A Guide to Configuring Google App Engine and Cloud CDN

I have summarized how to use GCP's App Engine (GAE) with Cloud CDN, as I couldn't find many explanations even after searching online.

These steps are as of 2021/03/19. For the latest information, please check the documentation.

Benefits of Using GAE and Cloud CDN Together

GAE has edge caching enabled by default. You can cache responses on Google's edge servers simply by specifying something like Cache-Control: public, max-age=86400 in the response headers.
Unfortunately, there is very little official documentation available regarding this edge cache.

If GAE's Edge Cache is available, isn't Cloud CDN unnecessary?

GAE's edge cache is easy and convenient to use, but it has the drawback that you cannot explicitly purge the cache. Even after deploying a new version of your app, the old cache might continue to be displayed for a while, making it slightly inconvenient for production use.

Using Cloud CDN provides the following benefits:

• Cache can be purged. Operations can be performed not only from the console but also via the gcloud command, allowing for automation.
• Supports stale-while-revalidate. (I tested this with GAE's edge cache, but it was not supported as of March 2021.)
• Possible to use the same domain across multiple services (e.g., settings can be configured to route example.com/storage/* to Cloud Storage, example.com/api/* to Cloud Functions, and everything else to GAE).
• Can reduce latency that occurs when using custom domains with GAE in the Tokyo region (Details).

Additionally, based on my personal verification, GAE's edge cache is not applied when accessing a GAE instance through Cloud CDN, so there is no need to worry about double caching.

Configuration Steps for GAE + Cloud CDN

Follow the instructions in the documentation to configure the settings. The steps are introduced below, but please check this documentation for the latest information.

https://cloud.google.com/cdn/docs/setting-up-cdn-with-serverless

The steps are almost identical if you use Cloud Run or Cloud Functions instead of GAE.

General Flow

This explanation assumes that your application has already been deployed to GAE.

1. Reserve an external IP address
2. Create an SSL certificate resource
3. Create a load balancer
4. Update the DNS records for the domain

Cloud CDN must be used in conjunction with a load balancer, which results in many configuration items.

1. Reserve an External IP Address

First, reserve an external IP address. You will later link your custom domain to this IP address. Open External IP addresses in the GCP Console and configure it as follows.

Set the region to "Global". For more details on each item, please check the documentation.

2. Create an SSL Certificate Resource

Configure the SSL certificate settings. In this guide, we will create a Google-managed certificate, which Google automatically renews.

Open the Certificates page in the GCP Console and click Create SSL Certificate.

After selecting a Google-managed certificate, enter the domain you want to link to the CDN.

The documentation for this part is here.

3. Create a Load Balancer

This is the part with the most settings in these steps. Open Load balancing in the GCP Console and select HTTP(S) Load Balancing.

I thought about including screenshots for each step, but since there are many items and the display is highly likely to change in the future, please follow the documentation to configure the settings.

There are two key points.

The first is to select the GAE application you want to link with Cloud CDN in Create a backend service => Serverless network endpoint group.

The second is to select the IP address you created earlier in the Frontend configuration for the IP address item, and select the certificate you created earlier for the Certificate item.

4. Update the DNS Records for the Domain

Finally, add the DNS records for the domain. If you have obtained a custom domain through Google Domains, accessing

https://domains.google.com/registrar/domain/dns

will open the DNS settings (apologies if this has changed).

After confirming that the name servers are set to Use Google Domains name servers, add an A record. Enter the IP address you created earlier into the IPv4 address field.

For more details, please check the documentation.

---

This completes the minimum necessary steps. If the settings are correct, you should be able to access the GAE application from your custom domain after waiting for a while.