This page describes how to manage individual or group access to Identity-Aware Proxy (IAP)-secured resources at the resource level.
Overview
IAP enables you to configure IAP policies for individual resources in a Google Cloud project. Multiple apps within a project can each have different access policies. This includes projects that have Compute Engine, Google Kubernetes Engine, and App Engine apps. For App Engine apps, individual versions and services can have different access policies applied.
To manage project level and higher access, use the IAM admin page. Lists of users who have access (the "members") at the project level applies to all IAP-secured resources in the project.
Before you begin
Before you begin, you'll need the following:
- A IAP-secured resource to which you want to add individual or group access.
- User or group names for which you want to add access.
Turning IAP on and off
To turn IAP on and off, certain permissions are needed. The following table shows the permission needed for each app type.
App type | Permission required |
---|---|
App Engine | appengine.applications.update |
Compute Engine or Google Kubernetes Engine | compute.backendServices.update |
These permissions are granted by roles such as Project Editor, App Engine Admin, and Compute Network Admin. While these roles allow turning IAP on and off, they don't have the permissions needed to modify access policies.
In addition, turning IAP on with the Cloud Console
might also require the clientauthconfig.clients.create
and
clientauthconfig.clients.getWithSecret
permissions. These permissions are
granted by the Project Editor role.
To learn more about granting roles, see Granting, changing, and revoking access.
Managing access in the Cloud Console
To control access to a IAP-secured resource with the Cloud Console, follow the process to add or remove access.
Add access
Go to the Identity-Aware Proxy page.
Go to the Identity-Aware Proxy pageSelect the resource you want to secure with IAP. The following resource selections secure a set group of resources:
All Web Services: All resources in the project will be secured. Note that this is not the same as granting project level access with the IAM admin page. A user granted the IAP Policy Admin role at the All Web Services resource level will only have permissions to IAP policies.
Backend Services: All backend services will be secured.
On the right side Info panel, add the email addresses of groups or individuals to whom you want to grant an Identity and Access Management (IAM) role for the resource.
Apply access policy roles to the member by selecting from the following roles in the Select a role dropdown:
Owner: Grants the same access as IAP Policy Admin. Use the IAP Policy Admin role instead. This role only allows modifying policies, and doesn't grant access to the app.
IAP Policy Admin: Grants administrator rights over IAP policies.
IAP-Secured Web App User: Grants access to the app and other HTTPS resources that use IAP.
Security Reviewer: Grants permission to view and audit IAP policies.
When you're finished adding email addresses and setting roles, click Add
Remove access
- Go to the Identity-Aware Proxy page.
Go to the Identity-Aware Proxy page - Select the resource that is secured with IAP.
- On the right side Info panel, select the section that corresponds to the role you want to remove from a member.
- In the expanded section, next to each user or group name for which you want to remove the role, click Remove.
- In the Remove member dialog that appears, click Remove.
Managing access with the API
IAM provides a standard set of methods for creating and managing access control policies on Google Cloud resources.
Resources and Permissions
The IAP API enables you to apply IAM permissions to individual resources in a IAP-secured project. IAM permissions granted at a certain level apply to all levels underneath it. For example, a permission granted at the project level applies to all Google Cloud resources in the project. Access for project-level and above is managed in the IAM admin page, but will be displayed in the IAP admin page.
Users need certain permissions to access a IAP-secured app
and use methods that update IAM policies. The
iap.webServiceVersions.accessViaIAP
permission grants access to the app. If
you're using IAP to control access to administrative services
like SSH and RDP, users will need the iap.tunnelInstances.accessViaIAP
permission.
Each IAP resource has its own getIamPolicy
and setIamPolicy
permission that grants the ability to manage access policies for that resource
and its children.
To call the IAM API, construct a call with a URL path to a resource. The following is an example call that gets the IAM policy for an App Engine app service version.
https://iap.googleapis.com/v1beta1/projects/PROJECT_NUMBER/iap_web/
appengine-APP_ID/services/SERVICE_ID/versions/VERSION_ID:getIamPolicy
Resource Type | Description | Path | Permissions |
---|---|---|---|
iap.web |
Every IAP-secured web app in the project. This is the same as the All Web Services checkbox on the IAP admin page. | https://iap.googleapis.com/v1beta1/projects/ |
iap.web.getIamPolicy iap.web.setIamPolicy |
iap.webTypes |
Either a backend service or an App Engine app. This is the same as the Backend Service and App Engine app checkboxes on the IAP admin page. | Backend service Global scope: https://iap.googleapis.com/v1beta1/projects/ Regional scope: https://iap.googleapis.com/v1beta1/projects/ App Engine app https://iap.googleapis.com/v1beta1/projects/ |
iap.webTypes.getIamPolicy iap.webTypes.setIamPolicy |
iap.webServices |
Either a Compute Engine backend service or an App Engine app service. The backend service path can either specify either the backend service ID or the backend service name. | Backend services Global scope: https://iap.googleapis.com/v1beta1/projects/ Regional scope: https://iap.googleapis.com/v1beta1/projects/ App Engine app https://iap.googleapis.com/v1beta1/projects/ |
iap.webServices.getIamPolicy iap.webServices.setIamPolicy |
iap.webServiceVersions |
An App Engine service version. Compute Engine doesn't support versioning. | https://iap.googleapis.com/v1beta1/projects/ |
iap.webServiceVersions.getIamPolicy iap.webServiceVersions.setIamPolicy |
iap.tunnel |
Every IAP-secured instance in the project. This is the same as the All Tunnel Resources checkbox on the IAP admin page. | https://iap.googleapis.com/v1beta1/projects/ |
iap.tunnel.getIamPolicy iap.tunnel.setIamPolicy |
iap.tunnelZones |
Every zone which has at least one instance. This is the same as a zone name checkbox on the IAP admin page, for example, us-central1-c . |
https://iap.googleapis.com/v1beta1/projects/ |
iap.tunnelZones.getIamPolicy iap.tunnelZones.setIamPolicy |
iap.tunnelInstances |
An individual instance. | https://iap.googleapis.com/v1beta1/projects/ |
iap.tunnelInstances.getIamPolicy iap.tunnelInstances.setIamPolicy |
Roles
The following table lists the IAP IAM roles with a corresponding list of all of the IAP-specific permissions each role includes. For more information about IAM roles see Managing Roles and Permissions.
Role | Includes permission(s) | Description |
---|---|---|
IAP-Secured Web App User (roles/iap.httpsResourceAccessor ) |
iap.webServiceVersions.accessViaIAP |
Grants access to App Engine and Compute Engine resources. |
IAP-Secured Tunnel User (roles/iap.tunnelResourceAccessor ) |
iap.tunnelInstances.accessViaIAP |
Grants access to tunnel resources that use IAP. |
IAP Policy Admin (roles/iap.admin ) |
iap.web.getIamPolicy iap.web.setIamPolicy iap.webTypes.getIamPolicy iap.webTypes.setIamPolicy iap.webServices.getIamPolicy iap.webServices.setIamPolicy iap.webServiceVersions.getIamPolicy iap.webServiceVersions.setIamPolicy |
Grants IAP administrative rights to manage IAP access policies of resources. |
Public access
To grant everyone access to a resource, add one of the following members to its access list:
allAuthenticatedUsers
: Anyone who is authenticated with a Google account or a service account.allUsers
: Anyone who is on the internet, including authenticated and unauthenticated users. The signed header for the request won't have asub
oremail
claim.
If public access is granted, IAP won't generate Cloud Audit Logs logs for the request.
Currently, bindings that grant public access can't have a condition
associated with it.
For example, a policy that allows anyone
access to a resource if the request path starts with /public/
is invalid.