title: How to restrict public access to google app engine flexible environment?
body: <p>I have many microservices in app engine only for internal use. But, by default, app engine opens <code>service-project.appspot.com</code> domain to public, and anyone can access them via <code>http</code> or <code>https</code>.
  Is there a way to restrict access only for certain IP address? </p>
  
  <p>The trivial way i can think of is checking source IP address in application code.
  Or, I can create custom docker image with nginx configuration which checks source ip address. But, these are not quite clean solutions because access control is actually independent from application, and I don't want to hard code static IP address inside the container.</p>
  
  <p>I assumed there is a way to setup firewall rule for app engine, but I could not find it. Identity-Aware Proxy seems like another option, but it is not available for app engine flex.</p>