无需服务账号与GAE端点服务，GCE能否安全请求GAE？默认账号认证疑问

Let's break down your two key questions clearly, using the config details you shared:

Can GCE send secure HTTP requests to GAE Standard without service accounts or endpoint services? #

Short answer: No, this won't work by default. Here's why:

• Your initial GAE handler config uses login: admin:

  handlers:
  - url: /securehandler/.*
    script: main.app
    login: admin
  

  This restriction only allows requests that carry GAE's special internal headers—like X-AppEngine-Cron: true for cron jobs, or X-Appengine-Inbound-Appid when another GAE app uses URLFetch to call yours. But when you send requests from GCE using a Go client, none of these headers are added automatically. That means your GCE requests will be blocked by the login: admin check.
• Without using service accounts or endpoint services, there's no native GCP mechanism to let GAE automatically trust requests from GCE. Even if your resources are in the same VPC, GAE Standard is publicly accessible by default, and there's no built-in way to assert the identity of a GCE instance in the request.

If you still want secure access without endpoint services, you have a couple of workarounds:

• Implement custom shared-key authentication: Create a secure secret key (store it in environment variables for both GCE and GAE), include it as a custom header in your GCE requests, and have your GAE /securehandler validate this key before processing the request. You'll need to manage key rotation and security yourself.
• Use service account auth (a more secure native option): Even though you wanted to avoid service accounts, this is the most robust GCP-native approach. You'd have your GCE instance's default service account fetch an ID token targeted at your GAE app, include it in the Authorization: Bearer <token> header, and have GAE validate the token. This requires a small amount of code on the GCE side to fetch the token, but it's far more secure than custom shared keys.

Does the default service account automatically authenticate when login: required is set? #

Short answer: No, it won't authenticate automatically.

• Your updated config uses login: required:

  - url: /securehandler/.*
    script: _go_app
    login: required
    secure: always
  

  The login: required setting is designed for human users with a logged-in Google account—it doesn't automatically recognize machine identities like service accounts. When you send a request from GCE without explicitly attaching credentials, the request will be blocked because there's no authenticated user associated with it.
• If you want to use a service account to bypass this restriction, you'll need to do it explicitly:
  1. Fetch an ID token for your GCE default service account, with your GAE app's URL set as the audience.
  2. Include the token in your request's Authorization: Bearer <token> header.
  3. Ensure the service account has the necessary IAM permissions to access your GAE app.
• That said, login: required isn't the best fit for machine-to-machine access. A better choice would be using login: admin alongside service account token validation, or setting up custom IAM-based access controls for your GAE handlers.

内容的提问来源于stack exchange，提问作者mbudge