Cloud Run Static Outbound IP Address

Problem

Cloud Run uses a shared pool of dynamic outbound IP addresses that change frequently and are shared across all Google Cloud customers. When external services need to whitelist your IP (for rate limit exemptions, firewall rules, or special access), you need a static, predictable outbound IP.

Context / Trigger Conditions

• External service asks for IP address to whitelist
• Cloud Run requests are being blocked by IP-based rate limiting
• Need to identify your traffic to external APIs
• Running crawlers/scrapers that need consistent source IP
• Error messages about "IP not whitelisted" or similar

Solution

Architecture

Cloud Run → VPC Connector → VPC Network → Cloud NAT (static IP) → Internet

Step 1: Reserve Static IP Address

gcloud compute addresses create [NAME]-nat-ip \
  --region=[REGION] \
  --description="Static IP for Cloud Run outbound traffic"

# Get the actual IP address
gcloud compute addresses describe [NAME]-nat-ip \
  --region=[REGION] \
  --format="value(address)"

Step 2: Create Cloud Router

gcloud compute routers create [NAME]-router \
  --network=default \
  --region=[REGION]

Step 3: Create Cloud NAT with Static IP

gcloud compute routers nats create [NAME]-nat \
  --router=[NAME]-router \
  --region=[REGION] \
  --nat-external-ip-pool=[NAME]-nat-ip \
  --nat-all-subnet-ip-ranges

Step 4: Enable VPC Access API

gcloud services enable vpcaccess.googleapis.com

Step 5: Create Serverless VPC Access Connector

gcloud compute networks vpc-access connectors create [NAME]-connector \
  --region=[REGION] \
  --network=default \
  --range=10.8.0.0/28 \
  --min-instances=2 \
  --max-instances=3 \
  --machine-type=e2-micro

Note: The IP range must not conflict with existing subnets. Use a /28 CIDR block.

Step 6: Update Cloud Run to Use VPC Connector

For Cloud Run Jobs:

gcloud run jobs deploy [JOB-NAME] \
  --image=[IMAGE] \
  --region=[REGION] \
  --vpc-connector=[NAME]-connector \
  --vpc-egress=all-traffic \
  [... other flags ...]

For Cloud Run Services:

gcloud run deploy [SERVICE-NAME] \
  --image=[IMAGE] \
  --region=[REGION] \
  --vpc-connector=[NAME]-connector \
  --vpc-egress=all-traffic \
  [... other flags ...]

Critical: --vpc-egress=all-traffic is required to route ALL outbound traffic through the VPC/NAT. Without this, only traffic to internal IPs uses the connector.

Verification

Test that outbound traffic uses the static IP:

# Run a container that checks its external IP
gcloud run jobs execute [JOB-NAME] --region=[REGION] \
  --args="curl,-s,https://api.ipify.org"

Or add a test endpoint to your service that calls an IP echo service.

Example: Complete Setup Script

#!/bin/bash
set -e

PROJECT_ID="my-project"
REGION="us-central1"
NAME="my-crawler"

# Reserve static IP
gcloud compute addresses create ${NAME}-nat-ip --region=$REGION

# Get and display the IP
STATIC_IP=$(gcloud compute addresses describe ${NAME}-nat-ip \
  --region=$REGION --format="value(address)")
echo "Static IP: $STATIC_IP"

# Create router
gcloud compute routers create ${NAME}-router \
  --network=default --region=$REGION

# Create NAT
gcloud compute routers nats create ${NAME}-nat \
  --router=${NAME}-router \
  --region=$REGION \
  --nat-external-ip-pool=${NAME}-nat-ip \
  --nat-all-subnet-ip-ranges

# Enable API and create connector
gcloud services enable vpcaccess.googleapis.com
gcloud compute networks vpc-access connectors create ${NAME}-connector \
  --region=$REGION \
  --network=default \
  --range=10.8.0.0/28 \
  --min-instances=2 \
  --max-instances=3 \
  --machine-type=e2-micro

echo "Setup complete! Use these flags in Cloud Run deployments:"
echo "  --vpc-connector=${NAME}-connector"
echo "  --vpc-egress=all-traffic"
echo ""
echo "Static IP for whitelisting: $STATIC_IP"

Cost Considerations

• Static IP: Free while in use, ~$7/month if reserved but unused
• VPC Connector: ~$7-20/month (2-3 e2-micro instances minimum)
• Cloud NAT: ~$1/month + $0.045/GB processed

Total: ~$10-30/month depending on traffic volume.

Notes

• All Cloud Run instances/jobs using the same VPC connector share the static IP
• You can scale Cloud Run horizontally without changing IPs
• VPC connector has throughput limits (~200-1000 Mbps depending on instance count)
• For high-throughput needs, increase max-instances on the connector
• Cloud SQL connections don't need to go through NAT (use Cloud SQL connector instead)
• The VPC connector adds ~1-5ms latency to requests

Cleanup

To remove the setup:

gcloud compute networks vpc-access connectors delete ${NAME}-connector --region=$REGION
gcloud compute routers nats delete ${NAME}-nat --router=${NAME}-router --region=$REGION
gcloud compute routers delete ${NAME}-router --region=$REGION
gcloud compute addresses delete ${NAME}-nat-ip --region=$REGION

References

• Cloud Run VPC Connectors
• Cloud NAT Overview
• Static Outbound IP for Cloud Run