title: App Engine Flex - Setting GCP Network Tag
body: <p>How can I apply a GCP firewall rule tag to an App Engine Flex instance? I have a project where a bastion host is set up with the appropriate firewall rules to only allow ssh from 0.0.0.0/0 to the bh machine. Then the bastion host is the only source that is able to connect via ssh to all project VMs. I need to apply a firewall rule tag "restricted-ssh" to all app engine flex instances to allow ssh in debug mode. </p>
  
  <p>Per documentation: A target, which defines the instances (including GKE clusters and App Engine Flex instances) to which the rule will apply.
  Source: <a href="https://cloud.google.com/vpc/docs/firewalls" rel="nofollow noreferrer">https://cloud.google.com/vpc/docs/firewalls</a></p>
  
  <p>Looks like the GCP VPC firewall rules effect app engine flex instance. How do I apply a firewall tag to all flex instances?</p>