Google cloud functions not accessible from app engine (with ingress controls)

1
votes

I have an API that I host through Google Cloud. The main entry point for the API is an App Engine instance (standard), which then needs to be able to call various cloud functions to execute its tasks.

To make the cloud functions secure, I want to set the ingress controls to "Allow internal only".

I've deployed the cloud functions and the App Engine in the same region (us-central1), but every time the App Engine instance tries to call a cloud function, it gets a 403 error. I've tried setting up a VPC connector for the App Engine, but that isn't helping.

Here's the app.yaml file:

service: my-test-app

runtime: nodejs10

env_variables:
    STAGE: "dev"

instance_class: F1

vpc_access_connector:
    name: "projects/my-test-project/locations/us-central1/connectors/test-vpc-connector"

The key cloud function configuration is the Ingress Setting. I have it set to Allow internal traffic only. If I set it to Allow all traffic, everything works (just highly insecure!)

Any suggestions on what I might be missing?

1
google-app-enginegoogle-cloud-functionsserverless
Please edit the question with complete details on how you've deployed and configured the function, and how you are invoking it from GAE. We should be able to reproduce your situation exactly based on the information you provide. – Doug Stevenson
Updated @DougStevenson! – AlexKogan
And how are you calling the function from GAE? – Doug Stevenson

1 Answers

1
votes

I found the solution! If I set the App Engine to a flex environment, everything works. It looks like the standard environment was the issue.