Putting "staging" instance behind VPN - Google Cloud + Firebase

Question

I have a web app with a React frontend on Firebase that connects to a Django backend running on Google App Engine.

I have this setup duplicated for a "staging" environment. The problem is that anyone can access this staging environment.

I'd like to set this up so that you need to be on our VPN to access it.

Can someone point me in the right direction to setup this VPN and move the staging environment behind it?

Answer 1

If you are using Firebase Hosting I believe there's no other way to restrict the access and it does not have a firewall feature. You should use authentication method to restrict and limit who can access your web app.

In App Engine, you can restrict the access of your web server/application by using the following:

1. App Engine Firewall - @JohnHanley answer, control which using IP addresses can connect to the app.

2. Identity Aware Proxy - without using VPN you can limit who can access of your App Engine by using their user account. IAP is free but when used with Compute Engine, the required load balancing and firewall configuration may incur additional costs.

3. App Engine with Load Balancer - to secure and make your App Engine(Standard & Flexible) receives only internal and Cloud Load Balancing traffic