How can I safely configure AppEngine sockets w/ Google Compute Engine

Question

I'd like to put a Redis server on Google Compute Engine and speak to it via AppEngine's socket support. The only problem is that there doesn't seem to be a specific firewall rule that says "this AppEngine application can access this host/port and no other".

There are some rules at instance setup time that describe whether the instance has access to task queues, etc, but not the inverse.

So my question is: how can I restrict port access to a Redis service only to a single AppEngine application?

Answer 1

In short you can not. AppEngine is a shared IP space with all the other apps, just like shared hosting. You need to use application level authentication such as OAuth to get the proper restrictions in place.