Connecting to a VPC network

Serverless VPC Access enables you to connect from your Cloud Functions directly to your VPC network, allowing access to Compute Engine VM instances, Memorystore instances, and any other resources with an internal IP address.

Serverless VPC Access supports communication to VPC networks connected via Cloud VPN and VPC Network Peering. Serverless VPC Access does not support legacy networks or Shared VPC.

Connecting to your VPC network

Connecting Cloud Functions to your VPC network involves three steps:

  1. Create a Serverless VPC Access connector
  2. Grant your Cloud Functions service account the appropriate permissions
  3. Configure your functions to use the connector

Creating a connector

A Serverless VPC Access connector handles communication to your VPC network. A connector must be in the same project and region as the functions that use it, but the connector can send traffic to resources in different regions. Multiple functions can use the same connector.

See Configuring Serverless VPC Access for step-by-step instructions on how to create a Serverless VPC Access connector.

Setting up permissions

Your project's Cloud Functions service account needs appropriate permissions in order for your function to use a Serverless VPC Access connector. You only need to grant these permissions once per project. To set up the permissions, follow these steps:

Console

  1. Go to the IAM page in the Google Cloud Console:

    Go to IAM

  2. Find the entry for the Cloud Functions Service Agent.

  3. Click the pencil icon to edit permissions.

  4. Click Add another role.

  5. Select Project > Viewer.

  6. Click Add another role.

  7. Select Compute Engine > Compute Network User.

  8. Click Save.

gcloud

  1. Find your project number by running the following command, replacing PROJECT_ID with your Cloud project ID:

    gcloud projects describe PROJECT_ID --format="value(projectNumber)"
    
  2. Grant the Cloud Functions Service Agent (service-PROJECT_NUM@gcf-admin-robot.iam.gserviceaccount.com) the viewer role:

    gcloud projects add-iam-policy-binding PROJECT_ID \
    --member=serviceAccount:service-PROJECT_NUM@gcf-admin-robot.iam.gserviceaccount.com \
    --role=roles/viewer
    

    where PROJECT_NUM is the project number obtained in step 1.

  3. Grant the Cloud Functions Service Agent the compute.networkUser role:

    gcloud projects add-iam-policy-binding PROJECT_ID \
    --member=serviceAccount:service-PROJECT_NUM@gcf-admin-robot.iam.gserviceaccount.com \
    --role=roles/compute.networkUser
    

Configuring a function to use a connector

After you have created a Serverless VPC Access connector and set up the proper permissions, you can configure your functions to use the connector.

Console

  1. Go to the Cloud Functions overview page in the Cloud Console:

    Go to Cloud Functions

  2. Click Create function.

  3. Fill in the required fields for your function.

  4. Expand the advanced settings by clicking Environment variables, networking, timeouts and more.

  5. In the VPC connector field, select or enter the name of your connector.

  6. Click Create.

gcloud

Use the gcloud functions deploy command to deploy the function and specify the --vpc-connector flag:

gcloud functions deploy FUNCTION_NAME \
--vpc-connector CONNECTOR_NAME \
FLAGS...

where:

  • FUNCTION_NAME is the name of your function.
  • CONNECTOR_NAME is the name of your connector.
  • FLAGS... refers to other flags you pass during function deployment.

After you deploy your function, it can send requests to internal IP addresses to access resources in your VPC network.

For more control over routing requests through the connector, see Egress settings.

Disconnecting a function from a connector

If your function no longer needs to connect to your VPC network, you can disconnect the Serverless VPC Access connector.

Console

  1. Go to the Cloud Functions overview page in the Cloud Console:

    Go to Cloud Functions

  2. Click the name of an existing function to go to its details page.

  3. Click Edit.

  4. Expand the advanced settings by clicking Environment variables, networking, timeouts and more.

  5. Clear the VPC connector field.

  6. Click Deploy.

gcloud

Use the gcloud functions deploy command to update your function, and specify the --clear-vpc-connector flag:

gcloud functions deploy FUNCTION_NAME --clear-vpc-connector

Next steps