Overview

By default, Cloud Run services send outbound traffic to the internet using a pool of Google-owned IP addresses that changes over time. This makes it impossible for a third party to allowlist your application's traffic.

To get a stable outbound IP address, you route your services' egress traffic through your environment's VPC and out via a Cloud NAT gateway that uses a reserved static IP address.

This requires two steps:

1. Create a Cloud NAT gateway with a reserved static IP for the Encore VPC, using the GCP Console.
2. Configure your Cloud Run services to route All traffic through the VPC, using the Encore Cloud dashboard.

Benefits

A static outbound IP allows you to:

• Have partners and third-party APIs allowlist your application's IP address
• Connect to external databases and services that require IP-based access control
• Meet compliance requirements that mandate known, auditable egress addresses

Step 1: Create a Cloud NAT gateway

Encore Cloud provisions a dedicated GCP project and VPC network for each environment. The Cloud NAT gateway needs to be created in that project, in the same region as your environment.

First, reserve a static external IP address:

1. In the GCP Console, select the GCP project for your Encore environment
2. Go to VPC network > IP addresses and click Reserve external static IP address
3. Give it a name (e.g. encore-egress-ip)
4. Set Type to Regional and select the region your environment is deployed in
5. Click Reserve

Then create the Cloud NAT gateway:

1. Go to Network services > Cloud NAT and click Get started / Create Cloud NAT gateway
2. Give the gateway a name (e.g. encore-egress-nat)
3. Set NAT type to Public
4. Select the VPC Network that Encore Cloud provisioned for the environment, and the same Region as above
5. For Cloud Router, create a new router (or select an existing one in the same network and region)
6. Under Cloud NAT mapping, keep the default source selection so that all subnet IP ranges are able to use the gateway
7. Set NAT IP addresses to Manual and select the static IP address you reserved
8. Click Create

<Callout type="info">

Create the Cloud NAT gateway before changing the VPC egress setting in the next step. Once egress is routed through the VPC, outbound internet traffic depends on the NAT gateway — without it, your services will not be able to reach the internet.

</Callout>

Step 2: Route all Cloud Run traffic through the VPC

By default, Cloud Run only sends traffic destined for private IP ranges through the VPC, and sends internet-bound traffic directly out via Google's IP pool. To make internet-bound traffic use the NAT gateway, you need to change the VPC egress setting:

1. Open your environment in the Encore Cloud dashboard
2. Go to the Infrastructure tab
3. Find the Cloud Run configuration and set VPC egress to All traffic
4. Apply the change

Infrastructure changes made in the dashboard are applied as part of a deployment, so trigger a new deploy (or push a commit) for the setting to take effect. See Managing Infrastructure for details on the deployment phases.

Verifying the configuration

Once deployed, make an outbound request from one of your services to a service that echoes back the caller's IP address (for example https://api.ipify.org) and confirm that the returned address matches the static IP you reserved.

Things to keep in mind

• All outbound traffic is affected. With All traffic egress, every outbound request — including calls to public APIs — goes through the VPC and the NAT gateway. This adds NAT data processing charges, and the NAT gateway becomes a dependency for all internet access from your services.
• One gateway per region and network. Cloud NAT is regional. If an environment spans multiple regions, create a gateway with a reserved IP in each region.
• Multiple IPs for high volume. A single NAT IP supports a limited number of concurrent connections to the same destination. If your application makes a large number of concurrent outbound connections, assign several reserved static IPs to the gateway and allowlist all of them.
• Manual changes are preserved. Encore Cloud does not overwrite resources it doesn't manage, so the Cloud NAT gateway and reserved IP you create in the console will be left untouched by future deployments. See Infrastructure Configuration.

<Callout type="info">

If your environment runs on GKE instead of Cloud Run, the VPC egress setting doesn't apply — pods already egress through the VPC network. In that case, check whether a Cloud NAT gateway already exists for the network and attach a reserved static IP address to it rather than creating a second gateway.

</Callout>