Found this post:

At this time it is not possible to do this.

I suspect this limitation is because App Engine is not available for VPC Service Controls like other services as Cloud Run or Cloud Functions where a perimeter is needed to reach them, the ingress is internal (or internal + load balancer) and the service is not in the host project.

For now the workaround is to have the App Engine service in the host project.

On the other hand there is already a Feature Request to allow requests coming from a resource in a Shared VPC.

I’m not certain if this is possible with App Engine Flexible or other products but please refer to below setup guide:

• App Engine Flexible:

  • Setting up the App Engine flexible environment with Shared VPC

  • Configure private internal-only services

• Cloud Load Balancing:

  • Configure a load balancer with a cross-project backend service