Configuring Serverless VPC Access

は、

Serverless VPC Access enables you to connect from the App Engine standard environment and Cloud Functions directly to your VPC network. This connection makes it possible for your App Engine standard environment apps and Cloud Functions to access resources in your VPC network via internal (private) IP addresses. Using internal IP addresses improves the latency of communication between your Google Cloud Platform services and avoids exposing internal resources to the public internet.

Serverless VPC Access only allows your app or function to send requests to resources in your VPC network and receive responses to those requests. Communication in the opposite direction, where a VM initiates a request to an app or function, requires you to use the public address of the app or function—see Private Google Access for more information.

Serverless VPC Access supports communication to VPC networks connected via Cloud VPN and VPC Network Peering. Serverless VPC Access does not support legacy networks or Shared VPC networks.

Serverless VPC Access connectors

Serverless VPC Access is based on a resource called a connector. A connector handles traffic between your app or function on App Engine or Cloud Functions and your VPC network. When you create a connector in your GCP project, you attach it to a specific VPC network and region. You can then configure your app or function to use the connector for internal network traffic.

When you create a connector, you also assign it an IP range to use for the source addresses for traffic sent through the connector. This IP range must be a CIDR /28 range that is not already reserved in your VPC network.

Serverless VPC Access automatically provisions throughput for a connector in 100 Mbps increments depending on the amount of traffic sent through the connector. A connector always has at least 200 Mbps provisioned and cannot exceed a throughput of 1000 Mbps. You can configure minimum and maximum throughput limits when you create a connector.

Serverless VPC Access example (click to enlarge)
Serverless VPC Access example (click to enlarge)

Note that:

  • A connector must be located in the same project and region as the app or function that connects to it.
  • Traffic to internal IP addresses is routed through the connector, while traffic to public IP addresses is routed through the internet.
  • You can use the same connector with multiple apps or functions if they are in the same region.
  • For resources that allow cross-region access, a connector can be in a different region than the resource it is sending traffic to. You are billed for egress from the connector—see pricing.

  • Serverless VPC Access connectors incur a monthly charge. See pricing.

Creating a connector

To create a connector, use the GCP Console or the gcloud command-line tool:

Console

  1. Go to the Serverless VPC Access overview page.

    Go to Serverless VPC Access

  2. Click Create connector.

  3. In the Name field, enter a name for your connector.

  4. In the Region field, select a region in which to locate your connector. This must match the region of your app or function.

  5. In the Network field, select the VPC network to attach your connector to.

  6. In the IP range field, enter an unreserved CIDR /28 IP range. Addresses in this range are used as source addresses for traffic sent through the connector. This IP range must not overlap with any existing IP address reservations in your VPC network.

  7. (Optional) For additional control over your connector's throughput, edit the Minimum throughput and Maximum throughput fields.

  8. Click Create.

A green check mark will appear next to the connector's name when it is ready to use.

gcloud

  1. Ensure the Serverless VPC Access API is enabled for your project:

    gcloud services enable vpcaccess.googleapis.com
    
  2. Create a connector with the command:

    gcloud beta compute networks vpc-access connectors create [CONNECTOR_NAME] \
    --network [VPC_NETWORK] \
    --region [REGION] \
    --range [IP_RANGE]
    

    Where:

    • [CONNECTOR_NAME] is a name for your connector.
    • [VPC_NETWORK] is the VPC network to attach your connector to.
    • [REGION] is the region in which to locate your connector. This must match the region of your app or function.
    • [IP_RANGE] is an unreserved CIDR /28 IP range. Addresses in this range are used as source addresses for traffic sent through the connector. This IP range must not overlap with any existing IP address reservations in your VPC network.

    For more details and optional arguments, see the gcloud reference.

  3. Verify that your connector is in the READY state before using it:

    gcloud beta compute networks vpc-access connectors describe [CONNECTOR_NAME] --region [REGION]
    

    The output should contain the line state: READY.

If creating a connector results in an error, try the following and re-create your connector:

  • Specify an IP range that does not overlap with any existing IP address reservations in the VPC network.
  • Grant your project permission to use Compute Engine VM images from the project with ID serverless-vpc-access-images. See Setting image access constraints for information on how to update your organization policy accordingly.

Deleting a connector

Before you delete a connector, ensure that no services are still using it. See the documentation for App Engine or Cloud Functions for information on disconnecting a connector.

Console

  1. Go to the Serverless VPC Access overview page.

    Go to Serverless VPC Access

  2. Select the connector you want to delete.

  3. Click Delete.

gcloud

Use the following gcloud command to delete a connector:

gcloud beta compute networks vpc-access connectors delete [CONNECTOR_NAME] --region [REGION]

Where:

  • [CONNECTOR_NAME] is the name of the connector you want to delete.
  • [REGION] is the region where the connector is located.

Configuring your service to use a connector

Once you've created a connector, you can configure your app or function on App Engine or Cloud Functions to use it. Remember that a connector must be located in the same region as the app or function that connects to it. If you have multiple apps or functions in the same region, you can use the same connector—for example, an app and a function in the same region can share a connector if they need to communicate with the same VPC network.

How you configure a service to use a connector depends on the product. For detailed instructions, see the relevant product's documentation:

Supported services

The following services support connecting to a Serverless VPC Access connector:

Curated IAM roles

The following table describes the Cloud Identity and Access Management (Cloud IAM) roles associated with Serverless VPC Access and lists the permissions that are contained in each role.

Role Description Permissions
Serverless VPC Access Admin
roles/vpcaccess.admin
Full access to all Serverless VPC Access resources vpcaccess.connectors.get
vpcaccess.connectors.list
vpcaccess.connectors.use
vpcaccess.connectors.create
vpcaccess.connectors.delete
vpcaccess.operations.get
vpcaccess.operations.list
vpcaccess.locations.list
Serverless VPC Access User
roles/vpcaccess.user
User of Serverless VPC Access connectors vpcaccess.connectors.get
vpcaccess.connectors.list
vpcaccess.connectors.use
vpcaccess.operations.get
vpcaccess.operations.list
vpcaccess.locations.list
Serverless VPC Access Viewer
roles/vpcaccess.viewer
Viewer of all Serverless VPC Access resources vpcaccess.connectors.get
vpcaccess.connectors.list
vpcaccess.operations.get
vpcaccess.operations.list
vpcaccess.locations.list

Audit logging

See Serverless VPC Access audit logging information.

Pricing

Serverless VPC Access is priced as follows. Pricing is subject to change (and might increase) while Serverless VPC Access is in beta or at General Availability.

Resource Price
Serverless VPC Access connector Charged as 1 f1-micro instance per 100 Mbps of throughput automatically provisioned for the connector
Network egress from app/function to destination Charged at Compute Engine networking rates
このページは役立ちましたか?評価をお願いいたします。