How do I run private modules on Google App Engine?

Question

I have an application that I'd like to split into three layers:

1. Public facing web service
2. Private web service
3. Private data store

1) are stateless frontend web servers that renders UI and mostly acts as proxy for 2).

2) must only be accessible from 1) and not the public internet.

3) must only be accessible from 2) and not 1) or the public internet.

I'd like to use GAE managed VMs for deploying both 1) and 2), while 3) is deployed to GCE. It's clear to me how to tag instances in GCE such that I can create firewall rules that apply to 3). However, it's not clear to me how to tag 1) and 2). I've looked into whatever documentation I can find on app.yaml and other things, but there doesn't seem to be much to find on instance tagging.

Is it possible to automatically tag GAE instances, and if so how?