Exclude cloud run from outer internet

Question

I have backend and google endpoints service (both on cloud run). Endpoints service provides information from backend for authorized users. I want to make backend not accessible from outer internet. There are possibility to allow only inner connections by setting Ingress -> Allow internal traffic only. If I do that my endpoints service can't reach backend. All endpoints and backend connected to the same VPC. How can I exclude backend from outer internet? how I want it be

Answer 1

You have 2 solutions:

1. Continue to expose your backend service to the internet but make it secures (IAM protected service, deployed with --noallow-unauthenticated option). However, grant only the service account of your endpoint service to reach the backend. Like that all the unauthenticated and the unauthorized traffic will be filtered by GFE (Google Front End) and discarded automatically. Only allowed traffic will reach the backend. That solution has the advantage to allow you to also test the backend in case of issue for example, with the correct permissions.
2. The second solution is exactly what you want:

• Set the backend ingress to internal only
• Create a serverless VPC connector, add it to the endpoint service with the egress control to ALL.

Like that, all the traffic of the endpoint will be routed through the VPC connector, land in your VPC and then, internally access your backend. Why egress=all?? Because, even if you set your backend ingress to internal, the Cloud Run URL is still public (but an additional check is done to be sure that the traffic comes from your VPC, it's named authenticated network traffic)

At the end, it's always authentication based (on network source or on service account identity). The serverless VPC connection costs about $17 per month