Enabling IAP for Cloud Run

Stay organized with collections Save and categorize content based on your preferences.

Console

The Google-managed OAuth client is not available when enabling IAP using the Google Cloud console.

If you haven't configured your project's OAuth consent screen, you'll be prompted to do so. To configure your OAuth consent screen, see Setting up your OAuth consent screen.

Setting up IAP access

1. Go to the Identity-Aware Proxy page.
2. Select the project you want to secure with IAP.
3. Under APPLICATIONS, select the checkbox next to the load balancer backend service to which you want to add members.
4. On the right side panel, click Add Principal.

5. In the Add Principal dialog, enter the accounts of groups or individuals who should have the IAP-secured Web App User role for the project. The following kinds of accounts can be members:

   • Google Account: user@gmail.com - This can also be a Google Workspace account, such as user@google.com or some other workspace domain.
   • Google Group: admins@googlegroups.com
   • Service account: server@example.iam.gserviceaccount.com
   • Google Workspace domain: example.com

6. Select Cloud IAP > IAP-secured Web App User from the Roles drop-down list.

7. Click Save.

Turning on IAP

1. On the IAP page, under APPLICATIONS, find the load balancer backend service to which you want to restrict access. To turn on IAP for a resource, click the IAP toggle. To enable IAP:
   • At least one protocol in the load balancer frontend configuration must be HTTPS. Learn about setting up a load balancer.
   • You need the compute.backendServices.update, clientauthconfig.clients.create, and clientauthconfig.clients.getWithSecret permissions. These permissions are granted by roles, such as the Project Editor role. To learn more, see Managing access to IAP-secured resources.
2. In the Turn on IAP window that appears, click Turn On to confirm that you want IAP to secure your resource. After you turn on IAP, it requires login credentials for all connections to your load balancer. Only accounts with the IAP-Secured Web App User role on the project will be given access.

3. Follow the instructions at Access control with IAM to authorize IAP to send traffic to the backend Cloud Run service.

   • Principal: service-[PROJECT-NUMBER]@gcp-sa-iap.iam.gserviceaccount.com
   • Role: Cloud Run Invoker

   The IAP service account is created when IAP is enabled. If the IAP service account is not in the list of principals, you can create it by running the following gcloud command:

   gcloud beta services identity create
       --service=iap.googleapis.com
       --project=PROJECT_ID
   

gcloud

1. If you have not previously done so in the project, create the IAP service agent by running the following command. If you previously created the service agent, running the command does not duplicate it.

   gcloud beta services identity create --service=iap.googleapis.com --project=[PROJECT_ID]

2. Grant the invoker permission to the service account, created in the previous step, by running the following command.

   gcloud run services add-iam-policy-binding [SERVICE-NAME] \
   --member='serviceAccount:service-[PROJECT-NUMBER]@gcp-sa-iap.iam.gserviceaccount.com'  \
   --role='roles/run.invoker'
   

3. Enable IAP by running either the globally or regionally scoped command, depending on whether your load balancer backend service is global or regional. Use the OAuth client ID and secret from the previous step.

   Global scope

   gcloud compute backend-services update BACKEND_SERVICE_NAME --global --iap=enabled
   

   Regional scope

   gcloud compute backend-services update BACKEND_SERVICE_NAME --region REGION_NAME --iap=enabled
   

   Replace the following:
   • BACKEND_SERVICE_NAME: the name of the backend service.
   • REGION_NAME: the region in which you want to enable IAP.

After you enable IAP, you can use the Google Cloud CLI to manipulate an IAP access policy using the Identity and Access Management role roles/iap.httpsResourceAccessor. See Managing access to IAP-secured resources for more information.

terraform

1. If you have not previously done so, in a project, create the IAP service agent by running the following command. If you previously created the service agent, running the command does not duplicate it.

   resource "google_project_service" "project" {
     project = "your-project-id"
     service = "iap.googleapis.com"
   }
   

2. Grant the invoker permission to the service agent created in the previous step by running the following command.

   resource "google_cloud_run_service_iam_binding" "binding" {
     location = google_cloud_run_v2_service.default.location
     service  = google_cloud_run_v2_service.default.name
     role = "roles/invoker"
     members = [
       "serviceAccount:service-[PROJECT-NUMBER]@gcp-sa-iap.gserviceaccount.com",
     ]
   }
   

3. Enable IAP by running either the global or the regional command depending on your load balancer. Use the OAuth client ID and secret from the previous step.

   • Global scope

     resource "google_compute_backend_service" "default" {
       name                  = "tf-test-backend-service-external"
       protocol              = "HTTPS"
       load_balancing_scheme = "EXTERNAL_MANAGED"
       iap {
         enabled              = true
         oauth2_client_id     = "abc"
         oauth2_client_secret = "xyz"
       }
     }
     

   • Regional scope

     resource "google_compute_region_backend_service" "default" {
       name                  = "tf-test-backend-service-external"
       protocol              = "HTTPS"
       load_balancing_scheme = "EXTERNAL_MANAGED"
       iap {
         enabled              = true
         oauth2_client_id     = "abc"
         oauth2_client_secret = "xyz"
       }
     }