My GCP app has been abused by some users. To stop their usage I have attempted to eliminate features that can be abused, and have employed firewall rules to block certain users. But bad users continue to try to access my app via certain legacy URLs such as myapp.appspot.com/badroute. Of course, I still want users to use the default URL myapp.appspot.com .

I have altered my code in the following manner, but I am still getting Instances to start from them, and I do not want Instances in such cases. What can I do differently to avoid the bad Instances starting OR is there anything I can do to force such Instances to stop quickly instead of after about 15 minutes?

class Dummy(webapp2.RequestHandler): 

  def get(self):
        logging.info("Dummy:  " )
        self.redirect("/")

app = webapp2.WSGIApplication(
                                     [('/', MainPage),
                                      ('/badroute', Dummy)],debug=True)

(I may be referring to Instances when I should be referring to Requests.)

CodePudding user response：

So whats the objective? you want users that visit /badroute to be redirected to some /goodroute ? or you want /badroute to not hit GAE and incur cost?

Putting a google cloud load balancer in front could help.

For the first case you could setup a redirect rule (although you can do this directly within App Engine too, like you did in your code example).

If you just want it to not hit app engine you could setup google cloud load balancer to have the /badroute route to some file in a GCS bucket instead of your GAE service

https://cloud.google.com/load-balancing/docs/https/ext-load-balancer-backend-buckets

However you wouldnt be able to use your *.appsot.com base url. You'd get a static IP which you should then map a custom domain to it

CodePudding user response：

DISCLAIMER: I'm not 100% sure if this would work.

Create a new service dummy.
Create and deploy a dispatch.yaml (GAE Standard // GAE Flex)
Add the links you want to block to the dispatch.yaml and point them to the dummy service.
Set up the Identity Aware Proxy (IAP) and enable it for the dummy service.
???
Profit

The idea is that the IAP will block the requests before they hit the dummy service. Since the requests never actually get forwarded to the service dummy you will not have an instance start. The bots will get a nice 403 page from Google's own infrastructure instead.

EDIT: Be sure to create the dummy service with 0 instances as the idea is to not have it cost money.

EDIT2:

So let me expand a bit on this answer.

You can have multiple GAE services running within one GCP project. Each service is it's own app. You can have one service running a python Flask app and another running a Java Springboot app. You can have each be either GAE Standard or GAE Flex. See this doc.

Normally all traffic gets routed to the default service. Using dispatch.yaml you can make request to certain endpoints go to a specific service.

If you create the dummy service as a GAE Standard app, and you don't actually need it to do anything, you can then route all the endpoints that get abused to this dummy service using the dispatch.yaml. Using GAE Standard you can have the service use 0 instances (and 0 costs).

Using the IAP you can then make sure only your own Google account can access this app (which you won't do). In effect this means that the abusers cannot really access the service, as the IAP blocks it before hitting the service, as you've set it up so only your Google account can access it.

Note, the dispatch.yaml is separate from any services, it's one of the per-project configuration files for GAE. It's not tied to a specific service.

As stated, the dummy app doesn't actually need to do anything, but you need to deploy it once though, as this basically creates the service.

CodePudding user response：

Consider using cloudflare to mitigate bot abuse, customize firewall rules regarding route access, rate limit ips, etc. This can be combined with Google cloud load balancer, if you’d like—as mentioned in https://stackoverflow.com/a/69165767/806876.

References

Cloudflare GCP integration: https://www.cloudflare.com/integrations/google-cloud/