Set up networking environment in Google Cloud

Good afternoon. You are absolutely right: modifying header information in the HTTP request to the run instance, but this is way too clunky. At least you have three possible strategies: 1. Configure the Cloud Run instances only for private access and apply tools such as IAP or specific permission for users. This applies because you can assign a custom domain / subdomain to a Cloud Run instance (there are certain regions for which restrictions apply) 2. You can configure the Cloud Run instances so that your traffic is received first by a load balancer (and a WAF). In this case you could use the WAF to filter requests from certain IP's (probably this solution is more expensive and does not necessarily satisfy the requirement of a specific "USER"). 3. Cloud RUN can send the traffic to your VPC (with a Local DNS) that would route the traffic to a proxy in reverse mode (nginx) and create rules in the proxy to filter traffic to certain domains / subdomains per user (eg it could be with a database, as it would filter for example the traffic from certain regions) I would like to have more details in order to make adjustments to the strategies suggested, Thanks P.D. Rethinking the requirement, an API gateway (Native GCP) with integrated Firebase authentication (Per User) can be created. Once the user authenticates, the API makes the request to its CR application (which would be in private mode)