이 페이지에서는 내부 IP 주소에만 App Engine 가변형 환경 서비스를 노출하는 데 필요한 구성에 대하여 설명합니다.
기본적으로 가변형 환경 서비스는 처음 배포될 때 내부 IP 주소와 임시 외부 IP 주소를 모두 받습니다. 임시 외부 IP 주소를 사용하면 서비스에서 인터넷의 커스텀 도메인 및 리소스가 있는 App Engine 서비스에 요청을 보낼 수 있습니다.
임시 외부 IP 주소는 비용이 발생합니다.
서비스에 외부 IP 주소가 필요하지 않으면 내부 IP 주소만 사용하도록 서비스를 제한하여 서비스에서 인터넷의 리소스에 요청을 보내지 않도록 하고 비용을 줄일 수 있습니다. 그러나 서비스의 정규화된 도메인 이름은 계속 표시되므로 커스텀 도메인이 있는 인터넷 또는 App Engine 서비스로부터 서비스가 요청을 수신하는 것을 차단하지 않습니다.
제한사항
임시 외부 IP 주소를 사용 중지하는 데에는 다음과 같은 제한사항이 있습니다.
커스텀 도메인이 있는 서비스: 커스텀 도메인으로 App Engine 서비스에 요청을 보내려면 Cloud NAT를 구성해야 합니다.
공유 VPC를 사용하는 경우 추가 구성을 위해 다음 단계에 따라 공유 VPC 네트워크를 준비합니다.
비공개 Google 액세스와 호환되는 경로가 있는지 확인합니다. 일반적으로 네트워크의 기본 경로는 비공개 Google 액세스와 호환됩니다. 다른 경로의 경우 경로가 다음과 같이 구성되었는지 확인합니다.
Network: SHARED_VPC_NETWORK_NAME
Destination IP address range: 0.0.0.0/0
Instance tags: INSTANCE_TAGS
Next hop: DEFAULT_INTERNET_GATEWAY
다음을 바꿉니다.
SHARED_VPC_NETWORK_NAME: 공유 VPC 네트워크 이름입니다.
INSTANCE_TAGS: 인스턴스 태그를 사용하지 않는 경우 이 필드에 아무것도 지정하지 마세요. 인스턴스 태그를 사용하는 경우 인스턴스 태그 목록에 aef-instances를 포함하세요.
DEFAULT_INTERNET_GATEWAY: 기본 인터넷 게이트웨이입니다.
비공개 Google 액세스의 호환 경로에 대한 자세한 내용은 라우팅 옵션에 대한 비공개 Google 액세스 문서를 참조하세요.
비공개 Google 액세스와 호환되는 방화벽 규칙이 있는지 확인합니다. 방화벽 규칙은 다음과 같이 구성해야 합니다.
Network: SHARED_VPC_NETWORK_NAME
Destination IP address range: 0.0.0.0/0
Destination filter: IP ranges
Direction of traffic: Egress
Attach on match: Allow
Instance tags: INSTANCE_TAGS
다음을 바꿉니다.
SHARED_VPC_NETWORK_NAME: 공유 VPC 네트워크 이름입니다.
INSTANCE_TAGS: 인스턴스 태그를 사용하지 않는 경우 이 필드에 아무것도 지정하지 마세요. 인스턴스 태그를 사용하는 경우 인스턴스 태그 목록에 aef-instances를 포함하세요.
비공개 Google 액세스에 호환되는 방화벽 규칙에 대한 자세한 내용은 방화벽 구성에 대한 비공개 Google 액세스 문서를 참조하세요.
내부 IP 주소만 사용하도록 서비스 구성
Google Cloud CLI를 업데이트합니다. 이렇게 하면 가변형 환경 앱에 비공개 IP 주소를 지원하는 gcloud CLI 버전을 사용할 수 있습니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[[["\u003cp\u003eThis guide outlines how to configure an App Engine flexible environment service to use only its internal IP address, thus preventing it from sending requests to resources on the internet and reducing costs associated with ephemeral external IP addresses.\u003c/p\u003e\n"],["\u003cp\u003eDisabling ephemeral external IP addresses requires enabling Private Google Access on the target subnetwork and has limitations, including the necessity to configure Cloud NAT for services with custom domains or those sending requests to external resources.\u003c/p\u003e\n"],["\u003cp\u003eTo prepare a Shared VPC network, it's essential to verify compatibility with Private Google Access by confirming the presence of a compatible default route and a firewall rule configured for egress traffic.\u003c/p\u003e\n"],["\u003cp\u003eConfiguring the service involves updating the Google Cloud CLI, adding the \u003ccode\u003einstance_ip_mode: internal\u003c/code\u003e line in the \u003ccode\u003enetwork\u003c/code\u003e section of the \u003ccode\u003eapp.yaml\u003c/code\u003e file, deploying the updated service, and verifying the absence of an external IP address on the Instances page in the Google Cloud console.\u003c/p\u003e\n"],["\u003cp\u003eServices limited to internal IPs needing to send requests to the internet can do so via setting up a Cloud NAT gateway, which acts as an intermediary allowing communication without the service utilizing an ephemeral external IP.\u003c/p\u003e\n"]]],[],null,["# Configure private internal-only services\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\nThis page shows the required configuration for exposing an App Engine flexible environment\nservice only on its internal IP address.\n\nBy default, flexible environment services receive both an internal IP address\nand an ephemeral external IP address when they are first deployed. The\nephemeral external IP address allows your service to send requests to\nApp Engine services with custom domains, and resources on the internet.\nEphemeral external IP addresses incur [costs](/vpc/network-pricing#ipaddress).\n\nIf your service does not require an external IP address, you can prevent your\nservice from sending requests to resources on the internet and reduce costs by\nlimiting your service to using only its internal IP address. This does not\nprevent your service from receiving requests from the internet or\nApp Engine services with custom domains, because the fully qualified\ndomain name of your service is still externally visible.\n\nLimitations\n-----------\n\nDisabling ephemeral external IP addresses has the following limitations:\n\n- **Services with custom domains:** To send requests to App Engine services with custom domains you must [configure Cloud NAT](/nat/docs/set-up-manage-network-address-translation).\n- **External resources:** To send requests to external resources you must [configure Cloud NAT](/nat/docs/set-up-manage-network-address-translation).\n- **Private Google Access dependency:** Instances with IP mode set to `internal` require [Private Google Access](/vpc/docs/private-google-access#pga-supported) on the target subnetwork.\n- **Legacy networks:** [Legacy networks](/vpc/docs/legacy) cannot use Private Google Access, and thus cannot disable ephemeral external IP addresses.\n\nBefore you begin\n----------------\n\nTo deploy flexible environment apps without external IP addresses, you must\nenable Private Google Access on the target subnetwork.\n\n- To learn about Private Google Access, see the [Overview](/vpc/docs/private-google-access#pga-supported).\n- For step-by-step configuration instructions, see [Enabling Private Google Access](/vpc/docs/configure-private-google-access#enabling-pga).\n\n### Prepare your Shared VPC network\n\nIf you use Shared VPC, follow these steps to prepare your\nShared VPC network for further configuration.\n\n1. Verify that you have a route that is compatible with\n Private Google Access. Typically the\n [default route](/vpc/docs/routes#routingpacketsinternet) of a network is\n compatible with Private Google Access. For other routes, confirm that\n the route is configured as follows.\n\n ```sh\n Network: SHARED_VPC_NETWORK_NAME\n Destination IP address range: 0.0.0.0/0\n Instance tags: INSTANCE_TAGS\n Next hop: DEFAULT_INTERNET_GATEWAY\n ```\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eSHARED_VPC_NETWORK_NAME\u003c/var\u003e: The name of your Shared VPC network.\n - \u003cvar translate=\"no\"\u003eINSTANCE_TAGS\u003c/var\u003e: If you do not use any instance tags, do not specify anything in this field. If you do use instance tags, include `aef-instances` in your list of instance tags.\n - \u003cvar translate=\"no\"\u003eDEFAULT_INTERNET_GATEWAY\u003c/var\u003e: The default internet gateway.\n\n To learn more about compatible routes for Private Google Access, see\n the Private Google Access documentation on\n [routing options](/vpc/docs/configure-private-google-access#config-routing).\n2. Verify that you have a firewall rule that is compatible with\n Private Google Access. The firewall rule must be configured as\n follows.\n\n ```sh\n Network: SHARED_VPC_NETWORK_NAME\n Destination IP address range: 0.0.0.0/0\n Destination filter: IP ranges\n Direction of traffic: Egress\n Attach on match: Allow\n Instance tags: INSTANCE_TAGS\n ```\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eSHARED_VPC_NETWORK_NAME\u003c/var\u003e: The name of your Shared VPC network.\n - \u003cvar translate=\"no\"\u003eINSTANCE_TAGS\u003c/var\u003e: If you do not use any instance tags, do not specify anything in this field. If you do use instance tags, include `aef-instances` in your list of instance tags.\n\n To learn more about compatible firewall rules for\n Private Google Access, see the Private Google Access\n documentation on\n [firewall configuration](/vpc/docs/configure-private-google-access#config-firewall).\n\nConfigure your service to use only its internal IP address\n----------------------------------------------------------\n\n1. Update the Google Cloud CLI. This ensures that you are using a version of the\n gcloud CLI that supports private IP addresses for\n flexible environment apps.\n\n ```bash\n gcloud components update\n ```\n2. In your `app.yaml` file, add the `instance_ip_mode` field to the\n [`network` section](/appengine/docs/flexible/reference/app-yaml#network_settings)\n and set it to `internal`.\n\n - If your `app.yaml` file already has a `network` section, add the following\n line inside the `network` section:\n\n ```bash\n instance_ip_mode: internal\n ```\n\n \u003cbr /\u003e\n\n - If your `app.yaml` file doesn't have a `network` section, create the\n section and specify the instance IP mode by adding the following lines:\n\n ```bash\n network:\n instance_ip_mode: internal\n ```\n\n \u003cbr /\u003e\n\n Save these changes.\n3. Deploy the service.\n\n ```bash\n gcloud beta app deploy\n ```\n4. Verify configuration by checking the Instances page of the Google Cloud console.\n\n [Go to Instances](https://console.cloud.google.com/appengine/instances)\n\n Scroll down to the **Instances** table (below the **Summary** chart). In the\n **External IP** column, confirm that there is no IP address listed. The\n absence of an IP address in this column means that your instance has no\n external IP address. Even though this field is empty, your instance still has\n an internal IP address.\n\nSend external requests without an external IP address\n-----------------------------------------------------\n\nIf your service sends requests to the internet but you want to limit it to using\nonly its internal IP address, you can use [Cloud NAT](/nat/docs/overview) to\ncreate a gateway. Your service can send external requests through the\nCloud NAT gateway without using the default ephemeral external IP addresses.\n\n1. Follow the steps in the section\n [Configure your service to use only its internal IP address](#limit-to-internal).\n\n2. Follow the steps to\n [Configure Cloud NAT](/nat/docs/set-up-manage-network-address-translation).\n\nTo learn more about this approach, see the Cloud Architecture Center\ndocumentation on\n[Deploying Cloud NAT for fetching](/architecture/building-internet-connectivity-for-private-vms#deploying_cloud_nat_for_fetching)."]]
