Configure an internet NAT gateway for SAE applications - Serverless App Engine

SAE application instances do not have public IP addresses and cannot directly access the internet. Create an internet NAT gateway in the VPC of your SAE application to enable outbound internet access for all instances.

When SAE applications use an internet NAT gateway, the gateway translates the source IP addresses of all application instances into a single, static public IP address. This is ideal for most use cases, such as adding the static public IP address to a database whitelist when accessing a public database service. Even if you have configured a Service or Ingress to allow inbound internet access to your SAE application, you still need an internet NAT gateway for outbound internet access from your application instances.

For special scenarios where each SAE application instance requires a unique public IP address to connect to other public services, use an alternative solution: Bind an Elastic IP Address (EIP) to each SAE application instance. Note that this public IP address is dynamic, as instances can be created or destroyed at any time.

Procedure

Step 1: Create an internet NAT gateway

If no internet NAT gateway exists in the VPC where your SAE application is deployed, follow these steps to create one.

If a gateway already exists, skip this step and configure it directly. We recommend creating only one internet NAT gateway per VPC to avoid potential route conflicts.

How to find the VPC of your SAE application

An SAE application belongs to a namespace. The namespace is associated with a VPC, and all SAE application instances are deployed in that VPC. To view this information:

In the SAE application list, select the target region and namespace at the top, and then click the target Application ID to go to the application details page.
In the navigation pane on the left, click Basic Information, and then click the Application Information tab.
In the Application Information section, you can view the VPC where the application is located. Click the VPC ID to go to the VPC details page.

How to check if an internet NAT gateway exists in the VPC

On the VPC details page, click the Resource Management tab.
In the Access to Internet section, view the number of Internet NAT Gateway instances in the current VPC.
Click the instance count to go to the Internet NAT Gateway list.

Log on to the NAT Gateway console.
In the top navigation bar, select the region where you want to create the NAT gateway.
On the Internet NAT Gateway page, click Create NAT Gateway.
When you create an Internet NAT gateway for the first time, click Create in the Notes on Creating Service-linked Roles section of the buy page to create a service-linked role. After the service-linked role is created, you can create Internet NAT gateways.
For more information, see Service-linked roles.
Configure the following parameters, and then click Buy Now and Activate Now. For billing details, see NAT Gateway billing.
1. Region: Select the region where your SAE application is deployed.
2. Network and Zone: Select the VPC of your SAE application, the availability zone where you want to deploy the internet NAT gateway instance, and either an existing vSwitch or a new one.
3. Network Type: Select Internet NAT Gateway.
4. Elastic IP Address (EIP): Select Purchase EIP and configure the Maximum Bandwidth, or select an Select EIP EIP. The created internet NAT gateway instance is automatically bound to this Elastic IP Address (EIP) instance.
On the Internet NAT Gateway page, you can view the created internet NAT gateway instance and the bound Elastic IP Address (EIP).

Step 2: Configure an SNAT entry

On the Internet NAT Gateway page, find the NAT gateway that you want to manage and click Configure SNAT in the Actions column.
On the SNAT tab, click Create SNAT Entry.
Configure the following parameters and click OK.
1. SNAT Entry: We recommend selecting Select vSwitch and then all vSwitches where the SAE application instances are deployed.
  How to find the vSwitches of your SAE application instances
  When creating an SAE application, you select one or more vSwitches where the instances are deployed. To find the vSwitches:
  
  In the SAE application list, select the target region and namespace at the top, and then click the target Application ID to go to the application details page.
  
  In the navigation pane on the left, click Basic Information, and then click the Application Information tab.
  
  In the Application Information section, you can view one or more vSwitches where the application is located. Click a vSwitch ID to go to the vSwitch details page.
2. Select EIP: Select the public IP address of the EIP bound to your internet NAT gateway.
In the SNAT Entry List, you can view the created SNAT entry, including its source CIDR block and the translated public IP address.