Subject: App Engine Standard (Python) Times Out Connecting to Memorystore Redis Despite Correct VPC Connector & Firewall

Google Cloud Serverless Applications
1

Hello everyone,

I’m facing a persistent connection timeout issue between my App Engine Standard (Python 3.12) service and a Memorystore for Redis instance, and I’ve exhausted all the standard troubleshooting steps.

The Goal:
Connect a FastAPI application on App Engine to a Memorystore for Redis instance (v7.2) in the same region (europe-west1).

The Setup:

  • App Engine: Deployed with a vpc_access_connector configured in app.yaml.

  • Memorystore: Standard Tier, using a Private Service Access connection on the default VPC network. (Redis IP: 10.16.178.5)

  • VPC Connector: Serverless VPC Access connector deployed in the same region/VPC, using subnet 10.9.0.0/28.

  • Firewall: An INGRESS firewall rule is active with priority 900 that ALLOWS tcp:6379 from source 10.9.0.0/28 to “All instances in the network”.

What I’ve Tried & Verified:

  1. Network Path is Correct: I launched a Compute Engine VM on the same subnet as the VPC connector (10.9.0.0/28). From this VM, I can successfully connect to the Redis instance using redis-cli -h 10.16.178.5 ping and get a PONG. This proves the firewall rule, VPC peering, and Redis instance are working correctly.

  2. App Engine Deployment: I have redeployed my App Engine service multiple times using gcloud app deploy --promote.

  3. App Engine Configuration: I have verified in the Google Cloud Console (App Engine → Versions → Configuration) that the active, running version of my service DOES have the VPC connector attached under the “Networking settings” section.

  4. IAM Permissions: The service account used by App Engine has the Serverless VPC Access User role.

The Problem:
Despite all of the above, any connection attempt from the App Engine application to the Redis host 10.16.178.5 results in a connection timeout. The application logs confirm it is trying to connect to the correct IP and port.

The Question:
Given that the underlying network path is proven to work (verified via the test VM), and the App Engine version shows the connector is attached, what could be preventing the App Engine traffic from successfully traversing the VPC connector? It seems the connection between the App Engine environment and the connector itself is failing.

Any insights or further diagnostic steps would be greatly appreciated. Thank you