Virtual private networks 

Because App Engine services running in the flexible environment are backed by Compute Engine VMs, these services can be made to run on top of any existing network in the same project. Unless specified, all services in the flexible environment run on the default network. This can be changed by specifying a network in the service's app.yaml:

network:
  name: NETWORK
  Subnet_name: SUBNETWORK

A Google Cloud network can be configured to connect to an organization's internal network through the use of VPN peering. By configuring a VPN to allow traffic from the service's network and subnet, App Engine services can securely connect directly to internal systems.