Is it possible to use Google App Engine with Google Cloud VPN?

Question

The documentation from Google is not really clear about it. Here ( https://cloud.google.com/compute/docs/vpn/overview ) it says

Google Cloud VPN securely connects your existing network to your Google Cloud Platform (GCP) network through an IPsec VPN connection

Considering that Both Google App Engine (GAE) and Google Compute Engine (GCE) are part of Google Cloud Platform (GCP), it would mean that Google Cloud VPN works for both GAE and GCE.

Also, the section for Cloud VNP is at the same level than GAE and GCE in the project console :

But the documentation is located in /compute/docs which should not obviously be compatible with /appengine/docs

And here is a graph describing the tunnel, which talks only about GCE, which could exclude GAE :

So, is GAE compatible with Cloud VPN or is it restricted to GCE only ?

Answer 1

Google Cloud VPN securely connects your existing network to your Google Cloud Platform (GCP) network through an IPsec VPN connection. Therefore, only resources that are connected to GCP networks can communicate through Cloud VPN tunnels.

App Engine Flexible Environment is based on Google Compute Engine and consequently can connect to your remote network via Cloud VPNs. As described in this article, you can specify network settings in your app.yaml configuration file of your GAE Flexible application.

Answer 2

Google App Engine standard CAN'T use VPN directly, however the new Flexible Google App Engine (now officially released, no longer in beta) CAN use it directly. Just set up google cloud VPN and your network from the console and make sure to include the network in your app.yaml file.

Flexible App Engine is be the easiest way for new applications to utilize VPN connections since there won't be any migration headaches.

For a standard app engine application that can't be ported over to flexible for whatever reason, you CAN still use a VPN connection - however, it requires a service to be running on flexible app engine (or compute engine), and your app will need to interface with it somehow. This may be the simplest method, as migrating from standard to flexible is not the simplest of tasks. I know - I've done it.