Google App EngineAuthorCloudBrum editorial teamLast reviewed30 Oct 2026Reading time~12 minLevelBeginner to advanced

• Deploy with one commandDescribe the runtime, the entry point and the scaling in app.yaml, run gcloud app deploy, and App Engine builds, uploads and starts the app. There are no servers or load balancers to create.
• A sandboxed standard environmentThe standard environment runs your code on supported runtimes such as Python, Java, Go, Node.js, PHP and Ruby in a sandbox. Instances start in seconds, and an idle app can drop to zero instances.
• Flexible when you need DockerThe flexible environment runs your container on Compute Engine virtual machines, so any language or library works. In return it’s slower to start and deploy, and it always keeps at least one instance.
• Services and versionsOne app is split into services, such as a web front end and an API, and every deployment creates a version. Several versions can run at once.
• Traffic splittingSend a share of requests to a new version by IP address, cookie or at random, watch it, and shift the rest, or roll back by moving the split.
• Scaling you describeAutomatic scaling adds and removes instances based on CPU, throughput and latency targets you set. Basic and manual scaling give you fixed or request-driven instances for long-running work.
• Access controlsA firewall in front of the app allows or blocks IP ranges, Identity-Aware Proxy puts sign-in in front of it, and a service account decides what the code may do in Google Cloud.
• Friendly with other Google servicesCloud Tasks queues background work, Cloud Scheduler runs cron jobs, Firestore stores data and Cloud Logging and Error Reporting collect what the app emits.

App Engine application

The one App Engine app in a project. It’s created once, in a region you can’t change, and holds all the services.

Service

A part of the app with its own code and configuration, for example default and api. Services scale and deploy independently.

Version

One deployed snapshot of a service. A service can have many versions, and traffic is split between them.

Instance

One running copy of a version. App Engine starts and stops instances as load changes.

Standard environment

The sandboxed environment for supported runtimes, with fast start-up, scale to zero and a free daily allowance.

Flexible environment

The environment that runs a Docker container on Compute Engine VMs, with any runtime and a minimum of one instance.

app.yaml

The file that names the runtime, the entry point, the instance class, scaling settings, environment variables and handlers for a service.

Instance class

The size of a standard instance, such as F2 for automatic scaling or B2 for basic scaling, which sets memory and CPU.

Automatic scaling

Scaling that follows targets for CPU, throughput and latency, with limits on minimum, idle and maximum instances.

Traffic splitting

A setting that divides requests among versions by IP address, cookie or randomly, used for canary releases and A/B tests.

dispatch.yaml

A routing file that sends requests to services by URL pattern.

Cloud Tasks and Cloud Scheduler

The services that replaced the older task queue and cron.yaml features, for background work and scheduled calls.

Serverless VPC Access

A connector that lets an app reach resources in your VPC network, such as a private database.

Identity-Aware Proxy

A Google service that requires sign-in and an IAM role before a request reaches your app.

Deploy an app with gcloud

1. Choose the project and the regionUse a project with billing. The App Engine region is fixed for the life of the project, so choose one near your users and data, such as asia-south1 (Mumbai).
2. Create the app and the service accountRun gcloud app create with the region. Make a service account for the app with only the roles it needs, and use it instead of the default one.
3. Write app.yamlName the runtime, the entry point (for example gunicorn for Python), the instance class, the scaling limits, environment variables and HTTPS-only handlers.
4. Connect it to your network if neededIf the app talks to private resources, create a Serverless VPC Access connector and name it in app.yaml, with an egress setting that sends only private ranges through it.
5. Deploy without promotingDeploy with --no-promote and a clear version name. The new version runs, but traffic stays on the old one.
6. Test and split the trafficOpen the version’s own URL, then send a small share of requests to it with set-traffic. Watch errors and latency before moving the rest.
7. Add schedules and a firewallCreate Cloud Scheduler jobs that call your handlers, and set firewall rules so that only the sources you expect can reach the app.
8. Protect the front doorTurn on Identity-Aware Proxy for internal apps, or put a load balancer with Cloud Armor in front of public ones.
9. Keep the version list tidyDelete old versions that no longer receive traffic. They cost nothing while stopped, but the list and the version limit grow.

• Pick the instance class from measurements: a bigger class gives more CPU and memory per instance, and handles more concurrent requests.
• Set min_idle_instances to a small number for user-facing services, so a quiet period doesn’t mean a cold start for the next visitor.
• Tune target_cpu_utilization and max_concurrent_requests by load testing. Lower targets scale earlier at higher cost.
• Keep start-up work light: lazy initialisation, small dependency sets and warmup handlers.
• Serve static files through App Engine’s static handlers or Cloud CDN and keep instances for dynamic work.
• Keep the app and its data in the same region, and use connection pooling for databases.
• Move slow and background work to Cloud Tasks, which has retries and rate limits, instead of making users wait.
• Check latency percentiles in Cloud Monitoring and Trace after each deployment, not just averages.

FinOps is the habit of managing cloud spend together with engineering. These are the FinOps checks that matter most for Google App Engine.

• Know your meter: instance hours by class on the standard environment, and vCPU, memory and disk on flexible.
• Use the free daily allowance of standard instance hours for small apps and test services. Sources disagree on the exact hours, so read Google’s page.
• Let services scale to zero where a cold start is acceptable, and keep idle instances only where users would notice.
• Set max_instances so a spike or a bug can’t scale the bill without limit.
• Choose the smallest instance class that handles your concurrency, and raise concurrency where the code allows.
• Prefer standard over flexible where the runtime fits, since flexible always bills for at least one instance.
• Stop or delete old versions and unused services, and remember that flexible versions bill while running.
• Watch data egress, Firestore operations and logging, which can grow faster than instance hours.
• Use committed use discounts where they apply to flexible’s underlying resources.
• Label the project by team, export billing to BigQuery and set budget alerts.

• Run the app as a dedicated service account with minimal roles, never the default one.
• Use IAP for internal apps, so a Google sign-in and an IAM role are needed to reach them.
• Set firewall rules that allow only expected source ranges, and put a load balancer with Cloud Armor in front of public apps.
• Serve everything over HTTPS with secure: always handlers, and use Google-managed certificates for custom domains.
• Keep secrets in Secret Manager and read them at start-up, and keep them out of app.yaml and Git.
• Use a Serverless VPC Access connector or Direct VPC egress with firewall rules for private resources, and send only private ranges through it.
• Validate input and authentication inside the app as well, since the platform can’t know your business rules.
• Turn on Cloud Audit Logs and alert on IAM changes for the project and on unusual error rates.
• Control who can deploy and delete versions with IAM roles such as App Engine Deployer, and keep App Engine Admin for few people.
• Scan dependencies in your pipeline, and upgrade runtimes before they reach end of support.

Cloud Audit Logs record who deployed, changed or deleted versions and services, organisation policy limits where and how projects may be created, Security Command Center reports findings, and the Compliance resource center holds Google’s certificates. Google runs the platform, the instances and the scaling, while you own the code, the service account, the firewall and IAP settings, the region choice and the runtime upgrades.

• Scale to zero for apps that are idle much of the day.
• Right-size the instance class and raise concurrency where the code allows.
• Prefer the standard environment, which uses no always-on virtual machine.
• Delete unused versions, services and test projects.
• Choose a region with a high carbon-free energy share when data rules allow. Google publishes the percentage for each region, and the App Engine region can’t be changed later.
• Cache and compress responses, so fewer requests reach instances.
• Cloud Carbon Footprint in the console estimates emissions per project and service. Check what it shows for App Engine before you quote a figure.

Purchase options

What you actually pay for

• Instance hours of the standard environment, minus the daily free allowance
• vCPU, memory and disk of flexible instances while they run
• Data stored and operations in Firestore or Datastore
• Network egress, logging and monitoring
• Load balancers, Cloud Armor, VPC connectors and any other service in front of or behind the app

The orders-api app in the App Engine standard environment: a dedicated service account, automatic scaling with one idle instance, HTTPS-only handlers, a VPC connector for private traffic, a firewall and a nightly Cloud Scheduler job. The gcloud tab deploys a new version without traffic and splits 10% of requests to it. Terraform builds the app and a version. The Python tab deletes old versions that get no traffic, and the C# tab lists versions with their traffic share. Replace the project, bucket and connector with your own. The region can’t be changed once the app exists, so check it before you run the first command.

# Placeholders: replace the project, bucket and connector range with your own.
PROJECT=my-orders-project
REGION=asia-south1
BUCKET=orders-receipts-example
SA=orders-api@$PROJECT.iam.gserviceaccount.com

gcloud config set project $PROJECT
gcloud services enable appengine.googleapis.com cloudbuild.googleapis.com vpcaccess.googleapis.com cloudscheduler.googleapis.com

# One narrow service account for the app. The region you pick here is permanent for the project.
gcloud iam service-accounts create orders-api --display-name="orders-api"
gcloud storage buckets add-iam-policy-binding gs://$BUCKET --member="serviceAccount:$SA" --role=roles/storage.objectCreator
gcloud app create --region=$REGION --service-account=$SA

# A connector so the app can reach private addresses in the VPC.
gcloud compute networks vpc-access connectors create orders-conn --region=$REGION --network=orders-net --range=10.8.0.0/28

cat > app.yaml <<EOF
runtime: python313
entrypoint: gunicorn -b :\$PORT -w 2 main:app
instance_class: F2
service_account: $SA
env_variables:
  RECEIPT_BUCKET: "$BUCKET"
automatic_scaling:
  min_idle_instances: 1
  max_instances: 10
  target_cpu_utilization: 0.65
  max_concurrent_requests: 40
vpc_access_connector:
  name: projects/$PROJECT/locations/$REGION/connectors/orders-conn
  egress_setting: private-ranges-only
handlers:
  - url: /.*
    script: auto
    secure: always
EOF

# Deploy the new version without sending it any traffic, then send it 10 percent of requests.
gcloud app deploy app.yaml --version=v150 --no-promote --quiet
gcloud app services set-traffic default --splits=v142=0.9,v150=0.1 --split-by=random --quiet
gcloud app versions list --service=default --sort-by=~version.createTime --limit=5

# Only the office may reach the app. The default rule is the last one that is checked.
gcloud app firewall-rules create 100 --action=allow --source-range=203.0.113.0/24 --description="office"
gcloud app firewall-rules update default --action=deny

# A nightly call to /tasks/reconcile.
gcloud scheduler jobs create app-engine orders-nightly --location=$REGION --schedule="30 20 * * *" --time-zone="UTC" \
  --service=default --relative-url=/tasks/reconcile --http-method=POST

# Placeholders: pass in your project and the object in Cloud Storage that holds the zipped app.
variable "project_id" {
  type = string
}

variable "location_id" {
  type    = string
  default = "asia-south1"
}

variable "source_bucket" {
  type = string
}

variable "source_object" {
  type    = string
  default = "orders-api-1.5.0.zip"
}

variable "receipt_bucket" {
  type    = string
  default = "orders-receipts-example"
}

resource "google_service_account" "orders_api" {
  account_id   = "orders-api"
  display_name = "orders-api"
}

resource "google_storage_bucket_iam_member" "receipts" {
  bucket = var.receipt_bucket
  role   = "roles/storage.objectCreator"
  member = "serviceAccount:${google_service_account.orders_api.email}"
}

# The App Engine app: one per project, and the location cannot be changed after this.
resource "google_app_engine_application" "app" {
  project     = var.project_id
  location_id = var.location_id
}

resource "google_app_engine_standard_app_version" "v150" {
  version_id = "v150"
  service    = "default"
  runtime    = "python313"

  entrypoint {
    shell = "gunicorn -b :$PORT -w 2 main:app"
  }

  deployment {
    zip {
      source_url = "https://storage.googleapis.com/${var.source_bucket}/${var.source_object}"
    }
  }

  instance_class  = "F2"
  service_account = google_service_account.orders_api.email

  env_variables = {
    RECEIPT_BUCKET = var.receipt_bucket
  }

  automatic_scaling {
    max_concurrent_requests = 40
    min_idle_instances      = 1

    standard_scheduler_settings {
      target_cpu_utilization = 0.65
      max_instances          = 10
    }
  }

  handlers {
    url_regex      = "/.*"
    security_level = "SECURE_ALWAYS"

    script {
      script_path = "auto"
    }
  }

  # keep the version after a destroy of this resource, and don't stop the service with it
  noop_on_destroy           = true
  delete_service_on_destroy = false

  depends_on = [google_app_engine_application.app]
}

# 90 percent of requests stay on the old version, 10 percent go to the new one.
resource "google_app_engine_service_split_traffic" "default" {
  service         = "default"
  migrate_traffic = false

  split {
    shard_by = "RANDOM"
    allocations = {
      "v142" = 0.9
      "v150" = 0.1
    }
  }

  depends_on = [google_app_engine_standard_app_version.v150]
}

resource "google_app_engine_firewall_rule" "office" {
  project      = var.project_id
  priority     = 100
  action       = "ALLOW"
  source_range = "203.0.113.0/24"
  description  = "office"

  depends_on = [google_app_engine_application.app]
}

# Deletes old versions of a service that receive no traffic, keeping the newest few for a quick rollback.
# pip install google-cloud-appengine-admin   (uses Application Default Credentials)
import sys

from google.cloud import appengine_admin_v1


def old_versions(project, service="default", keep=3):
    services = appengine_admin_v1.ServicesClient()
    versions = appengine_admin_v1.VersionsClient()

    split = services.get_service(name="apps/%s/services/%s" % (project, service)).split
    serving = {v for v, share in split.allocations.items() if share > 0}

    parent = "apps/%s/services/%s" % (project, service)
    every = sorted(versions.list_versions(parent=parent), key=lambda v: v.create_time, reverse=True)
    newest = {v.id for v in every[:keep]}
    return [v for v in every if v.id not in serving and v.id not in newest]


if __name__ == "__main__":
    project = sys.argv[1]
    dry_run = "--delete" not in sys.argv
    versions = appengine_admin_v1.VersionsClient()
    for v in old_versions(project):
        print(("would delete" if dry_run else "deleting"), v.name)
        if not dry_run:
            versions.delete_version(name=v.name).result()

// dotnet add package Google.Cloud.AppEngine.V1
// Lists the services of an App Engine app, their traffic split and the versions of each, newest first.
// Uses Application Default Credentials (gcloud auth application-default login, or the service account on the machine).
using Google.Cloud.AppEngine.V1;

string project = args.Length > 0 ? args[0] : throw new ArgumentException("Usage: versions <project>");

ServicesClient services = await ServicesClient.CreateAsync();
VersionsClient versions = await VersionsClient.CreateAsync();

await foreach (Service service in services.ListServicesAsync(new ListServicesRequest { Parent = $"apps/{project}" }))
{
    string id = service.Id;
    var split = string.Join(", ", service.Split.Allocations.Select(a => $"{a.Key}={a.Value:P0}"));
    Console.WriteLine($"{id}  traffic: {(split.Length == 0 ? "none" : split)}");

    var list = new List<Google.Cloud.AppEngine.V1.Version>();
    await foreach (var v in versions.ListVersionsAsync(new ListVersionsRequest { Parent = $"apps/{project}/services/{id}" }))
        list.Add(v);

    foreach (var v in list.OrderByDescending(v => v.CreateTime.ToDateTime()))
    {
        bool serving = service.Split.Allocations.TryGetValue(v.Id, out var share) && share > 0;
        Console.WriteLine($"    {v.Id,-10} {v.ServingStatus,-8} runtime={v.Runtime,-10} {(serving ? "gets traffic" : "idle")}");
    }
}

Videos picked for this service. Each one is labelled with its source, opens on YouTube if you prefer, and loads only when you press play.

If you want containers that scale to zero without the App Engine model, look at Cloud Run. For small event-driven functions use Cloud Run functions, and for Kubernetes use Google Kubernetes Engine. App Engine apps usually keep relational data in Cloud SQL and files in Cloud Storage.