Note: Python 2.7 will reach the end of support on January 31, 2024. After this date, your existing Python 2.7 applications will continue to run and receive traffic. However, you cannot deploy new or update existing applications that use runtimes after their end of support date. We recommend that you migrate to the latest supported version of Python.

App Engine connectivity questions

This page contains answers to common App Engine connectivity questions, including questions related to using Serverless VPC Access and internal IP addresses.

Set up inbound connectivity from VPC to App Engine instances using an internal IP address

This scenario can be encountered when you want to connect to an App Engine instance using an internal (private) IP address. Serverless VPC Access is useful for making calls from Google's serverless offerings into the Virtual Private Cloud (VPC) network; however, it does not provide a way to access App Engine instances on internal IP addresses.

In this scenario, you can use one of the following options:

Set up Private Google Access, which allows VPC resources without external (or public) IP addresses to access the public IP addresses of the App Engine service.
Use Private Service Connect for Google APIs, which allows VPC resources to call App Engine using an internal IP address.

Connect App Engine to Cloud SQL private IP addresses

This scenario may be encountered when you want to connect from App Engine standard environment or App Engine flexible environment apps to Cloud SQL instances over private IP addresses.

In this scenario, create a connection using one of the following options:

App Engine standard environment: Use the Serverless VPC Access connector to connect to Cloud SQL over internal IP addresses. To learn more, see Connecting from App Engine standard environment to Cloud SQL.
App Engine flexible environment: Deploy your flexible environment app in the same VPC network as your Cloud SQL instance. Your app should now be able to connect directly using Cloud SQL instance's private IP address. To learn more, see Connecting from App Engine flexible environment to Cloud SQL.

Troubleshoot a Cloud SQL instance using public IP addresses

When deploying an older App Engine standard environment app with Cloud SQL using Unix sockets, you might see a few error messages if your app is not correctly configured to connect to a Cloud SQL instance.

The following warning message indicates that App Engine was able to fall back on a legacy connection method to complete the operation successfully:

CloudSQL warning: your action is needed to update your application and avoid potential disruptions. Please see https://cloud.google.com/sql/docs/mysql/connect-app-engine-standard for additional details: ...

The following error message indicates that the operation to connect to Cloud SQL was not completed successfully:

Cloud SQL connection failed. Please see https://cloud.google.com/sql/docs/mysql/connect-app-engine-standard for additional details: ...

For both error messages, you need to check the following to ensure that the Cloud SQL Auth proxy is correctly configured to connect to a Cloud SQL instance:

The Cloud SQL Admin API must be enabled.
The service account for the App Engine app must have the correct permissions.
The instance connection name must include the region.

If the failure message persists after troubleshooting, contact Google Cloud Support for assistance.

Customize access permissions between App Engine services

This scenario can be encountered when you have multiple App Engine services and want to configure access permissions differently between services (for example, you want to enable access to App Engine Service A only from App Engine Service B).

In this scenario, you can use App Engine with Identity-Aware Proxy (IAP) to make only some of the services publicly accessible while keeping others protected. To learn more, you can see the Centralize access to your organization's websites with IAP video and refer to the IAP documentation.