Determine um recurso que você quer proteger. Configure um dos itens a seguir se você
não tiver um recurso.
Um app da Web executado por trás de um
balanceador de carga HTTPS
em Google Cloud. Isso inclui aplicativos da Web, como aplicativos do App Engine,
aplicativos locais e aplicativos em execução em outra nuvem.
Uma máquina virtual no Google Cloud.
Determine os principais a que você quer conceder e limitar o acesso.
O Identity-Aware Proxy (IAP) estabelece uma camada de reconhecimento de identidade central para apps e
recursos acessados por HTTPS e TCP. Isso significa que você pode controlar o acesso em
cada aplicativo e recurso individual em vez de usar firewalls no nível da rede.
Proteja o app Google Cloud e todos os recursos dele selecionando um dos
seguintes guias:
Também é possível estender o IAP para ambientes que não
são doGoogle Cloud, como infraestruturas locais ou outras nuvens.
Para saber mais, consulte o guia
Como proteger aplicativos
no local.
Para controlar o acesso a serviços administrativos, como SSH e RDP, nos
back-ends, defina permissões de recursos de túnel e crie túneis que encaminham
o tráfego TCP por meio do IAP para instâncias de máquina virtual.
Um nível de acesso não entra em vigor até que seja aplicado em uma
política de Gerenciamento de identidade e acesso (IAM) de recursos protegidos pelo IAP.
Nesta etapa, você adiciona uma
Condição do IAM
ao papel do IAP usado para conceder acesso ao recurso.
Depois de aplicar seu nível de acesso, os recursos estarão protegidos com
o Chrome Enterprise Premium.
Como ativar a confiança e a segurança do dispositivo com a Verificação de endpoints
Para reforçar ainda mais a segurança dos recursos protegidos do Chrome Enterprise Premium,
aplique atributos de controle de acesso e confiança baseados em dispositivo com
níveis de acesso.
A Verificação de endpoint ativa esse controle.
A Verificação de endpoints é uma extensão do Chrome para dispositivos Windows, Mac e Chrome OS.
O Access Context Manager faz referência aos atributos
do dispositivo coletados pela Verificação de endpoint para impor o controle de acesso refinado com
níveis de acesso.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-09-01 UTC."],[],[],null,["# Quickstart: Apply Chrome Enterprise Premium to cloud resources\n\nApply Chrome Enterprise Premium to cloud resources\n==================================================\n\nThis page walks through the high level steps of applying Chrome Enterprise Premium to\nyour Google Cloud and on-premises resources.\n\nFor information about how Chrome Enterprise Premium leverages other\nGoogle Cloud offerings, see the\n[Chrome Enterprise Premium access protection overview](/chrome-enterprise-premium/docs/overview).\n\nBefore you begin\n----------------\n\nBefore you make your apps and resources context-aware, you'll need to:\n\n1. If you don't already have [Cloud Identity](/identity) user accounts in\n your organization,\n [create a few Cloud Identity accounts](https://support.google.com/cloudidentity/answer/7332836?hl=en).\n\n2. Determine a resource you want to protect. Configure one of the following if\n you don't have a resource.\n\n - A web app running behind an [HTTPS load balancer](/load-balancing/docs/https/setting-up-https) on Google Cloud. This includes web apps like App Engine apps, apps running on-premises, and apps running in another cloud.\n - A virtual machine on Google Cloud.\n3. Determine principals that you want to grant and limit access to.\n\nIf you're interested in securing Google Workspace apps, see the\n[Google Workspace Chrome Enterprise Premium overview](https://support.google.com/a/answer/9275380?hl=en).\n\nSecuring your apps and resources with IAP\n-----------------------------------------\n\nIdentity-Aware Proxy (IAP) establishes a central identity awareness layer for apps and\nresources accessed by HTTPS and TCP. This means you can control access on\neach individual app and resource instead of using network-level firewalls.\n\nSecure your Google Cloud app and all its resources by selecting one of the\nfollowing guides:\n\n- [App Engine standard and flexible environment](/chrome-enterprise-premium/docs/securing-app-engine)\n- [Compute Engine](/chrome-enterprise-premium/docs/securing-compute-engine)\n- [Google Kubernetes Engine](/chrome-enterprise-premium/docs/securing-kubernetes-engine)\n\nYou can also extend IAP to non-Google Cloud\nenvironments like on-premises as well as other clouds.\nTo learn more, see the\n[Securing on-premises apps](/chrome-enterprise-premium/docs/securing-on-premises)\nguide.\n\nFor more information, see the [IAP documentation](/iap/docs).\n\n### Virtual machine resources\n\nYou can control access to administrative services like SSH and RDP on your\nbackends by setting tunnel resource permissions and creating tunnels that route\nTCP traffic through IAP to virtual machine instances.\n\nTo secure a virtual machine, see the\n[Securing virtual machines](/chrome-enterprise-premium/docs/securing-virtual-machines)\nguide.\n\nCreating an access level with Access Context Manager\n----------------------------------------------------\n\nOnce you've secured your apps and resources with IAP, it's time\nto set richer access policies with\n[access levels](/access-context-manager/docs/overview#access-levels).\n\n[Access Context Manager](/access-context-manager/docs/overview) creates\naccess levels. Access levels can limit access based on the\nfollowing attributes:\n\n- [IP subnetworks](/access-context-manager/docs/access-level-attributes#ip-subnetworks)\n- [Regions](/access-context-manager/docs/access-level-attributes#regions)\n- [Access level dependency](/access-context-manager/docs/access-level-attributes#access-level-dependency)\n- [Principals](/access-context-manager/docs/access-level-attributes#members)\n- [Device policy](/access-context-manager/docs/access-level-attributes#device-policy) (Note that [Endpoint Verification](/chrome-enterprise-premium/docs/apply-resources#enable-endpoint-verification) must be set up.)\n\nCreate an access level by following the\n[Creating an access levels](/chrome-enterprise-premium/docs/access-levels#creating-an-access-level)\nguide.\n\nApplying access levels\n----------------------\n\nAn access level doesn't take effect until you apply it on a\nIAP-secured resources' Identity and Access Management (IAM) policy.\nThis step is done by adding an\n[IAM Condition](/chrome-enterprise-premium/docs/access-protection#applying-cloud-iam-conditions)\non the IAP role used to grant access to your resource.\n\nTo apply your access level, see\n[applying access levels](/chrome-enterprise-premium/docs/access-levels#applying_an_access_level).\n\nOnce you've applied your access level, your resources are now secured with\nChrome Enterprise Premium.\n\nEnabling device trust and security with Endpoint Verification\n-------------------------------------------------------------\n\nTo further strengthen the security of your Chrome Enterprise Premium secured resources,\nyou can apply device-based trust and security access control attributes with\naccess levels.\n[Endpoint Verification](/chrome-enterprise-premium/docs/access-protection#Gathering-device-information)\nenables this control.\n\nEndpoint Verification is a Chrome extension for Windows, Mac, and Chrome OS devices.\n[Access Context Manager](/access-context-manager/docs/overview) references the device\nattributes gathered by Endpoint Verification to enforce fine grained access control with\n[access levels](/access-context-manager/docs/overview#access-levels).\n\nFollow the [Endpoint Verification quickstart](/endpoint-verification/docs/quickstart)\nto set up Endpoint Verification for your organization.\n\nWhat's next\n-----------\n\n- Set up [Cloud Audit Logs](/audit-logs)"]]
