這些範圍會由 Cloud Run、Cloud Run 函式和 App Engine 標準環境底層的 Google 基礎架構使用。我們保證這些 IP 的所有要求都來自 Google 基礎架構，確保每個 Cloud Run、Cloud Run 函式和 App Engine 服務/函式/應用程式只與所連結的 VPC 連接器通訊。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eThis guide outlines how to set up Serverless VPC Access connectors in a service project when using Shared VPC, offering an alternative to setting up connectors in the host project.\u003c/p\u003e\n"],["\u003cp\u003eBefore setting up, users must disable the URL Fetch default and any explicit use of the \u003ccode\u003eurlfetch\u003c/code\u003e library, as Serverless VPC Access is incompatible with the URL Fetch service.\u003c/p\u003e\n"],["\u003cp\u003eSetting up firewall rules is required to allow requests from specific IP ranges to reach and be reached by the connector, with options to apply these rules to all connectors or specific ones using network tags or IP ranges.\u003c/p\u003e\n"],["\u003cp\u003eShared VPC Admins must grant the Compute Network User role to the service project's \u003ccode\u003ecloudservices\u003c/code\u003e and \u003ccode\u003evpcaccess\u003c/code\u003e service accounts, and if preferred, these roles can be granted on specific subnets only.\u003c/p\u003e\n"],["\u003cp\u003eA subnet, specifically a \u003ccode\u003e/28\u003c/code\u003e subnet, must be created by the Shared VPC Admin for each connector, ensuring it is located in the same region as the serverless services.\u003c/p\u003e\n"]]],[],null,["# Configure connectors in Shared VPC service projects\n\nIf your organization uses Shared VPC, you can set up\nServerless VPC Access connectors in either the service project or the\nhost project. This guide shows how to set up a connector in the service project.\n\nIf you need to set up a connector in the host project, see\n[Configure connectors in the host project](/appengine/docs/legacy/standard/python/shared-vpc-host-project).\nTo learn about the advantages of each method, see\n[Connecting to a Shared VPC network](/appengine/docs/legacy/standard/python/connecting-shared-vpc).\n\nAt a high level, you must take the following steps:\n\n1. [Add firewall rules to allow required IP ranges](#firewall-rules-shared-vpc)\n2. [Grant permissions](#grant-permissions)\n3. [Create a subnet](#subnet)\n4. In the page [Configuring Serverless VPC Access](/vpc/docs/configure-serverless-vpc-access), complete the steps in the following sections:\n - [Create a Serverless VPC Access connector](/vpc/docs/configure-serverless-vpc-access#create-connector)\n - [Configure your serverless environment to use a connector](/vpc/docs/configure-serverless-vpc-access#configure-environment)\n\n\u003cbr /\u003e\n\nBefore you begin\n----------------\n\n\u003cbr /\u003e\n\nServerless VPC Access is not compatible with the URL Fetch\nservice. Before you begin,\n[disable the URL Fetch default](/appengine/docs/legacy/standard/python/sockets#making_httplib_use_sockets)\nand discontinue any explicit use of the\n[`urlfetch`](/appengine/docs/legacy/standard/python/refdocs/google.appengine.api.urlfetch)\nlibrary.\n\nAdd firewall rules to allow IP ranges\n-------------------------------------\n\nTo perform these steps, you must have one of the following roles on the\nhost project:\n\n- Compute Engine [Security Admin](/compute/docs/access/iam#compute.securityAdmin) role\n- Custom [Identity and Access Management (IAM)](/iam) role with the [`compute.firewalls.create`](/compute/docs/reference/rest/v1/firewalls/insert#iam-permissions) permission enabled\n\nYou must create firewall rules to allow requests from the following IP ranges to\nreach the connector and to be reached by the connector:\n\n- NAT ranges\n - `107.178.230.64/26`\n - `35.199.224.0/19`\n- Health check ranges\n - `130.211.0.0/22`\n - `35.191.0.0/16`\n - `108.170.220.0/23`\n\nThese ranges are used by the Google infrastructure underlying Cloud Run,\nCloud Run functions, and the App Engine standard environment. All requests from these IPs are guaranteed\nto originate from Google infrastructure, which ensures that each\nCloud Run, Cloud Run functions, and App Engine service/function/app\nonly communicates with the VPC Connector it is connected to.\n\nFor a simple configuration, apply the rules to allow serverless services in any\nservice project connected to the Shared VPC network to send requests to\nany resource in the network.\n| **Important:** The rules you create using the following process apply to existing and future connectors. If you want to scope these rules so they only apply to specified connectors, see [Create firewall rules with narrower scope](#narrow-scope-rules).\n\nTo apply these rules:\n\n1. Run the following three commands to set the rules to allow requests from the\n serverless environment to reach all VPC Connectors in the network:\n\n ```bash\n gcloud compute firewall-rules create serverless-to-vpc-connector \\\n --allow tcp:667,udp:665-666,icmp \\\n --source-ranges 107.178.230.64/26,35.199.224.0/19 \\\n --direction=INGRESS \\\n --target-tags vpc-connector \\\n --network=VPC_NETWORK\n ``` \n\n ```bash\n gcloud compute firewall-rules create vpc-connector-to-serverless \\\n --allow tcp:667,udp:665-666,icmp \\\n --destination-ranges 107.178.230.64/26,35.199.224.0/19 \\\n --direction=EGRESS \\\n --target-tags vpc-connector \\\n --network=VPC_NETWORK\n ``` \n\n ```bash\n gcloud compute firewall-rules create vpc-connector-health-checks \\\n --allow tcp:667 \\\n --source-ranges 130.211.0.0/22,35.191.0.0/16,108.170.220.0/23 \\\n --direction=INGRESS \\\n --target-tags vpc-connector \\\n --network=VPC_NETWORK\n ```\n\n Where \u003cvar translate=\"no\"\u003eVPC_NETWORK\u003c/var\u003e is the VPC network to attach your\n connector to.\n2. Create an ingress rule on your VPC network to allow requests\n from connectors:\n\n ```bash\n gcloud compute firewall-rules create vpc-connector-requests \\\n --allow tcp,udp,icmp \\\n --direction=INGRESS \\\n --source-tags vpc-connector \\\n --network=VPC_NETWORK\n ```\n\n This rule gives the VPC connector access to every resource in the network. To\n limit the resources that your serverless environment can reach using\n Serverless VPC Access,\n [specify a target for these firewall rules](/vpc/docs/firewalls#rule_assignment).\n\n### Create firewall rules for specific connectors\n\nFollowing the procedure in\n[Add firewall rules to allow IP ranges](#firewall-rules-shared-vpc)\nresults in firewall rules that apply to *all* connectors, both current ones\nand ones created in the future. If you don't want this, but instead want to\ncreate rules for specific connectors only, you can scope the rules so that\nthey apply only to those connectors.\n\nTo limit the scope of the rules to specific connectors, you can use one of the\nfollowing mechanisms:\n\n- Network tags. Every connector has two network tags: `vpc-connector` and `vpc-connector-`\u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e`-`\u003cvar translate=\"no\"\u003eCONNECTOR_NAME\u003c/var\u003e. Use the latter format to limit the scope of your firewall rules to a specific connector.\n- IP ranges. Use this for the Egress rules only, because it doesn't work for Ingress. You can use the IP range of the connector subnet to limit the scope of your firewall rules to a single VPC connector.\n\nGrant permissions to service accounts in your service projects\n--------------------------------------------------------------\n\nFor each service project that will use VPC Connectors, a Shared VPC\nAdmin must grant the Compute Network User\nrole ([`compute.networkUser`](/compute/docs/access/iam#compute.networkUser)) in the\nhost project to the service project `cloudservices` and `vpcaccess` service\naccounts.\n\nTo grant the role:\n\n1. Use these commands:\n\n ```bash\n gcloud projects add-iam-policy-binding HOST_PROJECT_ID \\\n --role \"roles/compute.networkUser\" \\\n --member \"serviceAccount:service-\u003cvar translate=\"no\"\u003eSERVICE_PROJECT_NUMBER\u003c/var\u003e@gcp-sa-vpcaccess.iam.gserviceaccount.com\"\n ``` \n\n ```bash\n gcloud projects add-iam-policy-binding HOST_PROJECT_ID \\\n --role \"roles/compute.networkUser\" \\\n --member \"serviceAccount:\u003cvar translate=\"no\"\u003eSERVICE_PROJECT_NUMBER\u003c/var\u003e@cloudservices.gserviceaccount.com\"\n ```\n2. If the `@gcp-sa-vpcaccess` service account does not exist, turn on the\n Serverless VPC Access API in the service project and try again:\n\n ```bash\n gcloud services enable vpcaccess.googleapis.com\n ```\n\n \u003cbr /\u003e\n\nIf you prefer not to grant these service accounts access to the entire\nShared VPC network and would rather only grant access to specific subnets, you\ncan instead [grant these roles to these service accounts on specific subnets only](/vpc/docs/shared-vpc#svc_proj_admins).\n\nCreate a subnet\n---------------\n\nWhen using Shared VPC, the Shared VPC Admin must create a subnet\nfor each connector. Follow the documentation in\n[adding a subnet](/vpc/docs/create-modify-vpc-networks#add-subnets) to add a `/28` subnet to the\nShared VPC network. This subnet must be in the same region as the\nserverless services that will use the connector.\n\nNext steps\n----------\n\n- In the page [Configuring Serverless VPC Access](/vpc/docs/configure-serverless-vpc-access), complete the steps in the following sections:\n - [Create a Serverless VPC Access connector](/vpc/docs/configure-serverless-vpc-access#create-connector)\n - [Configure your serverless environment to use a connector](/vpc/docs/configure-serverless-vpc-access#configure-environment)"]]
