This page is for networking specialists who want to migrate from [Serverless VPC Access connectors](https://docs.cloud.google.com/appengine/docs/standard/connecting-vpc.md.txt) to [Direct VPC egress](https://docs.cloud.google.com/appengine/docs/standard/shared-vpc-direct-vpc.md.txt) when sending traffic to a Shared VPC network. Direct VPC egress is faster and can handle more traffic than connectors, delivering lower latency and higher throughput because it uses a new, direct network path instead of connector instances. ## Before you begin Before you migrate, we recommend that you familiarize yourself with the following for Direct VPC egress: - [Prerequisites](https://docs.cloud.google.com/appengine/docs/standard/shared-vpc-direct-vpc.md.txt#before-you-begin) - [Limitations](https://docs.cloud.google.com/appengine/docs/standard/vpc-direct-vpc.md.txt#limitations) - [IP address allocation](https://docs.cloud.google.com/appengine/docs/standard/shared-vpc-direct-vpc.md.txt#direct-vpc-ip-addresses) - [IAM permissions](https://docs.cloud.google.com/appengine/docs/standard/shared-vpc-direct-vpc.md.txt#iam) Connectors continue to incur charges even if they have no traffic and are disconnected. For details, see [pricing](https://cloud.google.com/vpc/pricing#serverless-vpc-pricing). If you no longer need your connector, be sure to delete it. ## Migrate services to Direct VPC egress gradually When you migrate App Engine services from Serverless VPC Access connectors to Direct VPC egress, we recommend that you do so in a gradual transition. To transition gradually: 1. Follow the instructions in this section to update your service to use Direct VPC egress. 2. [Split a small percentage of traffic](https://docs.cloud.google.com/appengine/docs/standard/splitting-traffic.md.txt#turning_on_traffic_splitting_in_the_console_name) to determine if the traffic routes correctly. 3. Update the traffic split to send all traffic to the new version using Direct VPC egress. To migrate traffic with Direct VPC egress for a service, use the Google Cloud CLI: 1. Open your service's `app.yaml` file and remove any existing `vpc_access_connector` configurations. For example: ```yaml vpc_access_connector: name: projects/PROJECT_ID/locations/REGION/connectors/CONNECTOR_NAME ``` 2. Add the following `vpc_access` configuration section in your `app.yaml` file, and specify the fully qualified resource names for the Shared VPC network and subnet in the host project: ```yaml vpc_access: network_interface: network: projects/HOST_PROJECT_ID/global/networks/VPC_NETWORK subnet: projects/HOST_PROJECT_ID/regions/REGION/subnetworks/SUBNET_NAME tags: - NETWORK_TAGS vpc_egress: EGRESS_SETTING ``` Replace the following: - HOST_PROJECT_ID: the ID of your Shared VPC host project. - VPC_NETWORK: the name of your Shared VPC network. - REGION: the region for your App Engine service, which must match the region of your subnet. - SUBNET_NAME: the name of your subnet. - Optional: NETWORK_TAGS lists network tags to associate with your App Engine service's instances for use in firewall rules and routing policies. - Optional: EGRESS_SETTING controls how outbound traffic is routed. This field supports the following configuration settings: - `all-traffic`: All outbound requests are routed through the VPC network. - `private-ranges-only` (default): Only traffic to internal IP addresses is routed through the VPC network. Internet traffic uses the default App Engine path. 3. Re-deploy your service to App Engine by running the following command: ```bash gcloud app deploy --no-promote ``` 4. To determine if traffic routes correctly, [split a small percentage of traffic](https://docs.cloud.google.com/appengine/docs/standard/splitting-traffic.md.txt#turning_on_traffic_splitting_in_the_console_name) to the new version that uses Direct VPC egress. 5. After verifying that traffic is routed correctly, [migrate all traffic](https://docs.cloud.google.com/appengine/docs/standard/migrating-traffic.md.txt) to the new version. 6. If you no longer need your Serverless VPC Access connector, [delete it](https://docs.cloud.google.com/appengine/docs/standard/connecting-vpc.md.txt#delete) to stop incurring costs. ## What's next - Learn more about the [Best practices for IP management](https://docs.cloud.google.com/appengine/docs/standard/networking-best-practices.md.txt#ip-management). - Learn how to [secure your App Engine app](https://docs.cloud.google.com/appengine/docs/standard/application-security.md.txt).