Mulai 29 April 2025, model Gemini 1.5 Pro dan Gemini 1.5 Flash tidak tersedia di project yang belum pernah menggunakan model ini, termasuk project baru. Untuk mengetahui detailnya, lihat Versi dan siklus proses model.
Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Pada langkah ini, Anda akan mengonfigurasi Identity-Aware Proxy (IAP) untuk menyediakan lapisan otorisasi terpusat bagi aplikasi yang di-deploy di Cloud Run, dengan melakukan hal berikut:
Mengonfigurasi layar izin OAuth: Layar izin OAuth adalah perintah yang menyertakan ringkasan project Anda, kebijakannya, dan cakupan akses otorisasi yang diminta. Dengan mengonfigurasi layar izin OAuth untuk aplikasi Anda, Anda menentukan apa yang tersedia bagi pengguna dan peninjau aplikasi, serta mendaftarkan aplikasi Anda agar dapat dipublikasikan nanti. Untuk mempelajari lebih lanjut
layar izin OAuth, lihat
Mengonfigurasi layar izin OAuth dan memilih cakupan.
Buat kredensial akses OAuth: Anda perlu membuat client ID OAuth untuk aplikasi dan domain Anda, sehingga aplikasi Anda dapat memanggil API yang diperlukan. Untuk mempelajari lebih lanjut kredensial OAuth, lihat Membuat kredensial akses.
Aktifkan IAP di load balancer: Gunakan client ID dan rahasia klien OAuth untuk mengaktifkan IAP di load balancer yang Anda buat untuk aplikasi Anda.
Aktifkan IAP: Amankan aplikasi Anda dengan membuat
principal yang dapat mengakses aplikasi Anda, lalu aktifkan IAP.
Mengonfigurasi layar izin OAuth
Di konsol Google Cloud , buka OAuth consent screen.
At the bottom of the Google Cloud console, a
Cloud Shell
session starts and displays a command-line prompt. Cloud Shell is a shell environment
with the Google Cloud CLI
already installed and with values already set for
your current project. It can take a few seconds for the session to initialize.
Di terminal Cloud Shell, jalankan perintah berikut:
Centang kotak di samping gemini-streamlit-app-backend.
Klik Tambahkan akun utama.
Masukkan detail di kolom berikut:
Akun utama baru: Masukkan alamat email grup atau individu untuk memberi mereka akses ke aplikasi Anda. Akun utama dapat berupa salah satu dari berikut ini:
Akun Google
Google Grup
Akun layanan
Domain Google Workspace
Pastikan Anda menyertakan Akun Google yang dapat Anda akses.
Dalam daftar Role, pilih Cloud IAP > IAP-secured Web App User.
Klik Simpan.
Di halaman Identity-Aware Proxy, di bagian Applications, klik tombol IAP ke posisi aktif di baris yang sesuai dengan resource gemini-streamlit-app-backend.
Di jendela Aktifkan IAP yang muncul, centang kotak untuk mengonfirmasi bahwa Anda telah membaca persyaratan konfigurasi dan mengonfigurasi backend Anda dengan tepat.
Klik Aktifkan. Setelah Anda mengaktifkan IAP, IAP akan memerlukan kredensial login untuk semua koneksi ke load balancer Anda.
Hanya akun dengan peran IAP-Secured Web App User di project yang diberi
akses.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[],[],null,["# Step 4: Configure Identity-Aware Proxy (IAP)\n\nIn this step, you configure Identity-Aware Proxy (IAP) to provision a\ncentralized authorization layer for the app deployed in Cloud Run, by\ndoing the following:\n\n1. **Configure the OAuth consent screen:** The OAuth consent screen is a prompt that\n includes a summary of your project, its policies, and the requested\n authorization scopes of access. By configuring the OAuth consent screen for\n your app, you define what is available to users and app reviewers, and also\n register your app so you can publish it later. To learn more about\n the OAuth consent screen, see\n [Configure the OAuth consent screen and choose scopes](https://developers.google.com/workspace/guides/configure-oauth-consent).\n\n2. **Create OAuth access credentials:** You need to create an OAuth client ID\n for your app and domain, so your app can call the required APIs. To learn more\n about OAuth credentials, see [Create access credentials](https://developers.google.com/workspace/guides/create-credentials).\n\n3. **Enable IAP on the load balancer**: Use the OAuth client ID and\n secret to enable IAP on the load balancer that you created for\n your app.\n\n4. **Turn on IAP**: Secure your app by creating\n principals who can access your app and then turning on IAP.\n\nConfigure the OAuth consent screen\n----------------------------------\n\n1. In the Google Cloud console, go to the **OAuth consent screen**.\n\n [Go to OAuth consent screen](https://console.cloud.google.com/apis/credentials/consent)\n2. Select one of the following user types for your app:\n\n - **External** : Any user with a Google Account can make authorization\n requests. For the purpose of completing this tutorial, we recommend\n selecting **External**.\n\n - **Internal**: Only members of your Google Cloud organization can make\n authorization requests to the app.\n\n3. Click **Create**.\n\n4. In the **Authorized domains** section, **Add domain**, and specify the domain name used during certificate creation.\n\n5. In the **Developer contact information** section, enter your email address.\n\n6. Click **Save and Continue**.\n\n7. On the **Scopes** page, click **Save and Continue**.\n\n8. Optional: If you selected **External** as the user type, add test users on the **Test users** page, as follows:\n\n 1. Click **Add users**.\n\n 2. Enter your email address and any other authorized test users, and then click **Save and continue**.\n\n9. Review your app registration summary. To make changes, click **Edit** . If the app registration looks OK, click **Back to dashboard**.\n\nCreate OAuth access credentials\n-------------------------------\n\n1. In the Google Cloud console, go to the **Credentials**.\n\n [Go to Credentials](https://console.cloud.google.com/apis/credentials)\n2. Click **Create credentials** and then click **OAuth client ID**.\n\n3. In the **Application type** list, click **Web application**.\n\n4. In the **Name** field, enter `gemini-streamlit-app`.\n\n5. In the **Authorized JavaScript origins** section, click **Add URI** and then\n enter the following URI:\n\n https://\u003cvar translate=\"no\"\u003eDOMAIN_NAME\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003eDOMAIN_NAME\u003c/var\u003e with the domain name used during certificate creation.\n6. Click **Create**.\n\n The **Oauth client created** screen appears, displaying the **Client ID** and **Client secret**.\n7. Copy the **Client ID** and **Client secret**. You'll need details in the next step of the tutorial.\n\nEnable IAP on the load balancer\n-------------------------------\n\n1. In the Google Cloud console, activate Cloud Shell.\n\n [Activate Cloud Shell](https://console.cloud.google.com/?cloudshell=true)\n\n\n At the bottom of the Google Cloud console, a\n [Cloud Shell](/shell/docs/how-cloud-shell-works)\n session starts and displays a command-line prompt. Cloud Shell is a shell environment\n with the Google Cloud CLI\n already installed and with values already set for\n your current project. It can take a few seconds for the session to initialize.\n2. In the Cloud Shell terminal, run the following command: \n\n\n gcloud compute backend-services update gemini-streamlit-app-backend \\\n --iap=enabled,oauth2-client-id=\u003cvar label=\"client_id\" translate=\"no\"\u003eCLIENT_ID\u003c/var\u003e,oauth2-client-secret=\u003cvar label=\"client_secret\" translate=\"no\"\u003eCLIENT_SECRET\u003c/var\u003e \\\n --global\n \n Replace the following\n - \u003cvar translate=\"no\"\u003eCLIENT_ID\u003c/var\u003e: The OAuth client ID from the OAuth credentials that you just created.\n - \u003cvar translate=\"no\"\u003eCLIENT_SECRET\u003c/var\u003e: The OAuth client secret from the OAuth credentials that you just created.\n\nSet up and use IAP\n------------------\n\n| **Caution:** When IAP is turned off, a resource is accessible to anyone with the URL. Ensure that IAP is turned on, so that the resource is accessible only by the configured principals.\n\n1. Go to the **Identity-Aware Proxy** page.\n\n [Go to the Identity-Aware Proxy page](https://console.cloud.google.com/security/iap)\n2. Select your project.\n\n3. Select the checkbox next to `gemini-streamlit-app-backend`.\n\n4. Click **Add principal**.\n\n5. Enter the details in the following fields:\n\n - **New principals**: Enter the email addresses of groups or individuals to\n grant them access to your app. Any of the following can be a principal:\n\n - Google Account\n\n - Google Group\n\n - Service account\n\n - Google Workspace domain\n\n Ensure that you include a Google Account that you have access to.\n6. In the **Role** list, select **Cloud IAP** \\\u003e **IAP-secured Web App User**.\n\n7. Click **Save**.\n\n8. On the **Identity-Aware Proxy** page, under **Applications** , click\n the **IAP** toggle to the on position in the row corresponding\n to the `gemini-streamlit-app-backend` resource.\n\n9. In the **Turn on IAP** window that appears, select the checkbox to acknowledge that you've read the configuration requirements and configured your backend accordingly.\n\n10. Click **Turn on** . After you turn on\n IAP, it requires login credentials for all connections to your load balancer.\n Only accounts with the **IAP-Secured Web App User** role on the project are granted\n given access."]]
