I would like to know how to access control with GAE - google-app-engine

Question

Is there a way to automatically control access to a specific IP with Google App Engine?
For example, if an API endpoint is accessed 10 times in one minute, it will not accept requests for that IP address.
I understand that GKE and GCE can do the same with Google Load Balancing and GOOGLE CLOUD ARMOR. I want to do this with Google App Engine.

Answer 1

Cloud Endpoints with App Engine is a solution.
You can set up ESP to authenticate clients Choosing an Authentication Method.
Then you can limit the api request by adding a quota to your OpenAPI document Configuring quotas.
This is an example from official documentation:
The following example shows how to configure the x-google-quota
extension in the
paths section:
x-google-management:
metrics:
# Define a metric for read requests.
- name: "read-requests"
displayName: "Read requests"
valueType: INT64
metricKind: DELTA quota:
limits:
# Define the limit or the read-requests metric.
- name: "read-limit"
metric: "read-requests"
unit: "1/min/{project}"
values:
STANDARD: 1000 paths: "/echo":
post:
description: "Echo back a given message."
operationId: "echo"
produces:
- "application/json"
responses:
200:
description: "Echo"
schema:
$ref: "#/definitions/echoMessage"
parameters:
- description: "Message to echo"
in: body
name: message
required: true
schema:
$ref: "#/definitions/echoMessage"
x-google-quota:
metricCosts:
"read-requests": 1
security:
- api_key: []
You can find more about OpenAPI extensions
You can use some more advanced techniques Proof of Work to enforce rate limiting without needing to remember IP addresses SO case.

Answer 2

I did not try it myself but it looks like there is an API to do it.
https://cloud.google.com/appengine/docs/admin-api/reference/rest/v1/apps.firewall.ingressRules
To programmatically create firewall rules for your App Engine app, you
can use the apps.firewall.ingressRules methods in the Admin API.

Answer 3

You can use Cloud Endpoints with App Engine. You can develop, deploy, and manage APIs on any Google Cloud back end with the help of Cloud Endpoints.
Cloud Endpoints provides quotas, which let you control the rate at
which applications can call your API. Setting a quota allows you to
specify usage limits to protect your API from an excessive number of
requests from calling applications. The excessive requests might have
been caused by a simple typo or from an inefficiently designed system
that makes needless calls to your API. Regardless of the cause,
blocking traffic from a specific source once it reaches a certain
level is necessary for the overall health of your API. By setting a
quota, you ensure that one application cannot negatively impact other
applications that use your API.
You can also check Rate limiting on Apigee Edge