How do you deal with securing the DB's in this setup? Is it possible to isolate the compute engine DB ports to only your appengine instances, or do they have to be open to the whole world?
Disclosure: Also GCP Developer Relations
If you wanted to have some instances that couldn't talk to your database, easiest thing to do is probably throw them in a separate project or create a new subnet that you firewall off and create your non-App Engine instances in that subnet.