Using the API to Manage Cloud Identity-Aware Proxy for Compute Engine Apps

This page describes the Cloud Identity-Aware Proxy (Cloud IAP) properties that are available for certain Compute Engine API requests. Use this document with Compute Engine API Reference.

Cloud IAP properties

Compute Engine BackendServices resources use the iap properties below. To learn how to set and get these properties, read the sections that follow.

Property name Value Description
iap.enabledbool Specifies if Cloud IAP is enabled for this backend service.
  • The default value is false.
  • If iap.enabled is true, the oauth2ClientId and oauth2ClientSecret properties must be set.
  • If iap.enabled is false, the oauth2ClientId and oauth2ClientSecret properties aren't affected. You can temporarily disable Cloud IAP without unsetting those properties.
iap.oauth2ClientId string Specifies the client ID for use with OAuth 2.0.
iap.oauth2ClientSecret
(Requests only)
string Specifies the client secret for use with OAuth 2.0.
  • This value can't be read via the API. Instead, the oauth2ClientSecretSha256 field is returned.
iap.oauth2ClientSecretSha256
(Responses only)
string In response bodies, the oauth2ClientSecret field is redacted. Instead, iap.oauth2ClientSecretSha256 supplies the SHA256 hash of the secret.

Setting Cloud IAP properties when creating a backend service

When you create a backend service, you can enable Cloud IAP and set the client ID and secret. Use a BackendService POST request:

HTTP request

POST https://www.googleapis.com/compute/v1/projects/project/global/backendServices

Parameters

Parameter name Value Description
Path parameters
project string Project ID for this request.

Request body

In the request body, supply a BackendServices resource with the relevant Cloud IAP properties:

Property name Value Description
Optional properties
iap.enabled bool Specifies if Cloud IAP is enabled for this backend service.
  • The default value is false.
  • If iap.enabled is true, the oauth2ClientId and oauth2ClientSecret properties must be set.
iap.oauth2ClientId string Specifies the client ID for use with OAuth 2.0.
iap.oauth2ClientSecret string Specifies the client secret for use with OAuth 2.0.

Example:


{
  ...
  "backends": [
    {
      ...
      "iap": [
        {
          "enabled": true,
          "oauth2ClientId": string,
          "oauth2ClientSecret": string
        }
      ],
      ...
    }
  ],
  ...
}

The example above shows only the Cloud IAP properties. For additional properties including required properties, see the BackendServices resource documentation.

Response

If successful, this method returns a BackendServices resource in the response body, including Cloud IAP properties.

If iap.enabled is true but the oauth2ClientId and oauth2ClientSecret properties aren't set, a BAD_REQUEST response is returned.

Learn about how to create a backend service using Cloud SDK backend-services create or the Compute Engine API BackendServices: insert method.

Setting Cloud IAP properties by updating a backend service

To enable or disable Cloud IAP for an existing backend service and set or replace the client ID and secret, update the backend service. Use a BackendService PATCH request:

HTTP request

PATCH https://www.googleapis.com/compute/v1/projects/project/global/backendServices/backendService

Parameters

Parameter name Value Description
Path parameters
backendService string Name of the BackendService to update.
project string Project ID for this request.

Request body

In the request body, supply the relevant portions of a BackendServices resource, according to the rules of patch semantics. Include the relevant Cloud IAP properties:

Property name Value Description
Optional properties
iap.enabled bool Specifies if Cloud IAP is enabled for this backend service.
  • The default value is false.
  • If iap.enabled is true, the oauth2ClientId and oauth2ClientSecret properties must be set.
iap.oauth2ClientId string Specifies the client ID for use with OAuth 2.0.
iap.oauth2ClientSecret string Specifies the client secret for use with OAuth 2.0.

Example:


{
  ...
  "backends": [
    {
      ...
      "iap": [
        {
          "enabled": true,
          "oauth2ClientId": string,
          "oauth2ClientSecret": string
        }
      ],
      ...
    }
  ],
  ...
}

The example above shows only the Cloud IAP properties. For additional properties including required properties, see the BackendServices resource documentation.

Response

If successful, this method returns a BackendServices resource in the response body, including Cloud IAP properties.

If iap.enabled is true but you didn't set or supply new oauth2ClientId and oauth2ClientSecret properties, a BAD_REQUEST response is returned.

Learn about how to update a backend service using Cloud SDK backend-services edit or the Compute Engine API BackendServices: patch method.

Getting the Cloud IAP properties of a backend service

To see the current Cloud IAP status of an existing backend service, use a BackendService GET request:

HTTP request

GET https://www.googleapis.com/compute/v1/projects/project/global/backendServices/backendService

Parameters

Parameter name Value Description
Path parameters
backendService string Name of the BackendService to return.
project string Project ID for this request.

Request body

Don't supply a request body with this method.

Response

If successful, this method returns a BackendServices resource in the response body that includes Cloud IAP properties.

Learn about how to get a backend service using Cloud SDK backend-services describe or the Compute Engine API BackendServices: get method.

Send feedback about...

Identity-Aware Proxy Documentation