Apigee Hybrid Runtime/ Message processor IP for restricting

[adarshprabhu]

We are setting up Apigee Hybrid for a bank on GCP. They want to restrict the IP address of Apigee from which the requests are made to the backend targets. They don't want to allow the IPs of the runtime cluster, but want a smaller range (message processor IP or setup something that routes traffic). 

Could you please direct us to the righ

[dchiesa1]

It sounds to me like you want a GCP Cloud NAT Gateway. Think of Cloud NAT as a part of GCP that will be adjacent to your use of Apigee.  It's independent of Apigee, and it can provide to that Apigee runtime, a common, smaller set of source IP addresses, to allow the remote firewalls to restrict inbound calls by source address. 

As the documentation for that capability states:

If you use manual NAT IP address assignment to configure a Cloud NAT gateway, you can confidently share a set of common external source IP addresses with a destination party. For example, a destination service might only allow connections from known external IP addresses.

NAT is the approach most customers use in order to address the challenge you described. 

Because you're installing Apigee hybrid into GCP, I am assuming you will use GKE.  Here's an example of configuring Cloud NAT for GKE.