What is the best set of Authorized networks setting for PostgreSQL as it is missing App Engine authorization setting

Question

The option to authorize all apps belonging to the same project is missing in Google Cloud SQL - PostgreSQL. The documentation provide examples for authorization using the network setting 0.0.0.0/0 which simply allows all IPv4 connections.

As we do not know when the App Engine authorization feature would be available for PostgreSQL, what is the next best setting to allow the IP range of App engine instances? I am lost as they are dynamically allocated and ephemeral.

Specs

App Engine Flex (1 aspnetcore + 1 custom service on dotnet core)

Cloud SQL - PostgreSQL

Both belong to the same GCP project

Answer 1

The way to go in this case is to follow the documentation steps: add 0.0.0.0/0 as the network and configure SSL access from the App Engine Flexible to the Cloud SQL PostgreSQL instance. The crucial part here is to adjust the PostgreSQL instance details, namely the SSL connections configuration. You need to allow only SSL connections to reach your instance, this way the GAE Flex instances (and only them, as having the SSL certificate) will be able to reach the instance with the database, even having dynamically allocated IPs.

To allow SSL connections only in your PostgreSQL instance:

1. Go to Cloud Console, choose the SQL section
2. Click on your PostgreSQL instance to view its details
3. Click the Allow only SSL connections button in the SSL tab