이 단계에서는 다음을 수행하여 Cloud Run에 배포된 앱의 중앙 집중식 승인 레이어를 프로비저닝하도록 IAP(Identity-Aware Proxy)를 구성합니다.
OAuth 동의 화면 구성: OAuth 동의 화면은 프로젝트, 정책, 요청된 액세스 승인 범위가 포함된 프롬프트입니다. 앱의 OAuth 동의 화면을 구성하면 사용자와 앱 검토자가 사용할 수 있는 항목을 정의하고 나중에 게시할 수 있도록 앱을 등록할 수 있습니다. OAuth 동의 화면에 대한 자세한 내용은 OAuth 동의 화면 구성 및 범위 선택을 참조하세요.
OAuth 액세스 사용자 인증 정보 만들기: 앱에서 필요한 API를 호출할 수 있도록 앱 및 도메인의 OAuth 클라이언트 ID를 만들어야 합니다. OAuth 사용자 인증 정보에 대해 자세히 알아보려면 액세스 사용자 인증 정보 만들기를 참고하세요.
부하 분산기에서 IAP 사용 설정: OAuth 클라이언트 ID 및 보안 비밀번호를 사용하여 앱에 만든 부하 분산기에서 IAP를 사용 설정합니다.
IAP 사용 설정: 앱에 액세스할 수 있는 주 구성원을 만든 다음 IAP를 사용 설정하여 앱을 보호합니다.
At the bottom of the Google Cloud console, a
Cloud Shell
session starts and displays a command-line prompt. Cloud Shell is a shell environment
with the Google Cloud CLI
already installed and with values already set for
your current project. It can take a few seconds for the session to initialize.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-07-24(UTC)"],[],[],null,["# Step 4: Configure Identity-Aware Proxy (IAP)\n\nIn this step, you configure Identity-Aware Proxy (IAP) to provision a\ncentralized authorization layer for the app deployed in Cloud Run, by\ndoing the following:\n\n1. **Configure the OAuth consent screen:** The OAuth consent screen is a prompt that\n includes a summary of your project, its policies, and the requested\n authorization scopes of access. By configuring the OAuth consent screen for\n your app, you define what is available to users and app reviewers, and also\n register your app so you can publish it later. To learn more about\n the OAuth consent screen, see\n [Configure the OAuth consent screen and choose scopes](https://developers.google.com/workspace/guides/configure-oauth-consent).\n\n2. **Create OAuth access credentials:** You need to create an OAuth client ID\n for your app and domain, so your app can call the required APIs. To learn more\n about OAuth credentials, see [Create access credentials](https://developers.google.com/workspace/guides/create-credentials).\n\n3. **Enable IAP on the load balancer**: Use the OAuth client ID and\n secret to enable IAP on the load balancer that you created for\n your app.\n\n4. **Turn on IAP**: Secure your app by creating\n principals who can access your app and then turning on IAP.\n\nConfigure the OAuth consent screen\n----------------------------------\n\n1. In the Google Cloud console, go to the **OAuth consent screen**.\n\n [Go to OAuth consent screen](https://console.cloud.google.com/apis/credentials/consent)\n2. Select one of the following user types for your app:\n\n - **External** : Any user with a Google Account can make authorization\n requests. For the purpose of completing this tutorial, we recommend\n selecting **External**.\n\n - **Internal**: Only members of your Google Cloud organization can make\n authorization requests to the app.\n\n3. Click **Create**.\n\n4. In the **Authorized domains** section, **Add domain**, and specify the domain name used during certificate creation.\n\n5. In the **Developer contact information** section, enter your email address.\n\n6. Click **Save and Continue**.\n\n7. On the **Scopes** page, click **Save and Continue**.\n\n8. Optional: If you selected **External** as the user type, add test users on the **Test users** page, as follows:\n\n 1. Click **Add users**.\n\n 2. Enter your email address and any other authorized test users, and then click **Save and continue**.\n\n9. Review your app registration summary. To make changes, click **Edit** . If the app registration looks OK, click **Back to dashboard**.\n\nCreate OAuth access credentials\n-------------------------------\n\n1. In the Google Cloud console, go to the **Credentials**.\n\n [Go to Credentials](https://console.cloud.google.com/apis/credentials)\n2. Click **Create credentials** and then click **OAuth client ID**.\n\n3. In the **Application type** list, click **Web application**.\n\n4. In the **Name** field, enter `gemini-streamlit-app`.\n\n5. In the **Authorized JavaScript origins** section, click **Add URI** and then\n enter the following URI:\n\n https://\u003cvar translate=\"no\"\u003eDOMAIN_NAME\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003eDOMAIN_NAME\u003c/var\u003e with the domain name used during certificate creation.\n6. Click **Create**.\n\n The **Oauth client created** screen appears, displaying the **Client ID** and **Client secret**.\n7. Copy the **Client ID** and **Client secret**. You'll need details in the next step of the tutorial.\n\nEnable IAP on the load balancer\n-------------------------------\n\n1. In the Google Cloud console, activate Cloud Shell.\n\n [Activate Cloud Shell](https://console.cloud.google.com/?cloudshell=true)\n\n\n At the bottom of the Google Cloud console, a\n [Cloud Shell](/shell/docs/how-cloud-shell-works)\n session starts and displays a command-line prompt. Cloud Shell is a shell environment\n with the Google Cloud CLI\n already installed and with values already set for\n your current project. It can take a few seconds for the session to initialize.\n2. In the Cloud Shell terminal, run the following command: \n\n\n gcloud compute backend-services update gemini-streamlit-app-backend \\\n --iap=enabled,oauth2-client-id=\u003cvar label=\"client_id\" translate=\"no\"\u003eCLIENT_ID\u003c/var\u003e,oauth2-client-secret=\u003cvar label=\"client_secret\" translate=\"no\"\u003eCLIENT_SECRET\u003c/var\u003e \\\n --global\n \n Replace the following\n - \u003cvar translate=\"no\"\u003eCLIENT_ID\u003c/var\u003e: The OAuth client ID from the OAuth credentials that you just created.\n - \u003cvar translate=\"no\"\u003eCLIENT_SECRET\u003c/var\u003e: The OAuth client secret from the OAuth credentials that you just created.\n\nSet up and use IAP\n------------------\n\n| **Caution:** When IAP is turned off, a resource is accessible to anyone with the URL. Ensure that IAP is turned on, so that the resource is accessible only by the configured principals.\n\n1. Go to the **Identity-Aware Proxy** page.\n\n [Go to the Identity-Aware Proxy page](https://console.cloud.google.com/security/iap)\n2. Select your project.\n\n3. Select the checkbox next to `gemini-streamlit-app-backend`.\n\n4. Click **Add principal**.\n\n5. Enter the details in the following fields:\n\n - **New principals**: Enter the email addresses of groups or individuals to\n grant them access to your app. Any of the following can be a principal:\n\n - Google Account\n\n - Google Group\n\n - Service account\n\n - Google Workspace domain\n\n Ensure that you include a Google Account that you have access to.\n6. In the **Role** list, select **Cloud IAP** \\\u003e **IAP-secured Web App User**.\n\n7. Click **Save**.\n\n8. On the **Identity-Aware Proxy** page, under **Applications** , click\n the **IAP** toggle to the on position in the row corresponding\n to the `gemini-streamlit-app-backend` resource.\n\n9. In the **Turn on IAP** window that appears, select the checkbox to acknowledge that you've read the configuration requirements and configured your backend accordingly.\n\n10. Click **Turn on** . After you turn on\n IAP, it requires login credentials for all connections to your load balancer.\n Only accounts with the **IAP-Secured Web App User** role on the project are granted\n given access."]]
