fix: Update VPC egress settings on GCP to only capture internal traffic

mjumbewu · mjumbewu · commit a9f4367f851f · 2026-07-02T15:33:31.000-04:00
For social auth or SSO, we need to be able to make requests to external servers. setting the vpc_access.egress to ALL_TRAFFIC caused all traffic to be routed to the VPC, which had no outbound rules. We only need the VPC so that the services and jobs can access the DB and cache servers.
diff --git a/infra/gcp/modules/shareabouts-service/jobs.tf b/infra/gcp/modules/shareabouts-service/jobs.tf
@@ -7,7 +7,7 @@ resource "google_cloud_run_v2_job" "migrate" {
       service_account = google_service_account.sa.email
       vpc_access {
         connector = var.vpc_connector_id
-        egress    = "ALL_TRAFFIC"
+        egress    = "PRIVATE_RANGES_ONLY"
       }
 
       containers {
diff --git a/infra/gcp/modules/shareabouts-service/main.tf b/infra/gcp/modules/shareabouts-service/main.tf
@@ -187,7 +187,7 @@ resource "google_cloud_run_v2_service" "default" {
     service_account = google_service_account.sa.email
     vpc_access {
       connector = var.vpc_connector_id
-      egress    = "ALL_TRAFFIC"
+      egress    = "PRIVATE_RANGES_ONLY"
     }
 
     containers {

Original file line number	Diff line number	Diff line change
`@@ -7,7 +7,7 @@ resource "google_cloud_run_v2_job" "migrate" {`
`7`	`7`	`service_account = google_service_account.sa.email`
`8`	`8`	`vpc_access {`
`9`	`9`	`connector = var.vpc_connector_id`
`10`		`- egress = "ALL_TRAFFIC"`
	`10`	`+ egress = "PRIVATE_RANGES_ONLY"`
`11`	`11`	`}`
`12`	`12`
`13`	`13`	`containers {`
Original file line number	Diff line number	Diff line change
`@@ -187,7 +187,7 @@ resource "google_cloud_run_v2_service" "default" {`
`187`	`187`	`service_account = google_service_account.sa.email`
`188`	`188`	`vpc_access {`
`189`	`189`	`connector = var.vpc_connector_id`
`190`		`- egress = "ALL_TRAFFIC"`
	`190`	`+ egress = "PRIVATE_RANGES_ONLY"`
`191`	`191`	`}`
`192`	`192`
`193`	`193`	`containers {`