configuring-identity-aware-proxy-with-google-iap

name	configuring-identity-aware-proxy-with-google-iap
description	Configures Google Cloud Identity-Aware Proxy (IAP) via gcloud to enforce per-request identity verification on Compute Engine, App Engine, Cloud Run, and GKE, including IAM bindings, Access Context Manager access levels, session/reauth settings, and service-account programmatic access. Use when replacing VPN access with identity-based access to GCP backends or configuring context-aware, zero-trust policies for Google Cloud services.
domain	cybersecurity
subdomain	zero-trust-architecture
tags	["google-iap","identity-aware-proxy","gcp","zero-trust","access-context-manager","cloud-run","app-engine"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.AA-01","PR.AA-05","PR.IR-01","GV.PO-01"]
mitre_attack	["T1078.004","T1133","T1021.007"]
mitre_f3	{"version":"1.1","tactics":["initial-access","positioning"],"techniques":[{"id":"F1006","name":"Account Takeover","tactic":"initial-access","source":"f3"},{"id":"F1004","name":"Access with Stolen Session Cookie","tactic":"initial-access","source":"f3"},{"id":"T1550.001","name":"Use Alternate Authentication Material: Application Access Token","tactic":"initial-access","source":"attack"},{"id":"T1539","name":"Steal Web Session Cookie","tactic":"positioning","source":"attack"}]}

Configuring Identity-Aware Proxy with Google IAP

When to Use

• When protecting Google Cloud applications (App Engine, Cloud Run, GKE, Compute Engine) with identity-based access
• When implementing context-aware access requiring device posture and location verification
• When providing secure access to internal tools without VPN or public IP exposure
• When needing per-request authentication and authorization for web applications and TCP services
• When configuring programmatic access to IAP-protected resources using service accounts

Do not use for non-HTTP applications that cannot be placed behind an HTTPS load balancer, for public-facing applications that need unauthenticated access, or when applications handle their own authentication and IAP would conflict with existing auth flows.

Prerequisites

• Google Cloud project with billing enabled
• IAP API enabled (gcloud services enable iap.googleapis.com)
• Application deployed behind HTTPS Load Balancer, App Engine, or Cloud Run
• Cloud Identity or Google Workspace for user management
• Access Context Manager API enabled for access levels
• OAuth consent screen configured for the project

Workflow

Step 1: Enable IAP on Backend Services

Configure IAP for different GCP compute platforms.

# Enable required APIs
gcloud services enable iap.googleapis.com
gcloud services enable accesscontextmanager.googleapis.com

# Create OAuth consent screen
gcloud iap oauth-brands create \
  --application_title="Internal Applications" \
  --support_email=[e-mail]

# Create OAuth client
gcloud iap oauth-clients create \
  projects/PROJECT_ID/brands/BRAND_ID \
  --display_name="IAP Web Client"

# === Enable IAP on Compute Engine Backend Service ===
gcloud compute backend-services update my-backend-service \
  --iap=enabled,oauth2-client-id=CLIENT_ID,oauth2-client-secret=CLIENT_SECRET \
  --global

# === Enable IAP on App Engine ===
gcloud iap web enable \
  --resource-type=app-engine \
  --oauth2-client-id=CLIENT_ID \
  --oauth2-client-secret=CLIENT_SECRET

# === Enable IAP on Cloud Run ===
# First grant IAP service account the Cloud Run Invoker role
gcloud run services add-iam-policy-binding my-service \
  --member= \
  --role= \
  --region=us-central1


gcloud compute backend-services update my-cloud-run-backend \
  --iap=enabled,oauth2-client-id=CLIENT_ID,oauth2-client-secret=CLIENT_SECRET \
  --global



gcloud compute instances add-iam-policy-binding my-vm \
  --member= \
  --role= \
  --zone=us-central1-a


gcloud compute ssh my-vm --zone=us-central1-a --tunnel-through-iap


gcloud compute start-iap-tunnel my-windows-vm 3389 \
  --local-host-port=localhost:3390 \
  --zone=us-central1-a