Only allow connection to GCP Compute Engine VM originating from Cloud Run service
I have a DB server running as a Compute Engine VM, and an API running on Cloud Run. Both are part of the same project. I want the DB VM to only be accessible from the Cloud Run code. At first I thought this should just work because the firewall has a "default-allow-internal" rule that should apply to every machine in the project. However I was still getting