REGION_ID는 앱을 만들 때 선택한 리전을 기준으로 Google에서 할당하는 축약된 코드입니다. 일부 리전 ID는 일반적으로 사용되는 국가 및 주/도 코드와 비슷하게 표시될 수 있지만 코드는 국가 또는 주/도와 일치하지 않습니다. 2020년 2월 이후에 생성된 앱의 경우 REGION_ID.r이 App Engine URL에 포함됩니다. 이 날짜 이전에 만든 기존 앱의 경우 URL에서 리전 ID는 선택사항입니다.
Google Cloud의 높은 보안성에도 불구하고 App Engine 앱을 보호하고 취약점을 식별하려면 몇 단계를 거쳐야 합니다.
다음 기능을 사용하여 App Engine 앱의 보안을 확인하세요. Google 보안 모델과 Google Cloud 프로젝트를 보호하기 위해 취할 수 있는 단계에 대한 자세한 내용은 Google Cloud Platform 보안을 참고하세요.
HTTPS 요청
HTTPS 요청을 사용하여 App Engine 앱에 안전하게 액세스할 수 있습니다. 앱이 구성된 방법에 따라 다음 옵션을 사용할 수 있습니다.
appspot.com 도메인
https URL 프리픽스를 사용하여 Google Cloud 프로젝트의 default 서비스로 HTTPS 요청을 보냅니다. 예를 들면 다음과 같습니다. https://PROJECT_ID.REGION_ID.r.appspot.com
App Engine 앱의 특정 리소스를 타겟팅하려면 -dot- 구문을 사용하여 타겟팅할 각 리소스를 구분합니다. 예를 들면 다음과 같습니다. https://VERSION-dot-SERVICE-dot-PROJECT_ID.REGION_ID.r.appspot.com
HTTP URL을 HTTPS URL로 변환하려면 각 리소스 사이의 마침표를 -dot-로 바꿉니다. 예를 들면 다음과 같습니다. http://SERVICE_ID.PROJECT_ID.REGION_ID.r.appspot.com https://SERVICE_ID-dot-PROJECT_ID.REGION_ID.r.appspot.com
커스텀 도메인으로 HTTPS 요청을 보내려면 App Engine을 통해 프로비저닝된 관리형 SSL 인증서를 사용할 수 있습니다. 자세한 내용은 SSL로 커스텀 도메인 보호를 참조하세요.
액세스 제어
각 Google Cloud 프로젝트에서 액세스 제어를 설정하여 App Engine을 비롯한 프로젝트에 있는 서비스에 액세스할 수 있는 사용자를 지정합니다.
각 계정에 앱을 지원하는 데 필요한 권한만 있도록 계정마다 다른 역할을 할당할 수 있습니다. 자세한 내용은 액세스 제어 설정을 참조하세요.
App Engine 방화벽
App Engine 방화벽을 사용하면 지정된 IP 주소 범위에서 들어오는 요청을 허용하거나 거부할 수 있는 규칙을 통해 App Engine 앱에 대한 액세스를 제어할 수 있습니다. 방화벽으로 차단되는 트래픽 또는 대역폭의 경우 요금이 청구되지 않습니다. 방화벽을 만들면 다음이 가능해집니다.
특정 네트워크 내 트래픽만 허용
특정 네트워크의 특정 IP 주소 범위만 앱에 액세스할 수 있는지 확인합니다. 예를 들어 앱 테스트 단계 중에는 회사의 비공개 네트워크에 있는 IP 주소 범위만 허용하는 규칙을 만듭니다. 그런 다음 출시 프로세스를 진행하면서 방화벽 규칙을 만들고 수정하여 액세스 범위를 제어할 수 있습니다. 이렇게 하면 회사 내부 또는 외부의 특정 조직만 개발 중인 앱에 액세스할 수 있습니다.
특정 서비스의 트래픽만 허용
App Engine 앱에 대한 모든 트래픽이 최우선적으로 특정 서비스를 통해 프록시 처리되도록 합니다. 예를 들어 타사 웹 애플리케이션 방화벽(WAF)을 사용하여 앱에 대한 요청을 프록시 처리하는 경우 방화벽 규칙을 만들어 WAF에서 전달되는 요청을 제외한 모든 요청을 거부할 수 있습니다.
악의적인 IP 주소 차단
Google Cloud 에는 공격을 방지하기 위한 많은 메커니즘이 마련되어 있지만 App Engine 방화벽을 사용하여 악의적인 의도를 보이는 IP 주소의 트래픽을 차단하거나, 서비스 거부 공격 및 이와 유사한 형태의 악용 사례로부터 앱을 보호할 수 있습니다. IP 주소 또는 서브네트워크를 거부 목록에 추가하여 해당 주소 및 서브네트워크에서 라우팅된 요청이 App Engine 앱에 도달하기 전에 거부되도록 할 수 있습니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[[["\u003cp\u003eThe \u003ccode\u003eREGION_ID\u003c/code\u003e is a code assigned by Google based on the region selected during app creation, included in App Engine URLs for apps created after February 2020.\u003c/p\u003e\n"],["\u003cp\u003eApp Engine offers multiple options for secure access via HTTPS, including \u003ccode\u003eappspot.com\u003c/code\u003e domains and custom domains with managed SSL certificates.\u003c/p\u003e\n"],["\u003cp\u003eAccess control within Google Cloud projects enables role-based permission assignments to control who can access App Engine services.\u003c/p\u003e\n"],["\u003cp\u003eThe App Engine firewall allows traffic control by enabling rules to allow or deny requests based on IP addresses, helping manage access and prevent abuse.\u003c/p\u003e\n"],["\u003cp\u003eThe Google Cloud Web Security Scanner helps identify vulnerabilities in App Engine apps by crawling the app and analyzing user inputs, with the requirement of project ownership to use it.\u003c/p\u003e\n"]]],[],null,["# Overview of app security\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\nGo Java Node.js PHP Python Ruby .NET Custom \n\n### Region ID\n\nThe \u003cvar translate=\"no\"\u003eREGION_ID\u003c/var\u003e is an abbreviated code that Google assigns\nbased on the region you select when you create your app. The code does not\ncorrespond to a country or province, even though some region IDs may appear\nsimilar to commonly used country and province codes. For apps created after\nFebruary 2020, \u003cvar translate=\"no\"\u003eREGION_ID\u003c/var\u003e`.r` is included in\nApp Engine URLs. For existing apps created before this date, the\nregion ID is optional in the URL.\n\nLearn more\n[about region IDs](/appengine/docs/flexible/python/how-requests-are-routed#region-id). \nOK\n\nSecurity is a core feature of the Google Cloud, but there are still steps you\nshould take to protect your App Engine app and identify vulnerabilities.\n\nUse the following features to ensure that your App Engine app is\nsecure. To learn more about the Google Security Model and the available steps\nthat you can take to secure your Google Cloud projects, see\n[Google Cloud Platform Security](/security).\n\nHTTPS requests\n--------------\n\nUse HTTPS requests to access to your App Engine app securely. Depending\non how your app is configured, you have the following options:\n\n`appspot.com` domains\n:\n - Use the `https` URL prefix to send HTTPS request to the `default` service of your Google Cloud project, for example: \n `https://`\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e`.`\u003cvar translate=\"no\"\u003e\u003ca href=\"#appengine-urls\" style=\"border-bottom: 1px dotted #999\" class=\"devsite-dialog-button\" data-modal-dialog-id=\"regional_url\" track-type=\"progressiveHelp\" track-name=\"modalHelp\" track-metadata-goal=\"regionalURL\"\u003eREGION_ID\u003c/a\u003e\u003c/var\u003e`.r.appspot.com`\n\n\n \u003c!-- --\u003e\n\n - To target specific resources in your App Engine app, use the\n `-dot-` syntax to separate each resource you want to target, for\n example: \n\n\n `https://`\u003cvar translate=\"no\"\u003eVERSION\u003c/var\u003e`-dot-`\u003cvar translate=\"no\"\u003eSERVICE\u003c/var\u003e`-dot-`\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e`.`\u003cvar translate=\"no\"\u003e\u003ca href=\"#appengine-urls\" style=\"border-bottom: 1px dotted #999\" class=\"devsite-dialog-button\" data-modal-dialog-id=\"regional_url\" track-type=\"progressiveHelp\" track-name=\"modalHelp\" track-metadata-goal=\"regionalURL\"\u003eREGION_ID\u003c/a\u003e\u003c/var\u003e`.r.appspot.com`\n\n - To convert an HTTP URL to an HTTPS URL, replace the periods\n between each resource with `-dot-`, for example: \n\n `http://`\u003cvar translate=\"no\"\u003eSERVICE_ID\u003c/var\u003e`.`\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e`.`\u003cvar translate=\"no\"\u003eREGION_ID\u003c/var\u003e`.r.appspot.com` \n\n\n `https://`\u003cvar translate=\"no\"\u003eSERVICE_ID\u003c/var\u003e`-dot-`\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e`.`\u003cvar translate=\"no\"\u003e\u003ca href=\"#appengine-urls\" style=\"border-bottom: 1px dotted #999\" class=\"devsite-dialog-button\" data-modal-dialog-id=\"regional_url\" track-type=\"progressiveHelp\" track-name=\"modalHelp\" track-metadata-goal=\"regionalURL\"\u003eREGION_ID\u003c/a\u003e\u003c/var\u003e`.r.appspot.com`\n\n\n For more information about HTTPS URLs and targeting resources, see\n [How Requests are\n Routed](/appengine/docs/flexible/how-requests-are-routed).\n\nCustom domains\n\n: To send HTTPS requests with your custom domain, you can use the managed SSL\n certificates that are provisioned by App Engine. For more information,\n see [Securing Custom Domains with\n SSL](/appengine/docs/flexible/securing-custom-domains-with-ssl).\n\n\nAccess control\n--------------\n\nIn each Google Cloud project, set up access control to determine\nwho can access the services within the project, including App Engine.\nYou can assign different roles to different accounts to ensure each account has\nonly the permissions it needs to support your app. For details see,\n[Setting Up Access\nControl](/appengine/docs/flexible/access-control).\n\nApp Engine firewall\n-------------------\n\nThe [App Engine\nfirewall](/appengine/docs/flexible/creating-firewalls)\nenables you to control access to your App Engine app through a set of\nrules that can either allow or deny requests from the specified ranges of IP\naddresses. You are not billed for traffic or bandwidth that is blocked by the\nfirewall. Create a firewall to:\n\nAllow only traffic from within a specific network\n: Ensure that only a certain range of IP addresses from specific networks can\n access your app. For example, create rules to allow only the range of IP\n addresses from within your company's private network during your app's testing\n phase. You can then create and modify your firewall rules to control the\n scope of access throughout your release process, allowing only certain\n organizations, either within your company or externally, to access your app\n as it makes its way to public availability.\n\nAllow only traffic from a specific service\n: Ensure that all the traffic to your App Engine app is first proxied\n through a specific service. For example, if you use a third-party Web\n Application Firewall (WAF) to proxy requests directed at your app, you can\n create firewall rules to deny all requests except those that are forwarded\n from your WAF.\n\nBlock abusive IP addresses\n: While Google Cloud has many mechanisms in place to prevent attacks, you can\n use the App Engine firewall to block traffic to your app from IP\n addresses that present malicious intent or shield your app from denial of\n service attacks and similar forms of abuse. You can add IP addresses or\n subnetworks to a denylist, so that requests routed from those addresses and\n subnetworks are\n denied before they reach your App Engine app.\n\nFor details about creating rules and configuring your firewall, see\n[Controlling App Access with\nFirewalls](/appengine/docs/flexible/creating-firewalls).\n\nIngress controls\n----------------\n\nYou can use Ingress controls to restrict inbound traffic to your App Engine\napp. By default, your App Engine app accepts traffic from all network origins.\nTo modify the default settings, and edit and view the available settings, see\n[Specify ingress settings](/appengine/docs/flexible/ingress-settings).\n\nSecurity scanner\n----------------\n\nThe Google Cloud [Web Security Scanner](/security-command-center/docs/concepts-web-security-scanner-overview)\ndiscovers vulnerabilities by crawling your\nApp Engine app, following all that links within the scope of your\nstarting URLs, and attempting to exercise as many user inputs and event\nhandlers as possible.\n\nIn order to use the security scanner, you must be an owner of the\nGoogle Cloud project. For more information on assigning roles, see\n[Setting Up Access\nControl](/appengine/docs/flexible/access-control).\n\nYou can run security scans from the Google Cloud console to identify security\nvulnerabilities in your App Engine app. For details about\nrunning the Security Scanner, see the\n[Using Web Security Scanner](/security-command-center/docs/how-to-use-web-security-scanner).\n\nVPC Service Controls\n--------------------\n\n[Not supported](/vpc-service-controls/docs/supported-products#appengine) in the App Engine flexible environment."]]
