3 ms·
How do you deal with securing the DB's in this setup? Is it possible to isolate the compute engine DB ports to only your appengine instances, or do they have to
by dabeeeenster 10y ago
How do you deal with securing the DB's in this setup? Is it possible to isolate the compute engine DB ports to only your appengine instances, or do they have to be open to the whole world?
- waprin 10y agoApp Engine Flexible runs on GCE instances, which all have internal IPs. So you can just firewall off external traffic but allow internal, which is the default anyway. Disclosure: Also GCP Developer Relations
- dabeeeenster 10y agoOK great - thanks. Just to be clear, you'd still be opening up DB ports to all internal global GCE instances?
- waprin 10y agoGlobal GCE instances within your project, yes. Not every GCE instance everywhere, that would not be very helpful :) If you wanted to have some instances that couldn't talk to your database, easiest thing to do is probably throw them in a separate project or create a new subnet that you firewall off and create your non-App Engine instances in that subnet.