如何使用无服务器 vpc 连接器启用 Cloud Run 以仅将流量限制到特定 VPC 资源

Question

I am trying to set up Cloud Run (nodeJs app, code is below) to privately connect to Memory store instance. I've followed this Google Article to create a Serverless VPC Access Connector. Making sure I created the connector in the same region as Cloud Run app, and that the connector is attached to the Redis instance's authorized VPC.network.

Memorystore is isolated in a VPC with a private range address.

Nodejs app code is shown below.

const {createClient} = require('redis');
 
    getClient() {
        const client = createClient({
            socket: {
                host: process.env.REDIS_HOST
            },
            password: process.env.REDIS_PASS
        });
        client.on('error', (err) => {
            throw Error(`redis client error: ${err}`);
        });
        return client;
    }

Google doc states that a firewall rule is created to allow ingress from the connector's su.net to all destinations in the VPC.network. This is against my company's security policy as we have other services in this VPC (VM's, GKE instances etc). So I need to restrict connector to be able to reach all destinations in VPC.network. Is there a preferred way of achieving this?

Answer 1

Earlier in 2021, Google Cloud made it possible for CloudRun serverless vpc connector to use the allow and target-tags flags to create an ingress firewall rule. It allows targeting the traffic only to a specific resource with in VPC.

Google doc states that a firewall rule is created to allow ingress from the connector's su.net to all destinations in the VPC.network. This is against my company's security policy as we have other services in this VPC (VM's, GKE instances etc). So I need to restrict connector to be able to reach all destinations in VPC.network. Is there a preferred way of achieving this?

Create a firewall rule and set the priority for this rule to be a lower value than the one you created in the previous step.

gcloud compute firewall-rules create RULE_NAME \
--allow=PROTOCOL \
--source-tags=VPC_CONNECTOR_NETWORK_TAG \
--direction=INGRESS \
--network=VPC_NETWORK \
--target-tags=RESOURCE_TAG \
--priority=PRIORITY

Hope it resolves your issue.