Search code examples
google-cloud-platformgoogle-app-enginecloud-security

How To Give Access To Resources Behind A GPC VPC Perimeter?

I have recently set up a VPC Service Control policy in GCP. For all intents an purposes it works alright but I am having 2 problems. Both of these problems have to do with App Engine. Here are the 2 problems:

First, when I am trying to build my app engine instance, it doesn't have access to cloud storage so I get an access denied in the build process.

Secondly, my images for my app engine instance are hosted in Cloud Storage so obviously when users visit they will not be able to access these images.

Third, my Firestore DB has direct listeners using the Angular Fire package within Angular from App Engine. When calling Firestore my listeners receive the following error:

Firestore Error

Advice from anyone with any experience in this would be greatly appreciated. Given these are the 2 main resources we are trying to protect, moving them outside the VPC perimeter renders this entire solution kind of pointless, so any way we can make this work with App Engine would be great.

Solution

  • The problem is that App Engine (both standard environment and flexible environment) is not supported by VPC Service Controls. As such, it is not possible to include App Engine projects inside service perimeters.

    As stated in the Documentation

    App Engine (both standard environment and flexible environment) is not supported by VPC Service Controls. Do not include App Engine projects in service perimeters.

    However, it is possible to allow App Engine apps created in projects outside service perimeters to read and write data to protected services inside perimeters. To allow your app to access the data of protected services, create an access level that includes the project's App Engine service account. This does not enable App Engine to be used inside service perimeters.

    So it is recommended to avoid using AppEngine projects in VPC-SC perimeters. Instead they can either use AppEngine in a project outside of VPC-SC perimeter or use other serverless solutions that support VPC-SC (e.g. Cloud Run).

    Also as you included App Engine projects in service perimeters, things may not work as expected. As you have added VPC Service Controls restrictions to App Engine's default (and internal-use) GCS bucket. My understanding is that this bucket is an internal implementation and the access control change the bucket has made is not supported.

    Also have a look at this Stackoverflow Link.

    If you are not ready to move the App Engine project outside the VPC-SC perimeter, there is already a Feature request raised here, you can mark +1 Or Feel free to raise a new Feature request or contact google support explaining your concern. You can use this page for reference when creating an issue.