Identity Aware Proxy | Google Identity

Introduction

Identity-Aware Proxy (IAP) is a Google Cloud service that allows you to control access to your applications and VMs running on Google Cloud. IAP ensures that only authenticated and authorized users can access your applications, providing an additional layer of security. In this tutorial, we will cover the basics of setting up and using IAP.

Prerequisites

Before you start using Identity-Aware Proxy, make sure you have the following:

A Google Cloud Platform (GCP) account.
Billing enabled for your GCP project.
Admin access to your GCP project.
Basic knowledge of Google Cloud services.

Step 1: Enable Identity-Aware Proxy

To enable IAP for your project, follow these steps:

Go to the Google Cloud Console.
Select your project.
Navigate to the "Security" section and click on "Identity-Aware Proxy".
Click on "Enable" to activate IAP for your project.

Step 2: Configure OAuth Consent Screen

To use IAP, you need to configure the OAuth consent screen:

Go to the OAuth consent screen in the Cloud Console.
Fill in the required fields such as Application Name, Support Email, etc.
Click "Save and Continue".

Step 3: Create OAuth 2.0 Credentials

Create OAuth 2.0 credentials to authenticate users:

Go to the Credentials page in the Cloud Console.
Click "Create Credentials" and select "OAuth 2.0 Client ID".
Choose "Web application" as the application type.
Fill in the required fields and click "Create".
Note down the Client ID and Client Secret.

Step 4: Secure Your Application with IAP

To secure your application with IAP, follow these steps:

Go to the IAP page in the Cloud Console.
Select the resource you want to protect (e.g., App Engine, Compute Engine, GKE).
Toggle the switch to "On" to enable IAP for your resource.
Configure access by adding users or groups who can access the resource.

Example: Protecting a Compute Engine Instance

Let's walk through an example of protecting a Compute Engine instance with IAP.

1. Create a Compute Engine instance:

gcloud compute instances create example-instance --zone=us-central1-a

2. Enable IAP for the instance:

gcloud compute instances set-iam-policy example-instance policy.json --zone=us-central1-a

3. Add a binding to the policy.json file:

{
  "bindings": [
    {
      "role": "roles/iap.tunnelResourceAccessor",
      "members": [
        "user:example@example.com"
      ]
    }
  ]
}

4. Apply the policy to your instance: