Support for TLS version 1.2 and later, along with a corresponding secure set of cipher suites, is in General Availability (GA).

To increase security, starting in March 2025, support for Transport Layer Security (TLS) version 1.1 and earlier is deprecated. Update your application settings in the App Engine flexible environment to use TLS version 1.2 and later, along with a corresponding secure set of cipher suites (Preview).

Container Registry is now shut down. We recommend that you use Artifact Registry for storing and managing container images. By default, new deployments created after March 5, 2025, use Artifact Registry instead of Container Registry for storing application build images. For more information, see Migrate App Engine container images to Artifact Registry.

In the App Engine page in the Google Cloud console, you can now filter your existing App Engine versions by runtime lifecycle stages. After you apply this filter, the console displays a warning icon for App Engine versions that are approaching end of support, have reached end of support, are deprecated, and are decomissioned.

Deployments for new projects might be impacted from the following changes to org policies:

• Starting in May 2024, Google Cloud enforces secure-by-default organization policies for all organization resources. This policy prevents App Engine from granting the Editor role to the App Engine default services accounts by default.
• Starting in June 2024, Cloud Build has changed the default behavior for how Cloud Build uses service accounts in new projects. This change is detailed in Cloud Build Service Account Change. As a result of this change, new projects deploying versions for the first time may be using the default App Engine service account with insufficient permissions for deploying versions.

If you are impacted by this change, you can do the following:

• Review the Cloud Build guidance on changes to the default service account and opt out of these changes.
• Grant the Editor role to the App Engine default service account.

A warning message now appears before you publish a container image to a public repository.

Accessing a service that's prohibited by the Internal or Internal and Cloud Load Balancing ingress setting now results in a 404 rather than 403 error code.

You can now use ssh to log in to App Engine flexible environment instances that use only internal IP addresses.

You can now use any configured service account in your Cloud project as the app-level default service account, while creating and updating your App Engine applications.

The option to set IP mode to internal for App Engine flexible environment instances is now generally available.

Specifying a user-managed service account for each App Engine version during deployment is now a generally available.

Specifying a user-managed service account for each App Engine version during deployment is now available in preview. This feature lets you grant different privileges to each version, based on the specific tasks it performs, and avoid granting more privileges than necessary.

App Engine is now available in the us-west1 (Oregon), asia-southeast1 (Singapore), and asia-east1 (Taiwan) regions.

App Engine is now available in the europe-central2 region (Warsaw).

External HTTP(S) Load Balancing is now supported for App Engine via Serverless network endpoint groups. Notably, this feature allows you to use Cloud CDN with App Engine.
This feature is available in Beta.

App Engine is now available in the us-west4 region (Las Vegas, NV).

Quotas for sockets have been removed. There is no longer a limit on the number of socket connections or the amount of data you can send and receive through a socket.

App Engine is now available in the asia-northeast3 region (Seoul).

App Engine is changing the URLs that you use to send requests to your apps. URLs now include a region ID to help Google route your requests more efficiently and reliably. For example, an app can receive requests at https://PROJECT_ID.REGION_ID.r.appspot.com. This new URL is optional for existing apps and is provided for all new apps.

To ensure a smooth transition, we are slowly updating App Engine to use region IDs. If we haven't updated your Google Cloud project yet, you won't see a region ID for your app. Since the ID is optional for existing apps, you don't need to update URLs or make other changes once the region ID is available for your existing apps.

• App Engine is now available in the asia-northeast2 region (Osaka, Japan).

• App Engine is now available in the europe-west6 region (Zürich, Switzerland).

Cloud Tasks is now GA and can be used to set up tasks to be performed asychronously, outside of user requests.

Cloud Scheduler is now GA and can be used to set up scheduled units of work (cron jobs).

• App Engine is now available in the asia-east2 region (Hong Kong).

• App Engine is now available in the us-west2 region (Los Angeles).

• App Engine is now available in the northamerica-northeast1 region (Montréal, Canada).

• Improved access control documentation around deploying apps with IAM roles and service accounts:

  • Predefined App Engine roles
  • Deploying using IAM roles
  • Require permissions

• App Engine is now available in the asia-south1 region (Mumbai, India).

• Announced general availability of App Engine firewall.

• For the App Engine flexible environment, all responses are now compressed with gzip by default once you redeploy your app. No changes need to be made to your app.yaml file.