Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Halaman ini memandu Anda men-deploy aplikasi lingkungan standar atau fleksibel App Engine dan mengamankannya dengan Identity-Aware Proxy (IAP).
Panduan memulai menyertakan kode contoh untuk aplikasi web lingkungan standar App Engine yang memverifikasi nama pengguna yang login.
Jika Anda berencana menayangkan resource dari jaringan penayangan konten (CDN),
lihat panduan praktik terbaik untuk
mengetahui informasi penting.
Untuk mengaktifkan IAP untuk App Engine, Anda memerlukan hal berikut:
Project konsol Google Cloud dengan penagihan diaktifkan.
Jika Anda belum menyiapkan instance App Engine, lihat artikel Men-deploy App Engine untuk mengetahui panduan lengkap.
IAP menggunakan klien OAuth yang dikelola Google untuk mengautentikasi pengguna.
Hanya pengguna dalam organisasi yang dapat mengakses aplikasi yang mengaktifkan IAP.
Jika Anda ingin mengizinkan akses kepada pengguna di luar organisasi, lihat Mengaktifkan IAP untuk aplikasi eksternal.
Mengaktifkan IAP
Konsol
Klien OAuth yang dikelola Google tidak tersedia saat mengaktifkan IAP menggunakan Google Cloud konsol.
File penyertaan dinamis
Jika belum mengonfigurasi layar izin OAuth project, Anda akan diminta untuk melakukannya. Untuk mengonfigurasi layar izin OAuth, lihat Menyiapkan layar izin OAuth.
Pilih kotak centang di samping resource yang ingin Anda beri akses.
Di panel samping kanan, klik Tambahkan akun utama.
Di dialog Add principals yang muncul, masukkan alamat email grup atau individu yang harus memiliki peran IAP-secured Web App User untuk project tersebut.
Jenis akun utama berikut dapat memiliki peran ini:
Akun Google: user@gmail.com
Google Grup: admin@googlegroups.com
Akun layanan: server@example.
Domain Google Workspace: example.com
Pastikan untuk menambahkan Akun Google yang aksesnya Anda miliki.
Pilih Cloud IAP > IAP-Secured Web App User dari daftar drop-down
Roles.
Klik Save.
Mengaktifkan IAP
Di halaman Identity-Aware Proxy, pada bagian APPLICATIONS,
cari aplikasi yang aksesnya ingin Anda batasi. Untuk mengaktifkan IAP untuk resource,
alihkan tombol aktif/nonaktif di kolom IAP.
Di jendela Aktifkan IAP yang muncul, klik Aktifkan untuk mengonfirmasi bahwa Anda ingin IAP mengamankan resource Anda. Setelah Anda mengaktifkan IAP, kredensial login diperlukan untuk semua koneksi ke load balancer Anda.
Hanya akun dengan peran IAP-Secured Web App User di project yang akan diberikan akses.
gcloud
Sebelum menyiapkan project dan IAP, Anda memerlukan versi terbaru gcloud CLI. Untuk mengetahui petunjuk cara menginstal gcloud CLI, lihat Menginstal gcloud CLI.
Untuk mengautentikasi, gunakan Google Cloud CLI dan jalankan perintah berikut.
gcloud auth login
Klik URL yang muncul, lalu login.
Setelah Anda login, salin kode verifikasi yang muncul dan tempelkan di command line.
Jalankan perintah berikut untuk menentukan project yang berisi aplikasi yang ingin Anda lindungi dengan IAP.
gcloud config set project PROJECT_ID
Untuk mengaktifkan IAP, jalankan perintah berikut.
gcloud iap web enable --resource-type=app-engine --versions=version
Tambahkan akun utama yang harus memiliki peran pengguna Aplikasi Web yang diamankan IAP ke project.
Ganti PRINCIPAL_IDENTIFIER dengan akun utama yang diperlukan. Ini dapat berupa
jenis domain, grup, serviceAccount, atau pengguna. Misalnya,
user:myemail@example.com.
Setelah mengaktifkan IAP, Anda dapat menggunakan gcloud CLI untuk mengubah
kebijakan akses IAP menggunakan peran IAM
roles/iap.httpsResourceAccessor. Pelajari lebih lanjut cara mengelola peran dan izin.
API
Jalankan perintah berikut untuk menyiapkan file settings.json.
Setelah mengaktifkan IAP, Anda dapat menggunakan Google Cloud CLI untuk mengubah kebijakan akses IAP menggunakan peran IAM roles/iap.httpsResourceAccessor. Pelajari lebih lanjut cara mengelola peran dan izin.
Menguji autentikasi pengguna
Akses URL aplikasi dari Akun Google yang Anda tambahkan ke IAP dengan peran Pengguna Aplikasi Web yang Dilindungi IAP seperti yang dijelaskan di atas. Anda harus memiliki akses tak terbatas ke aplikasi.
Gunakan jendela samaran di Chrome untuk mengakses aplikasi, dan lakukan login saat
diminta. Jika Anda mencoba mengakses aplikasi dengan akun yang tidak memiliki otorisasi
dengan peran Pengguna Aplikasi Web yang Dilindungi IAP, Anda akan melihat pesan
yang menyatakan bahwa Anda tidak memiliki akses.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[],[],null,["# Securing App Engine apps with IAP\n\nThis page walks you through deploying an App Engine standard or flexible\nenvironment application and securing it with [Identity-Aware Proxy (IAP)](/iap/docs/concepts-overview).\nThe quickstart includes sample code for an App Engine standard\nenvironment web app that verifies a logged-in user's name.\n\nIf you plan to serve resources from a content delivery network (CDN),\nsee the [best practices guide](/iap/docs/concepts-best-practices#caching) for\nimportant information.\n\nTo secure resources not on Google Cloud, see\n[Securing on-premises apps and resources](/chrome-enterprise-premium/docs/securing-on-premises).\n\nBefore you begin\n----------------\n\nTo enable IAP for App Engine, you need the\nfollowing:\n\n- A Google Cloud console project with billing enabled.\n\nIf you don't have your App Engine instance set up already, see\n[Deploying App Engine](/build/docs/deploying-builds/deploy-appengine)\nfor a complete walkthrough.\n\nIAP uses a Google-managed OAuth client to authenticate users.\nOnly users within the organization can access the IAP-enabled application.\nIf you want to allow access to users outside of your organization, see [Enable IAP for external applications](/iap/docs/custom-oauth-configuration).\n| **Note:** The ability to authenticate users with a Google-managed OAuth client is available in [Preview](/products#product-launch-stages).\n\nEnabling IAP\n------------\n\n### Console\n\nThe Google-managed OAuth client is not available when enabling IAP using the Google Cloud console.\n\n\nDynamic include file\n\n\nIf you haven't configured your project's OAuth consent screen, you'll be\nprompted to do so. To configure your OAuth consent screen, see\n[Setting up your OAuth consent screen](https://support.google.com/cloud/answer/10311615).\n\n### Setting up IAP access\n\n1. Go to the [Identity-Aware Proxy page](https://console.cloud.google.com/security/iap). \n [Go to the Identity-Aware Proxy page](https://console.cloud.google.com/security/iap)\n2. Select the project you want to secure with IAP.\n3. Select the checkbox next to the resource you want to grant access to.\n4. On the right side panel, click **Add principal**.\n5. In the **Add principals** dialog that appears, enter the email addresses of groups or individuals who should have the **IAP-secured Web App User** role for the project.\n\n The following kinds of principals can have this role:\n - **Google Account**: user@gmail.com\n - **Google Group**: admins@googlegroups.com\n - **Service account**: server@example.gserviceaccount.com\n - **Google Workspace domain**: example.com\n\n Make sure to add a Google Account that you have access to.\n6. Select **Cloud IAP \\\u003e IAP-secured Web App User** from the **Roles** drop-down list.\n7. Click **Save**.\n\n### Turning on IAP\n\n1. On the **Identity-Aware Proxy** page, under **APPLICATIONS** , find the application you want to restrict access to. To turn on IAP for a resource, toggle the on/off switch in the **IAP** column. \n2. In the **Turn on IAP** window that appears, click **Turn On** to confirm that you want IAP to secure your resource. After you turn on IAP, it requires login credentials for all connections to your load balancer. Only accounts with the **IAP-Secured Web App User** role on the project will be given access.\n\n\u003cbr /\u003e\n\n### gcloud\n\nBefore you set up your project and IAP, you need an up-to-date version of the\ngcloud CLI. For instructions on how to install the gcloud CLI, see [Install the gcloud CLI](/sdk/downloads).\n\n1. To authenticate, use the Google Cloud CLI and run the following command. \n\n gcloud auth login\n\n2. Click the URL that appears and sign in.\n3. After you sign in, copy the verification code that appears and paste it in the command line.\n4. Run the following command to specify the project that contains the applications that you want to protect with IAP. \n\n gcloud config set project \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e\n\n5. To enable IAP, run the following command. \n\n gcloud iap web enable --resource-type=app-engine --versions=\u003cvar translate=\"no\"\u003eversion\u003c/var\u003e\n\n6. Add principals who should have the IAP-secured Web App user role to the project. \n\n gcloud projects add-iam-policy-binding \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e \\\n --member=\u003cvar translate=\"no\"\u003ePRINCIPAL_IDENTIFIER\u003c/var\u003e \\\n --role=roles/iap.httpsResourceAccessor\n\n - Replace \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e with your project ID.\n - Replace \u003cvar translate=\"no\"\u003ePRINCIPAL_IDENTIFIER\u003c/var\u003e with the necessary principals. This can be a type of domain, group, serviceAccount, or user. For example, `user:myemail@example.com`.\n\nAfter you enable IAP, you can use the gcloud CLI to modify the\nIAP access policy using the IAM role\n`roles/iap.httpsResourceAccessor`. Learn more about\n[managing roles and permissions](/iam/docs/granting-changing-revoking-access).\n\n### API\n\n1. Run the following command to prepare a `settings.json` file.\n\n ```\n cat \u003c\u003c EOF \u003e settings.json\n {\n \"iap\":\n {\n \"enabled\":true\n }\n }\n EOF\n ```\n\n \u003cbr /\u003e\n\n2. Run the following command to enable IAP.\n\n ```\n curl -X PATCH \\\n -H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n -H \"Accept: application/json\" \\\n -H \"Content-Type: application/json\" \\\n -d @settings.json \\\n \"https://appengine.googleapis.com/v1/apps/PROJECT_ID?updateMask=iap\"\n ```\n\n \u003cbr /\u003e\n\nAfter you enable IAP, you can use the Google Cloud CLI to modify the\nIAP access policy using the IAM role\n`roles/iap.httpsResourceAccessor`. Learn more about\n[managing roles and permissions](/iam/docs/granting-changing-revoking-access).\n| **Note:** When a App Engine application consists of multiple services, in order to make some services publicly-accessible and keep others restricted, enable IAP on the entire application, then grant the **IAP-secured Web App User** role to \\`allUsers\\` or \\`allAuthenticatedUsers\\` on the services that should be publicly-accessible.\n| **Role-based access:** If you're a project owner, you may think that you get automatic access to the app. That is not the case as only accounts with the **IAP-secured Web App User** role on this project will be given access. Imagine you're in corporate IT implementing IAP access to the HR payroll system. In most scenarios, only the staff on the Payroll team should have access to the app. This is one of the reasons why role-based access is more secure. The owner (or editor, etc.) of a project can manage all aspects of the project but doesn't automatically get app access.\n\nTest user authentication\n------------------------\n\n1. Access the app URL from a Google account that you added to\n IAP with the **IAP-secured Web App User** role\n as described above. You should have unrestricted access to the app.\n\n2. Use an incognito window in Chrome to access the app and sign in when\n prompted. If you try to access the app with an account that isn't authorized\n with the **IAP-secured Web App User** role, you'll see a message\n saying that you don't have access.\n\nNext steps\n----------\n\n- Set richer context rules by [applying access levels](/chrome-enterprise-premium/docs/access-levels).\n- See access requests by [enabling Cloud Audit Logs](/chrome-enterprise-premium/docs/audit-logs).\n- Learn more about [IAP](/iap/docs/concepts-overview).\n- Learn about [getting the user's identity](/iap/docs/identity-howto) and develop your own [App Engine](/appengine) app."]]
