How to enable Cloud Run using serverless vpc connector to restrict traffic to a specific VPC resource only

I am trying to set up Cloud Run (nodeJs app, code is below) to privately connect to Memory store instance. I've followed this Google Article to create a Serverless VPC Access Connector. Making sure I created the connector in the same region as Cloud Run app, and that the connector is attached to the Redis instance's authorized VPC network.

Memorystore is isolated in a VPC with a private range address.

Nodejs app code is shown below.

const {createClient} = require('redis');
 
    getClient() {
        const client = createClient({
            socket: {
                host: process.env.REDIS_HOST
            },
            password: process.env.REDIS_PASS
        });
        client.on('error', (err) => {
            throw Error(`redis client error: ${err}`);
        });
        return client;
    }

Google doc states that a firewall rule is created to allow ingress from the connector's subnet to all destinations in the VPC network. This is against my company's security policy as we have other services in this VPC (VM's, GKE instances etc). So I need to restrict connector to be able to reach all destinations in VPC network. Is there a preferred way of achieving this?

Earlier in 2021, Google Cloud made it possible for CloudRun serverless vpc connector to use the allow and target-tags flags to create an ingress firewall rule. It allows targeting the traffic only to a specific resource with in VPC.

Google doc states that a firewall rule is created to allow ingress from the connector's subnet to all destinations in the VPC network. This is against my company's security policy as we have other services in this VPC (VM's, GKE instances etc). So I need to restrict connector to be able to reach all destinations in VPC network. Is there a preferred way of achieving this?

Create a firewall rule and set the priority for this rule to be a lower value than the one you created in the previous step.

gcloud compute firewall-rules create RULE_NAME \
--allow=PROTOCOL \
--source-tags=VPC_CONNECTOR_NETWORK_TAG \
--direction=INGRESS \
--network=VPC_NETWORK \
--target-tags=RESOURCE_TAG \
--priority=PRIORITY

Hope it resolves your issue.