Stay organized with collections
Save and categorize content based on your preferences.
Region ID
The REGION_ID is an abbreviated code that Google assigns
based on the region you select when you create your app. The code does not
correspond to a country or province, even though some region IDs may appear
similar to commonly used country and province codes. For apps created after
February 2020, REGION_ID.r is included in
App Engine URLs. For existing apps created before this date, the
region ID is optional in the URL.
This section describes how to use ingress settings to restrict network access to
your App Engine app. At a network level, by default, any resource on
the internet is able to reach your App Engine app on its
appspot URL
or at a custom domain
set up in App Engine. For example, the appspot.com URL can have the
following format:
SERVICE_ID.PROJECT_ID.REGION_ID.r.appspot.com.
You can change this default setting by specifying a
different setting for ingress. All ingress paths, including the default
appspot.com URL, are subject to your ingress setting. Ingress is set at the
service level.
Available ingress settings
The following settings are available:
Setting
Description
Internal
Most restrictive. Allows requests from resources attached to the
project's VPC networks, such as:
VMs in the same project, including Compute Engine VMs.
Requests from these sources stay within the Google network, even
if they access your service at the appspot.com URL.
Requests from other sources, including the internet, cannot reach your
service at the appspot.com URL or custom domains. There
is no support for multi-tenancy, that is, multiple trust domains
within the same project.
Internal and Cloud Load Balancing
Allows requests from the following resources:
Resources allowed by the more restrictive Internal setting
External Application Load Balancer
Use the Internal and Cloud Load Balancing setting to accept requests
from an external Application Load Balancer but not directly from the internet. Requests to
the appspot.com URL bypass the external Application Load Balancer, so this
setting prevents external requests from reaching the
appspot.com URL.
All
Least restrictive. Allows all requests, including requests directly from
the internet to the appspot.com URL.
Accessing internal services
The following considerations apply:
For requests from a Shared VPC, traffic is only considered internal if the
App Engine app is deployed in the Shared VPC host project. If the
App Engine app is deployed in a Shared VPC service project, only traffic
from networks owned by the app's own project is internal. All other traffic,
including traffic from other Shared VPCs, is external.
When accessing internal services, call them as you would normally do by using
their public URLs, either the default appspot.com URL or a
custom domain set up in App Engine.
For requests from Compute Engine VM instances or other resources running
inside a
VPC network
in the same project, no further setup is required.
Requests from resources within VPC networks in the same project are classified
as internal even if the resource they originate from has a public IP address.
Requests from on-premises resources connected to the VPC network via
Cloud VPN are considered internal.
Locate the Ingress column. For each service, the value in this column
shows the ingress setting as one of All (default),
Internal + Load Balancing, or Internal.
gcloud
To view the ingress setting for a service using the gcloud CLI:
gcloudappservicesdescribeSERVICE
Replace SERVICE with the name of your service.
For example, to view the ingress settings and other information for the
default service run:
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-29 UTC."],[[["\u003cp\u003e\u003ccode\u003eREGION_ID\u003c/code\u003e is a Google-assigned code based on the selected region when creating an app, included in App Engine URLs for apps created after February 2020.\u003c/p\u003e\n"],["\u003cp\u003eApp Engine apps are, by default, accessible from any internet resource via their appspot URL or a custom domain, but this can be changed through ingress settings.\u003c/p\u003e\n"],["\u003cp\u003eThere are three ingress settings: \u003ccode\u003eInternal\u003c/code\u003e (most restrictive, allowing requests only from project's VPC), \u003ccode\u003eInternal and Cloud Load Balancing\u003c/code\u003e (allows \u003ccode\u003eInternal\u003c/code\u003e traffic and requests from an external Application Load Balancer), and \u003ccode\u003eAll\u003c/code\u003e (least restrictive, allows all traffic).\u003c/p\u003e\n"],["\u003cp\u003eIngress settings are set at the service level, and they can be viewed and modified either through the App Engine Services page in the Google Cloud console or using the gcloud CLI.\u003c/p\u003e\n"],["\u003cp\u003eRequests from resources within VPC networks in the same project are considered internal, regardless of the presence of a public IP address, and requests from on-premises resources connected via Cloud VPN are also considered internal.\u003c/p\u003e\n"]]],[],null,["# Ingress settings\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n### Region ID\n\nThe \u003cvar translate=\"no\"\u003eREGION_ID\u003c/var\u003e is an abbreviated code that Google assigns\nbased on the region you select when you create your app. The code does not\ncorrespond to a country or province, even though some region IDs may appear\nsimilar to commonly used country and province codes. For apps created after\nFebruary 2020, \u003cvar translate=\"no\"\u003eREGION_ID\u003c/var\u003e`.r` is included in\nApp Engine URLs. For existing apps created before this date, the\nregion ID is optional in the URL.\n\nLearn more\n[about region IDs](/appengine/docs/flexible/python/how-requests-are-routed#region-id). \nOK\n\nThis section describes how to use ingress settings to restrict network access to\nyour App Engine app. At a network level, by default, any resource on\nthe internet is able to reach your App Engine app on its\n[appspot URL](/appengine/docs/flexible/how-requests-are-routed)\nor at a [custom domain](/appengine/docs/flexible/mapping-custom-domains)\nset up in App Engine. For example, the `appspot.com` URL can have the\nfollowing format:\n\u003cvar translate=\"no\"\u003eSERVICE_ID\u003c/var\u003e`.`\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e`.`\u003cvar translate=\"no\"\u003eREGION_ID\u003c/var\u003e`.r.appspot.com`.\n\nYou can change this default setting by specifying a\ndifferent setting for ingress. All ingress paths, including the default\n`appspot.com` URL, are subject to your ingress setting. Ingress is set at the\nservice level.\n\nAvailable ingress settings\n--------------------------\n\nThe following settings are available:\n\n### Accessing internal services\n\nThe following considerations apply:\n\n- For requests from a Shared VPC, traffic is only considered internal if the\n App Engine app is deployed in the Shared VPC host project. If the\n App Engine app is deployed in a Shared VPC service project, only traffic\n from networks owned by the app's own project is internal. All other traffic,\n including traffic from other Shared VPCs, is external.\n\n- When accessing internal services, call them as you would normally do by using\n their public URLs, either the default `appspot.com` URL or a\n [custom domain](/run/docs/mapping-custom-domains) set up in App Engine.\n\n- For requests from Compute Engine VM instances or other resources running\n inside a\n\n [VPC network](/appengine/docs/flexible/using-shared-vpc)\n in the same project, no further setup is required.\n\n- Requests from resources within VPC networks in the same project are classified\n as internal even if the resource they originate from has a public IP address.\n\n- Requests from on-premises resources connected to the VPC network via\n Cloud VPN are considered `internal`.\n\n### View ingress settings\n\n### Console\n\n1. Go to the App Engine Services page.\n\n [Go to the Services page](https://console.cloud.google.com/appengine/services)\n2. Locate the **Ingress** column. For each service, the value in this column\n shows the ingress setting as one of **All** (default),\n **Internal + Load Balancing** , or **Internal**.\n\n### gcloud\n\nTo view the ingress setting for a service using the gcloud CLI: \n\n```bash\ngcloud app services describe SERVICE\n```\n\nReplace \u003cvar translate=\"no\"\u003eSERVICE\u003c/var\u003e with the name of your service.\n\nFor example, to view the ingress settings and other information for the\ndefault service run: \n\n```bash\ngcloud app services describe default\n```\n\n\u003cbr /\u003e\n\n### Edit ingress settings\n\n### Console\n\n1. Go to the App Engine Services page.\n\n [Go to the Services page](https://console.cloud.google.com/appengine/services)\n2. Select the service you wish to edit.\n\n3. Click **Edit ingress setting**.\n\n4. Select the ingress setting that you want from the menu and click\n **Save**.\n\n### gcloud\n\nTo update the ingress setting for a service using the gcloud CLI: \n\n```bash\ngcloud app services update SERVICE --ingress=INGRESS\n```\n\nReplace:\n\n- \u003cvar translate=\"no\"\u003eSERVICE\u003c/var\u003e: The name of your service.\n- \u003cvar translate=\"no\"\u003eINGRESS\u003c/var\u003e: The ingress control you want to apply. One of `all`, `internal-only`, or `internal-and-cloud-load-balancing`.\n\nFor example:\n\n- To update the default service of an App Engine app to accept traffic\n only from Cloud Load Balancing and VPC networks that are in the same\n project:\n\n ```bash\n gcloud app services update default --ingress=internal-and-cloud-load-balancing\n ```\n- To update a service named \"internal-requests\" to accept traffic only from VPC\n networks that are in the same project:\n\n ```bash\n gcloud app services update internal-requests --ingress=internal-only\n ```\n\n\u003cbr /\u003e"]]
