在每个 Google Cloud 项目中，设置访问权限控制以确定哪些人员可以访问项目中的服务（包括 App Engine）。
您可以为不同的账号分配不同的角色，以确保每个账号仅具有支持您的应用所需的权限。如需了解详情，请参阅设置访问权限控制。
App Engine 防火墙
借助 App Engine 防火墙，您可以通过一组规则来允许或拒绝来自指定 IP 地址范围的请求，从而控制对 App Engine 应用的访问。您不需要为防火墙所屏蔽的流量或带宽付费。您可以按以下方式创建防火墙：
仅允许来自特定网络的流量
确保只有特定网络中的特定 IP 地址范围才能访问您的应用。例如，通过创建规则，您可在应用的测试阶段仅允许公司专用网络中的 IP 地址范围访问您的应用。然后，您可以创建和修改防火墙规则，以此控制整个发布流程的访问范围，使您的应用在公开发布之前仅可供公司内部或外部的特定组织进行访问。
仅允许来自特定服务的流量
确保发送到 App Engine 应用的所有流量都先通过特定服务进行代理。例如，如果您使用第三方 Web 应用防火墙 (WAF) 来代理定向到您的应用的请求，则可以创建防火墙规则，拒绝 WAF 转发的请求之外的所有请求。
屏蔽存在滥用行为的 IP 地址
虽然 Google Cloud 实施了许多机制来防止攻击，您仍然可以使用 App Engine 防火墙来阻止从存在恶意企图的 IP 地址发送到您的应用的流量，或者保护您的应用免遭拒绝服务攻击和类似形式的滥用。您可以将某些 IP 地址或子网添加到拒绝名单，这样，从这些地址和子网路由的请求会被拒绝，无法到达您的 App Engine 应用。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-21。"],[[["\u003cp\u003eThe \u003ccode\u003eREGION_ID\u003c/code\u003e is a Google-assigned code based on the region selected during app creation, and it is included in App Engine URLs for apps created after February 2020, but it does not necessarily align with country or province codes.\u003c/p\u003e\n"],["\u003cp\u003eGoogle Cloud's core security features can be supplemented by implementing measures such as using HTTPS requests, which can be applied to \u003ccode\u003eappspot.com\u003c/code\u003e domains and custom domains with managed SSL certificates.\u003c/p\u003e\n"],["\u003cp\u003eAccess control in Google Cloud projects allows for the management of who can access App Engine services through the assignment of specific roles and permissions.\u003c/p\u003e\n"],["\u003cp\u003eThe App Engine firewall allows administrators to define rules that either permit or block requests from specified IP ranges, offering the ability to control traffic from specific networks, services, or block abusive IPs.\u003c/p\u003e\n"],["\u003cp\u003eIngress and Egress controls can be used to restrict inbound traffic and specify how traffic is routed through Serverless VPC connectors respectively, giving administrators control over the flow of traffic to and from the App Engine app.\u003c/p\u003e\n"]]],[],null,["# Overview of app security\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\n### Region ID\n\nThe \u003cvar translate=\"no\"\u003eREGION_ID\u003c/var\u003e is an abbreviated code that Google assigns\nbased on the region you select when you create your app. The code does not\ncorrespond to a country or province, even though some region IDs may appear\nsimilar to commonly used country and province codes. For apps created after\nFebruary 2020, \u003cvar translate=\"no\"\u003eREGION_ID\u003c/var\u003e`.r` is included in\nApp Engine URLs. For existing apps created before this date, the\nregion ID is optional in the URL.\n\nLearn more\n[about region IDs](/appengine/docs/standard/python/how-requests-are-routed#region-id). \nOK\n\nSecurity is a core feature of the Google Cloud, but there are still steps you\nshould take to protect your App Engine app and identify vulnerabilities.\n\nUse the following features to ensure that your App Engine app is\nsecure. To learn more about the Google Security Model and the available steps\nthat you can take to secure your Google Cloud projects, see\n[Google Cloud Platform Security](/security).\n\nHTTPS requests\n--------------\n\nUse HTTPS requests to access to your App Engine app securely. Depending\non how your app is configured, you have the following options:\n\n`appspot.com` domains\n:\n - Use the `https` URL prefix to send HTTPS request to the `default` service of your Google Cloud project, for example: \n `https://`\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e`.`\u003cvar translate=\"no\"\u003e\u003ca href=\"#appengine-urls\" style=\"border-bottom: 1px dotted #999\" class=\"devsite-dialog-button\" data-modal-dialog-id=\"regional_url\" track-type=\"progressiveHelp\" track-name=\"modalHelp\" track-metadata-goal=\"regionalURL\"\u003eREGION_ID\u003c/a\u003e\u003c/var\u003e`.r.appspot.com`\n\n\n \u003c!-- --\u003e\n\n - To target specific resources in your App Engine app, use the\n `-dot-` syntax to separate each resource you want to target, for\n example: \n\n\n `https://`\u003cvar translate=\"no\"\u003eVERSION\u003c/var\u003e`-dot-`\u003cvar translate=\"no\"\u003eSERVICE\u003c/var\u003e`-dot-`\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e`.`\u003cvar translate=\"no\"\u003e\u003ca href=\"#appengine-urls\" style=\"border-bottom: 1px dotted #999\" class=\"devsite-dialog-button\" data-modal-dialog-id=\"regional_url\" track-type=\"progressiveHelp\" track-name=\"modalHelp\" track-metadata-goal=\"regionalURL\"\u003eREGION_ID\u003c/a\u003e\u003c/var\u003e`.r.appspot.com`\n\n - To convert an HTTP URL to an HTTPS URL, replace the periods\n between each resource with `-dot-`, for example: \n\n `http://`\u003cvar translate=\"no\"\u003eSERVICE_ID\u003c/var\u003e`.`\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e`.`\u003cvar translate=\"no\"\u003eREGION_ID\u003c/var\u003e`.r.appspot.com` \n\n\n `https://`\u003cvar translate=\"no\"\u003eSERVICE_ID\u003c/var\u003e`-dot-`\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e`.`\u003cvar translate=\"no\"\u003e\u003ca href=\"#appengine-urls\" style=\"border-bottom: 1px dotted #999\" class=\"devsite-dialog-button\" data-modal-dialog-id=\"regional_url\" track-type=\"progressiveHelp\" track-name=\"modalHelp\" track-metadata-goal=\"regionalURL\"\u003eREGION_ID\u003c/a\u003e\u003c/var\u003e`.r.appspot.com`\n\n\n For more information about HTTPS URLs and targeting resources, see\n [How Requests are\n Routed](/appengine/docs/standard/how-requests-are-routed).\n\nCustom domains\n\n: To send HTTPS requests with your custom domain, you can use the managed SSL\n certificates that are provisioned by App Engine. For more information,\n see [Securing Custom Domains with\n SSL](/appengine/docs/standard/securing-custom-domains-with-ssl).\n\n\nAccess control\n--------------\n\nIn each Google Cloud project, set up access control to determine\nwho can access the services within the project, including App Engine.\nYou can assign different roles to different accounts to ensure each account has\nonly the permissions it needs to support your app. For details see,\n[Setting Up Access\nControl](/appengine/docs/standard/access-control).\n\nApp Engine firewall\n-------------------\n\nThe [App Engine\nfirewall](/appengine/docs/standard/creating-firewalls)\nenables you to control access to your App Engine app through a set of\nrules that can either allow or deny requests from the specified ranges of IP\naddresses. You are not billed for traffic or bandwidth that is blocked by the\nfirewall. Create a firewall to:\n\nAllow only traffic from within a specific network\n: Ensure that only a certain range of IP addresses from specific networks can\n access your app. For example, create rules to allow only the range of IP\n addresses from within your company's private network during your app's testing\n phase. You can then create and modify your firewall rules to control the\n scope of access throughout your release process, allowing only certain\n organizations, either within your company or externally, to access your app\n as it makes its way to public availability.\n\nAllow only traffic from a specific service\n: Ensure that all the traffic to your App Engine app is first proxied\n through a specific service. For example, if you use a third-party Web\n Application Firewall (WAF) to proxy requests directed at your app, you can\n create firewall rules to deny all requests except those that are forwarded\n from your WAF.\n\nBlock abusive IP addresses\n: While Google Cloud has many mechanisms in place to prevent attacks, you can\n use the App Engine firewall to block traffic to your app from IP\n addresses that present malicious intent or shield your app from denial of\n service attacks and similar forms of abuse. You can add IP addresses or\n subnetworks to a denylist, so that requests routed from those addresses and\n subnetworks are\n denied before they reach your App Engine app.\n\nFor details about creating rules and configuring your firewall, see\n[Controlling App Access with\nFirewalls](/appengine/docs/standard/creating-firewalls).\n\nIngress controls\n----------------\n\nYou can use Ingress controls to restrict inbound traffic to your App Engine\napp. By default, your App Engine app accepts traffic from all network origins.\nTo modify the default settings, and edit and view the available settings, see\n[Specify ingress settings](/appengine/docs/standard/ingress-settings).\n\nEgress controls\n---------------\n\nEgress controls determine what traffic is sent over [Serverless VPC connectors](/appengine/docs/standard/connecting-shared-vpc).\nBy default, only requests to private IP addresses are routed through a\nServerless VPC connector. With Egress control settings, you\ncan require all traffic from your App Engine services to be routed through the attached VPC Connector.\nTo specify Egress settings for your app, see [Egress settings](/appengine/docs/standard/ingress-settings#egress).\n\n\nSecurity scanner\n----------------\n\nThe Google Cloud [Web Security Scanner](/security-command-center/docs/concepts-web-security-scanner-overview)\ndiscovers vulnerabilities by crawling your\nApp Engine app, following all that links within the scope of your\nstarting URLs, and attempting to exercise as many user inputs and event\nhandlers as possible.\n\nIn order to use the security scanner, you must be an owner of the\nGoogle Cloud project. For more information on assigning roles, see\n[Setting Up Access\nControl](/appengine/docs/standard/access-control).\n\nYou can run security scans from the Google Cloud console to identify security\nvulnerabilities in your App Engine app. For details about\nrunning the Security Scanner, see the\n[Using Web Security Scanner](/security-command-center/docs/how-to-use-web-security-scanner).\n\nVPC Service Controls\n--------------------\n\n[Not supported](/vpc-service-controls/docs/supported-products#appengine) in the App Engine standard environment."]]
