各 Google Cloud プロジェクトで、App Engine など、プロジェクト内のサービスにアクセスできるユーザーを決定するアクセス制御を設定します。アカウントごとに異なるロールを割り当てて、各アカウントにアプリをサポートするために必要な権限のみを付与できます。詳細については、アクセス制御の設定をご覧ください。
App Engine ファイアウォール
App Engine ファイアウォールでは、指定した範囲の IP アドレスからのリクエストを許可または拒否する一連のルールを使用して、App Engine アプリへのアクセスを制御できます。ファイアウォールでブロックされたトラフィックまたは帯域幅に対しては課金されません。ファイアウォールを作成すると、次のことを行うことができます。
特定のネットワーク内のトラフィックのみを許可する
特定のネットワークの特定の IP アドレス範囲にのみアプリへのアクセスを許可します。たとえば、アプリのテスト段階で、会社のプライベート ネットワーク内の IP アドレス範囲のみを許可するルールを作成します。その後アプリのリリース プロセスが一般公開に向けて進む過程でファイアウォール ルールを随時作成、変更し、社内または外部の特定の組織にのみアプリへのアクセスを許可できます。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-09-04 UTC。"],[[["\u003cp\u003eThe \u003ccode\u003eREGION_ID\u003c/code\u003e is a Google-assigned code based on the region selected during app creation, and it is included in App Engine URLs for apps created after February 2020, but it does not necessarily align with country or province codes.\u003c/p\u003e\n"],["\u003cp\u003eGoogle Cloud's core security features can be supplemented by implementing measures such as using HTTPS requests, which can be applied to \u003ccode\u003eappspot.com\u003c/code\u003e domains and custom domains with managed SSL certificates.\u003c/p\u003e\n"],["\u003cp\u003eAccess control in Google Cloud projects allows for the management of who can access App Engine services through the assignment of specific roles and permissions.\u003c/p\u003e\n"],["\u003cp\u003eThe App Engine firewall allows administrators to define rules that either permit or block requests from specified IP ranges, offering the ability to control traffic from specific networks, services, or block abusive IPs.\u003c/p\u003e\n"],["\u003cp\u003eIngress and Egress controls can be used to restrict inbound traffic and specify how traffic is routed through Serverless VPC connectors respectively, giving administrators control over the flow of traffic to and from the App Engine app.\u003c/p\u003e\n"]]],[],null,["# Overview of app security\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\n### Region ID\n\nThe \u003cvar translate=\"no\"\u003eREGION_ID\u003c/var\u003e is an abbreviated code that Google assigns\nbased on the region you select when you create your app. The code does not\ncorrespond to a country or province, even though some region IDs may appear\nsimilar to commonly used country and province codes. For apps created after\nFebruary 2020, \u003cvar translate=\"no\"\u003eREGION_ID\u003c/var\u003e`.r` is included in\nApp Engine URLs. For existing apps created before this date, the\nregion ID is optional in the URL.\n\nLearn more\n[about region IDs](/appengine/docs/standard/python/how-requests-are-routed#region-id). \nOK\n\nSecurity is a core feature of the Google Cloud, but there are still steps you\nshould take to protect your App Engine app and identify vulnerabilities.\n\nUse the following features to ensure that your App Engine app is\nsecure. To learn more about the Google Security Model and the available steps\nthat you can take to secure your Google Cloud projects, see\n[Google Cloud Platform Security](/security).\n\nHTTPS requests\n--------------\n\nUse HTTPS requests to access to your App Engine app securely. Depending\non how your app is configured, you have the following options:\n\n`appspot.com` domains\n:\n - Use the `https` URL prefix to send HTTPS request to the `default` service of your Google Cloud project, for example: \n `https://`\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e`.`\u003cvar translate=\"no\"\u003e\u003ca href=\"#appengine-urls\" style=\"border-bottom: 1px dotted #999\" class=\"devsite-dialog-button\" data-modal-dialog-id=\"regional_url\" track-type=\"progressiveHelp\" track-name=\"modalHelp\" track-metadata-goal=\"regionalURL\"\u003eREGION_ID\u003c/a\u003e\u003c/var\u003e`.r.appspot.com`\n\n\n \u003c!-- --\u003e\n\n - To target specific resources in your App Engine app, use the\n `-dot-` syntax to separate each resource you want to target, for\n example: \n\n\n `https://`\u003cvar translate=\"no\"\u003eVERSION\u003c/var\u003e`-dot-`\u003cvar translate=\"no\"\u003eSERVICE\u003c/var\u003e`-dot-`\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e`.`\u003cvar translate=\"no\"\u003e\u003ca href=\"#appengine-urls\" style=\"border-bottom: 1px dotted #999\" class=\"devsite-dialog-button\" data-modal-dialog-id=\"regional_url\" track-type=\"progressiveHelp\" track-name=\"modalHelp\" track-metadata-goal=\"regionalURL\"\u003eREGION_ID\u003c/a\u003e\u003c/var\u003e`.r.appspot.com`\n\n - To convert an HTTP URL to an HTTPS URL, replace the periods\n between each resource with `-dot-`, for example: \n\n `http://`\u003cvar translate=\"no\"\u003eSERVICE_ID\u003c/var\u003e`.`\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e`.`\u003cvar translate=\"no\"\u003eREGION_ID\u003c/var\u003e`.r.appspot.com` \n\n\n `https://`\u003cvar translate=\"no\"\u003eSERVICE_ID\u003c/var\u003e`-dot-`\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e`.`\u003cvar translate=\"no\"\u003e\u003ca href=\"#appengine-urls\" style=\"border-bottom: 1px dotted #999\" class=\"devsite-dialog-button\" data-modal-dialog-id=\"regional_url\" track-type=\"progressiveHelp\" track-name=\"modalHelp\" track-metadata-goal=\"regionalURL\"\u003eREGION_ID\u003c/a\u003e\u003c/var\u003e`.r.appspot.com`\n\n\n For more information about HTTPS URLs and targeting resources, see\n [How Requests are\n Routed](/appengine/docs/standard/how-requests-are-routed).\n\nCustom domains\n\n: To send HTTPS requests with your custom domain, you can use the managed SSL\n certificates that are provisioned by App Engine. For more information,\n see [Securing Custom Domains with\n SSL](/appengine/docs/standard/securing-custom-domains-with-ssl).\n\n\nAccess control\n--------------\n\nIn each Google Cloud project, set up access control to determine\nwho can access the services within the project, including App Engine.\nYou can assign different roles to different accounts to ensure each account has\nonly the permissions it needs to support your app. For details see,\n[Setting Up Access\nControl](/appengine/docs/standard/access-control).\n\nApp Engine firewall\n-------------------\n\nThe [App Engine\nfirewall](/appengine/docs/standard/creating-firewalls)\nenables you to control access to your App Engine app through a set of\nrules that can either allow or deny requests from the specified ranges of IP\naddresses. You are not billed for traffic or bandwidth that is blocked by the\nfirewall. Create a firewall to:\n\nAllow only traffic from within a specific network\n: Ensure that only a certain range of IP addresses from specific networks can\n access your app. For example, create rules to allow only the range of IP\n addresses from within your company's private network during your app's testing\n phase. You can then create and modify your firewall rules to control the\n scope of access throughout your release process, allowing only certain\n organizations, either within your company or externally, to access your app\n as it makes its way to public availability.\n\nAllow only traffic from a specific service\n: Ensure that all the traffic to your App Engine app is first proxied\n through a specific service. For example, if you use a third-party Web\n Application Firewall (WAF) to proxy requests directed at your app, you can\n create firewall rules to deny all requests except those that are forwarded\n from your WAF.\n\nBlock abusive IP addresses\n: While Google Cloud has many mechanisms in place to prevent attacks, you can\n use the App Engine firewall to block traffic to your app from IP\n addresses that present malicious intent or shield your app from denial of\n service attacks and similar forms of abuse. You can add IP addresses or\n subnetworks to a denylist, so that requests routed from those addresses and\n subnetworks are\n denied before they reach your App Engine app.\n\nFor details about creating rules and configuring your firewall, see\n[Controlling App Access with\nFirewalls](/appengine/docs/standard/creating-firewalls).\n\nIngress controls\n----------------\n\nYou can use Ingress controls to restrict inbound traffic to your App Engine\napp. By default, your App Engine app accepts traffic from all network origins.\nTo modify the default settings, and edit and view the available settings, see\n[Specify ingress settings](/appengine/docs/standard/ingress-settings).\n\nEgress controls\n---------------\n\nEgress controls determine what traffic is sent over [Serverless VPC connectors](/appengine/docs/standard/connecting-shared-vpc).\nBy default, only requests to private IP addresses are routed through a\nServerless VPC connector. With Egress control settings, you\ncan require all traffic from your App Engine services to be routed through the attached VPC Connector.\nTo specify Egress settings for your app, see [Egress settings](/appengine/docs/standard/ingress-settings#egress).\n\n\nSecurity scanner\n----------------\n\nThe Google Cloud [Web Security Scanner](/security-command-center/docs/concepts-web-security-scanner-overview)\ndiscovers vulnerabilities by crawling your\nApp Engine app, following all that links within the scope of your\nstarting URLs, and attempting to exercise as many user inputs and event\nhandlers as possible.\n\nIn order to use the security scanner, you must be an owner of the\nGoogle Cloud project. For more information on assigning roles, see\n[Setting Up Access\nControl](/appengine/docs/standard/access-control).\n\nYou can run security scans from the Google Cloud console to identify security\nvulnerabilities in your App Engine app. For details about\nrunning the Security Scanner, see the\n[Using Web Security Scanner](/security-command-center/docs/how-to-use-web-security-scanner).\n\nVPC Service Controls\n--------------------\n\n[Not supported](/vpc-service-controls/docs/supported-products#appengine) in the App Engine standard environment."]]
