google-app-engine - Google App Engine 通过内部网络与 Compute Engine 通信

Question

我们正在谷歌云中构建一个应用程序。我们使用 App Engine 作为前端，使用 Compute Engine 作为后端。在这些 Compute Engine 实例上，我正在运行一个接受特定“命令”消息的 TCP 服务器。 Compute Engine 实例还在防火墙和负载均衡器后面连接到 Internet，用于传入的 https 流量。我想将 TCP 服务器绑定(bind)到本地 IP 地址，并只允许 App Engine 实例(它们在同一项目中)通过 socket api 连接到 TCP“命令”端口.

目前我们将传入连接限制为 Google Ip's only

Compute Engine documentation说以下内容:

Every instance is a member of a single network. A network performs the same function that a router does in a home network: it describes the network range and gateway IP address, handles communication between instances, and serves as a gateway between instances and callers outside the network. A network is constrained to a single project; it cannot span projects. Any communication between instances in different networks, even within the same project, must be through external IP addresses. In the API, a network is represented by the Network object.

是否有可能建立一个安全的通信设置？也许使用 App Engine 后端实例？

Answer 1

借助 App Engine Flexible，您可以设置 instance_tags 并使用它来创建具有适当标记规则的防火墙规则。参见 https://cloud.google.com/appengine/docs/flexible/custom-runtimes/configuring-your-app-with-app-yaml获取更多信息。