Enabling IAP for Cloud Run

Console

The Google-managed OAuth client is not available when enabling IAP using the Google Cloud console.

If you haven't configured your project's OAuth consent screen, you'll be prompted to do so. To configure your OAuth consent screen, see Setting up your OAuth consent screen.

Setting up IAP access

1. Go to the Identity-Aware Proxy page.
2. Select the project you want to secure with IAP.
3. Under APPLICATIONS, select the checkbox next to the load balancer backend service to which you want to add members.
4. On the right side panel, click Add member.

5. In the Add members dialog, enter the accounts of groups or individuals who should have the IAP-secured Web App User role for the project. The following kinds of accounts can be members:

   • Google Account: user@gmail.com - This can also be a Google Workspace account, such as user@google.com or some other workspace domain.
   • Google Group: admins@googlegroups.com
   • Service account: server@example.iam.gserviceaccount.com
   • Google Workspace domain: example.com

6. Select Cloud IAP > IAP-secured Web App User from the Roles drop-down list.

7. Click Save.

Turning on IAP

1. On the IAP page, under APPLICATIONS, find the load balancer backend service to which you want to restrict access. To turn on IAP for a resource, click the IAP toggle. To enable IAP:
   • At least one protocol in the load balancer frontend configuration must be HTTPS. Learn about setting up a load balancer.
   • You need the compute.backendServices.update, clientauthconfig.clients.create, and clientauthconfig.clients.getWithSecret permissions. These permissions are granted by roles, such as the Project Editor role. To learn more, see Managing access to IAP-secured resources.
2. In the Turn on IAP window that appears, click Turn On to confirm that you want IAP to secure your resource. After you turn on IAP, it requires login credentials for all connections to your load balancer. Only accounts with the IAP-Secured Web App User role on the project will be given access.

3. Follow the instructions at Access control with IAM to authorize IAP to send traffic to the backend Cloud Run service.

   • Principal: service-[PROJECT-NUMBER]@gcp-sa-iap.iam.gserviceaccount.com
   • Role: Cloud Run Invoker

gcloud

1. If you have not previously done so, create a service account by running the following command. If you previously created a service account, running the command does not create duplicate service accounts.

   gcloud beta services identity create --service=iap.googleapis.com --project=[PROJECT_ID]

2. Grant the invoker permission to the service account, created in the previous step, by running the following command.

   gcloud run services add-iam-policy-binding [SERVICE-NAME] \
   --member='serviceAccount:service-[PROJECT-NUMBER]@gcp-sa-iap.iam.gserviceaccount.com'  \
   --role='roles/run.invoker'
   

3. Enable IAP by running either the globally or regionally scoped command, depending on whether your load balancer backend service is global or regional. Use the OAuth client ID and secret from the previous step.

   Global scope

   gcloud compute backend-services update BACKEND_SERVICE_NAME --global --iap=enabled
   

   Regional scope

   gcloud compute backend-services update BACKEND_SERVICE_NAME --region REGION_NAME --iap=enabled
   

   Replace the following:
   • BACKEND_SERVICE_NAME: the name of the backend service.
   • REGION_NAME: the region in which you want to enable IAP.

After you enable IAP, you can use the Google Cloud CLI to manipulate an IAP access policy using the Identity and Access Management role roles/iap.httpsResourceAccessor. See Managing roles and permissions for more information.