Restricting Google API Keys to be accessed by my Google App Engine application

user_13757329 0
Viewed 111

I have an application hosted on Google App Engine. My app uses the Google Geocoding API.

I would like to restrict the API to be accessed only by my application. According to Google's documentation since this is a webservice API it can only be restricted by IP address and not by referer.

Looking for a way to restrict by IP I came across this - I cannot have a static IP address for my application, and GAE uses many IP address ranges that are subject to change.

Am I missing a simple way of doing this? Ideally I would like my API key to be used only from my application, but if that's not possible I'd like to at least restrict it to GAE applications only.

google-api google-app-engine
1 Answers

You are correct, GAE's IP ranges are subject to change, you will need to continuously monitor the IP blocks and add new ones to the allowed subnets for the API Key IP restriction. Although GAE's IP blocks don't change that often they do happen.

The workaround that I can think of is using a Compute Engine VM to work as a proxy with a simple service in charge of receiving the geolocations API, calling the API and sending back the result to GAE. You can then restrict the API Key to the VM's Static IP. However, with this approach you will have to consider how much traffic you will be requesting from GAE to the VM/Geolocation API so you can decide which VM type to use (one f1-micro is within free tier).

Lastly, if you resolve GAE not having a Static block of IP's is a disadvantage for your need (Geolocation API), you can then consider migrating to a different GCP service, eg. Compute Engine VM's with Load Balancer and Instance groups.

user_36855130
Related