your release process, allowing only certain organizations, either within your company or externally, to access your app as it makes its way to public availability. Allow only traffic from a specific service : Ensure that all the traffic to your App Engine app is first proxied through a specific service. For example, if you use a third-party Web Application Firewall (WAF) to proxy requests directed at your app, you can create firewall rules to deny all requests except those that are forwarded from your WAF. Block abusive IP addresses : While Google Cloud has many mechanisms in place to prevent attacks, you can use the App Engine firewall to block traffic to your app from IP addresses that present malicious intent or shield your app from denial of service attacks and similar forms of abuse. You can add IP addresses or subnetworks to a denylist, so that requests routed from those addresses and subnetworks are denied before they reach your App Engine app. For details about creating rules and configuring your firewall, see [Controlling App Access with Firewalls](https://docs.cloud.google.com/appengine/docs/flexible/creating-firewalls). ## Ingress controls You can use Ingress controls to restrict inbound traffic to your App Engine app. By default, your App Engine app accepts traffic from all network origins. To modify the default settings, and edit and view the available settings, see [Specify ingress settings](https://docs.cloud.google.com/appengine/docs/flexible/ingress-settings.md.txt). ## Egress controls By default, flexible environment instances receive an ephemeral external IP address to send outbound requests to resources on the internet. To prevent instances from using default ephemeral external IP addresses, set `instance_ip_mode: internal` in your `app.yaml` file and route outbound internet traffic through Cloud NAT with reserved static IP addresses. For configuration steps, see [Send external requests without an external IP address](https://docs.cloud.google.com/appengine/docs/flexible/disable-external-ip.md.txt#send-to-external). ### Shared internet egress risks and acceptable use By default, outbound traffic to the public internet uses ephemeral external IP addresses from a shared Google Cloud pool. Keep the following risks and responsibilities in mind:
- Prior or noisy traffic on the shared IP address pool can degrade the reputation of ephemeral external IP addresses. External firewalls and third-party web application firewalls (WAFs) might throttle or block requests from these IP addresses, causing connection timeouts or `HTTP 403` errors. - Don't use default ephemeral external IP addresses for reputation-sensitive external endpoints, such as payment gateways, hosted databases, or partner APIs behind WAFs. Instead, set `instance_ip_mode: internal` and use Cloud NAT with dedicated static external IP addresses as described in [Send external requests without an external IP address](https://docs.cloud.google.com/appengine/docs/flexible/disable-external-ip.md.txt#send-to-external). - Don't run network scanning, port enumeration, host fingerprinting, vulnerability probing, web scraping, or load testing over default ephemeral external IP addresses. Unisolated scanning activity degrades IP reputation, can disrupt service for other customers in violation of the [Google Cloud Acceptable Use Policy](https://cloud.google.com/terms/aup), and might cause Google to throttle or suspend your workload. - If you run authorized security scanning, host fingerprinting, or load testing workloads, you must isolate your outbound traffic. Configure instances with `instance_ip_mode: internal` and route outbound requests through [Cloud NAT](https://docs.cloud.google.com/appengine/docs/flexible/disable-external-ip.md.txt#send-to-external) using your own static external IP addresses. ## Security scanner - The Google Cloud [Web Security Scanner](https://docs.cloud.google.com/security-command-center/docs/concepts-web-security-scanner-overview.md.txt) discovers vulnerabilities by crawling your App Engine app, following all that links within the scope of your starting URLs, and attempting to exercise as many user inputs and event handlers as possible. - In order to use the security scanner, you must be an owner of the Google Cloud project. For more information on assigning roles, see [Setting Up Access Control](https://docs.cloud.google.com/appengine/docs/flexible/access-control). - You can run security scans from the Google Cloud console to identify security vulnerabilities in your App Engine app. For details about running the Security Scanner, see the [Using Web Security Scanner](https://docs.cloud.google.com/security-command-center/docs/how-to-use-web-security-scanner.md.txt). ## VPC Service Controls - [Not supported](https://docs.cloud.google.com/vpc-service-controls/docs/supported-products.md.txt#appengine) in the App Engine flexible environment.