title: Securely allow Google App Engine to internal company network/servers for Google Apps Scripts
body: <p>It is well documented that Google Apps Script run on Google App Engine servers that  would not have access to a company's internal network/server:</p>
  
  <ul>
  <li><a href="https://developers.google.com/apps-script/reference/url-fetch/url-fetch-app" rel="nofollow noreferrer">https://developers.google.com/apps-script/reference/url-fetch/url-fetch-app</a></li>
  <li><a href="https://cloud.google.com/appengine/kb/#static-ip" rel="nofollow noreferrer">https://cloud.google.com/appengine/kb/#static-ip</a></li>
  <li><a href="https://developers.google.com/apps-script/guides/jdbc#using_jdbcgetconnectionurl" rel="nofollow noreferrer">https://developers.google.com/apps-script/guides/jdbc#using_jdbcgetconnectionurl</a></li>
  </ul>
  
  <p>Per the documentation, if you want a Google Apps Script project to have access to an internal network/server then you will have to white-list Google's IPs. But we all know that isn't the safest option. In fact, the documentation even says so:</p>
  
  <blockquote>
    <p>Note that using static IP address filtering is not considered a safe and effective means of protection. For example, an attacker could set up a malicious App Engine app which could share the same IP address range as your application. Instead, we suggest that you take a <a href="https://en.wikipedia.org/wiki/Defense_in_depth_(computing)" rel="nofollow noreferrer">defense in depth</a> approach using <a href="https://en.wikipedia.org/wiki/Oauth" rel="nofollow noreferrer">OAuth</a> and <a href="https://en.wikipedia.org/wiki/Digital_certificates" rel="nofollow noreferrer">Certs</a>.</p>
  </blockquote>
  
  <p>The issue is I cannot find any documentation, reference material, or articles on how best an organization should do what it suggests. </p>
  
  <p>So my question is, how can an organization using G-Suite Enterprise securely allow Google Apps Script projects to access the company's internal network?</p>