If you are creating a new function, see the Console Quickstart on Cloud Run.

Configure Direct VPC egress for 2nd gen functions

Direct VPC egress lets you route traffic from your Cloud Run functions (2nd gen) function directly to your VPC network.

Limitations

Direct VPC egress is not available for 1st gen functions.
You can't use Direct VPC egress and Serverless VPC Access connectors at the same time. See Compare Direct VPC egress and VPC connectors for details.
To learn about general limitations of using Direct VPC, see Direct VPC with a VPC network.

Before you begin

Enable the Cloud Functions API.
Install the Google Cloud CLI, then initialize it by running gcloud init.
Update gcloud components to version 558.0.0 or later:
```
gcloud components update
```
If you don't already have a VPC network in your project, create one.
Optional: If your function needs to access Google APIs and services using their internal IP addresses, enable Private Google Access on the subnet that you use for Direct VPC egress.

Set up IAM permissions

To authorize Direct VPC egress, ask your administrator to grant the Cloud Run Invoker (roles/run.invoker) role to your function's service account.

Ensure that Cloud Run has access to the VPC network by using one of the following methods:

Cloud Run Service Agent role: By default, the Cloud Run service agent has the Cloud Run Service Agent role (roles/run.serviceAgent) that contains the necessary permissions.
Custom permissions: For more granular control, grant the Cloud Run service agent with the following additional permissions on the project:
- compute.networks.get
- compute.subnetworks.get
- compute.subnetworks.use on the project or the specific subnet
- compute.addresses.get
- compute.addresses.list
- compute.addresses.create (required only for dual-stack subnets with external IPv6)
- compute.addresses.delete (required only for dual-stack subnets with external IPv6)
- compute.addresses.createInternal
- compute.addresses.deleteInternal
- compute.regionOperations.get
Compute Network User role: If you don't use the default Cloud Run Service Agent role or the custom permissions, grant the Compute Network User role (roles/compute.networkUser) on the Cloud Run Service Agent service account. Subnets with external IPv6 also require the Compute Public IP Admin role (roles/compute.publicIpAdmin).

For example, to grant the Compute Network User role, run the following command:
```
gcloud projects add-iam-policy-binding PROJECT_ID \
--member "serviceAccount:service-PROJECT_NUMBER@serverless-robot-prod.iam.gserviceaccount.com" \
--role "roles/compute.networkUser"
```
Replace the following:
- PROJECT_ID: the ID of your project.
- PROJECT_NUMBER: the project number where you deploy your Cloud Run function.

Configure Direct VPC egress

Configure Direct VPC egress for new or existing 2nd gen functions.

gcloud

To configure Direct VPC egress when you deploy a function, use the gcloud functions deploy command with flags for your network settings.
```
gcloud functions deploy FUNCTION_NAME \
    --source . \
    --runtime RUNTIME \
    --trigger-http \
    --region REGION \
    --network=NETWORK \
    --subnet=SUBNET \
    --network-tags=NETWORK_TAG_NAMES \
    --direct-vpc-egress=EGRESS_SETTING
```
Replace the following:
- FUNCTION_NAME: the name of your function.
- RUNTIME: the runtime for your function, for example, nodejs20.
- REGION: the region where you deploy your function.
- Optional: NETWORK with the name of your VPC network. Specify either a VPC network or a subnet, or both. If you specify only a network, the subnet uses the same name as the network.
- Optional: SUBNET with the name of your subnet. Specify either a VPC network or a subnet, or both. If you specify only a network, the subnet uses the same name as the network. You can deploy or execute multiple functions on the same subnet.
- Optional: NETWORK_TAG_NAMES with the comma-separated names of the network tags you want to associate with a function. Each function can have different network tags, such as network-tag-2.
- EGRESS_SETTING with an egress setting value:
  - all: Default. Sends all outbound traffic through the VPC network.
  - private-ranges-only: Sends only traffic to internal addresses through the VPC network.
Optional: To remove all Direct VPC egress settings from a function, redeploy the function with the --clear-network and --clear-network-tags flags.

Terraform

To learn how to apply or remove a Terraform configuration, see Basic Terraform commands.

This feature (support for using Direct VPC egress with 2nd gen Cloud Run functions) adds the fields direct_vpc_network_interface.network and direct_vpc_egress.

To use this feature, follow these guidelines:

You must use Terraform version 7.21.0 or later.
If you redeploy a function that has existing Direct VPC, you now must explicitly set the values in the configuration.

Using the Cloud Run functions (2nd gen) Direct VPC egress example as a starting point, update the following fields:

service_config.direct_vpc_network_interface.network: the name of your VPC network.
service_config.direct_vpc_network_interface.subnetwork: the name of your VPC subnetwork.
service_config.direct_vpc_egress: which traffic to send to the VPC network. VPC_EGRESS_ALL_TRAFFIC sends all outbound traffic through the VPC network. VPC_EGRESS_PRIVATE_RANGES_ONLY only sends traffic to private IP address ranges to the VPC network.

Example: Call an internal service from a function

This example shows how to create an internal Cloud Run service and then call it from a Cloud Run functions (2nd gen) function that uses Direct VPC egress.

Create the internal backend service

Create a new directory for the backend service and change into it:
```
mkdir backend-service
cd backend-service
```

Create a package.json file with the following content:

{
    "name": "backend-service",
    "version": "1.0.0",
    "description": "",
    "scripts": {
        "start": "node index.js"
    },
    "dependencies": {
        "express": "^4.18.1"
    }
}

Create an index.js file with the following content:

const express = require('express');
const app = express();

app.get('/', (req,