Identity-Aware Proxy (IAP) 是一种云原生替代方案，可取代传统 VPN，用于管理对 Cloud Run、App Engine、Compute Engine 和 GKE 中运行的应用的访问权限。
IAP 在应用级层验证身份并强制执行授权，从而消除了广泛的网络访问权限和基于边界的安全措施。系统会实时评估每个请求，确保只有经过身份验证的授权用户才能访问受保护的资源。
您可以使用用户身份、群组成员身份、设备安全性和位置或 IP 地址等情境信号来配置情境感知访问权限政策。与 VPN 不同，IAP 不需要客户端软件或网络隧道。
用户可以直接通过 Chrome 访问应用，而 IT 团队可以在一个地方集中定义和强制执行访问政策。
了解详情
获享 $300 免费赠金开始概念验证
-
体验 Gemini 2.0 Flash Thinking
-
免费使用热门产品（包括 AI API 和 BigQuery）的每月用量
-
不会自动收费，无需承诺
继续探索 20 多种提供“始终免费”用量的产品
使用适用于常见应用场景（包括 AI API、虚拟机、数据仓库等）的 20 多种免费产品。
培训
培训和教程
Google Cloud 中的安全性
了解 Google Cloud 安全控制措施和技术。探索 Google Cloud 组件并部署安全解决方案。了解如何缓解 Google Cloud 基础架构中多个方面的攻击，包括分布式拒绝服务攻击、网上诱骗攻击以及涉及内容分类和使用的威胁。
使用场景
使用场景
员工通过浏览器访问
用户通过浏览器登录来访问内部应用，例如人力资源门户和信息中心。访问权限与身份、角色和设备安全相关联，可确保最小权限访问，而不会暴露整个网络。
员工访问权限
零信任
安全性
使用场景
使用场景
控制供应商和承包商访问权限
让外部合作伙伴访问特定应用，而无需将其纳入您的网络。设置限时权限，您可以立即撤消这些权限，而无需更改防火墙。
供应商访问权限
第三方
安全性
使用场景
使用场景
没有开放网络端口的管理员访问权限
IAP 可确保对云虚拟机的 SSH 和 RDP 访问安全，而无需公开公共 IP。
通过安全的基于身份的访问权限，消除跳转主机、静态 SSH 密钥和长期有效的凭据。
管理员访问权限
SSH
安全性
如未另行说明，那么本页面中的内容已根据知识共享署名 4.0 许可获得了许可，并且代码示例已根据 Apache 2.0 许可获得了许可。有关详情，请参阅 Google 开发者网站政策。Java 是 Oracle 和/或其关联公司的注册商标。
最后更新时间 (UTC)：2025-08-18。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-18。"],[[["\u003cp\u003eIdentity-Aware Proxy (IAP) manages access to applications in various environments like App Engine, Compute Engine, and GKE.\u003c/p\u003e\n"],["\u003cp\u003eIAP creates a central authorization layer for applications accessed via HTTPS, enabling application-level access control rather than network-level firewalls.\u003c/p\u003e\n"],["\u003cp\u003eTurning on IAP requires the use of signed headers to ensure app security.\u003c/p\u003e\n"],["\u003cp\u003eA wide array of documentation can be found such as quickstarts, guides, reference and faqs, to help set up and maintain IAP.\u003c/p\u003e\n"]]],[],null,["# Identity-Aware Proxy documentation\n==================================\n\n[Read product documentation](/iap/docs/concepts-overview)\nIdentity-Aware Proxy (IAP) is a cloud-native alternative to\ntraditional VPNs that manages access to applications running in\nCloud Run, App Engine, Compute Engine, and\nGKE.\n\n\nIAP verifies identity and enforces authorization at the\napplication level, eliminating broad network access and perimeter-based\nsecurity. Every request is evaluated in real time, ensuring only authenticated,\nauthorized users can reach protected resources.\n\n\nYou can configure context-aware access policies using user identity, group\nmembership, device security, and contextual signals like location or IP address.\nUnlike VPNs, IAP requires no client software or network tunneling.\nUsers access applications directly through Chrome, while IT teams centrally\ndefine and enforce access policies in one place.\n\n\n[Learn more](/iap/docs/concepts-overview)\n[Get started for free](https://console.cloud.google.com/freetrial) \n\n#### Start your proof of concept with $300 in free credit\n\n- Get access to Gemini 2.0 Flash Thinking\n- Free monthly usage of popular products, including AI APIs and BigQuery\n- No automatic charges, no commitment \n[View free product offers](/free/docs/free-cloud-features#free-tier) \n\n#### Keep exploring with 20+ always-free products\n\n\nAccess 20+ free products for common use cases, including AI APIs, VMs, data warehouses,\nand more.\n\nDocumentation resources\n-----------------------\n\nFind quickstarts and guides, review key references, and get help with common issues. \nformat_list_numbered\n\n### Guides\n\n-\n\n [Cloud IAP conceptual overview](/iap/docs/concepts-overview)\n\n-\n\n [Authenticate users with Google Accounts](/iap/docs/authenticate-users-google-accounts)\n\n-\n\n [Use IAP for TCP forwarding](/iap/docs/using-tcp-forwarding)\n\n-\n\n [Set up programmatic authentication](/iap/docs/authentication-howto)\n\n-\n\n [Configure context-aware access](/iap/docs/cloud-iap-context-aware-access-howto)\n\n-\n\n [Enable IAP for App Engine](/iap/docs/enabling-app-engine)\n\n-\n\n [Enable IAP for Cloud Run](/run/docs/securing/identity-aware-proxy-cloud-run)\n\n-\n\n [Enable IAP for Compute Engine](/iap/docs/enabling-compute-howto)\n\n-\n\n [Manage access to IAP-secured resources](/iap/docs/managing-access)\n\n-\n\n [Secure your app with signed headers](/iap/docs/signed-headers-howto)\n\nfind_in_page\n\n### Reference\n\n-\n\n [Using the API for IAP with App Engine](/iap/docs/reference/app-engine-apis)\n\n-\n\n [Using the API for IAP with Compute Engine apps](/iap/docs/reference/compute-engine-apis)\n\n-\n\n [Cloud IAP for on-premises apps](/iap/docs/cloud-iap-for-on-prem-apps-overview)\n\n-\n\n [TCP forwarding overview](/iap/docs/tcp-forwarding-overview)\n\n-\n\n [IAP client libraries](/iap/docs/reference/libraries)\n\n-\n\n [REST API](/iap/docs/reference/rest)\n\n-\n\n [RPC API](/iap/docs/reference/rpc)\n\ninfo\n\n### Resources\n\n-\n\n [Frequently asked questions](/iap/docs/faq)\n\n-\n\n [Pricing](/iap/pricing)\n\n-\n\n [Release notes](/iap/docs/release-notes)\n\n-\n\n [Get support](/iap/docs/getting-support)\n\n-\n\n [Code samples](/iap/docs/samples)\n\nRelated resources\n-----------------\n\nTraining and tutorials \nUse cases \nExplore self-paced training, use cases, reference architectures, and code samples with examples of how to use and connect Google Cloud services. Training \nTraining and tutorials\n\n### Security in Google Cloud\n\n\nLearn about Google Cloud security controls and techniques. Explore\nGoogle Cloud components and deploy a secure solution. Learn to mitigate\nattacks at several points in a Google Cloud infrastructure, including\ndistributed denial-of-service attacks, phishing attacks, and threats\ninvolving content classification and use.\n\n\n[Learn more](/training/course/security-in-google-cloud-platform) \nUse case \nUse cases\n\n### Employee access through browsers\n\n\nUsers log in through a browser to access internal apps like HR portals\nand dashboards. Access ties to identity, role, and device security, ensuring\nleast-privilege access without network-wide exposure.\n\nEmployee Access Zero Trust Security\n\n\u003cbr /\u003e\n\n[Learn more](/iap/docs/concepts-overview) \nUse case \nUse cases\n\n### Controlled vendor and contractor access\n\n\nGive external partners access to specific apps without putting them on\nyour network. Set time-limited permissions that you can revoke instantly with\nno firewall changes required.\n\nVendor Access Third-Party Security\n\n\u003cbr /\u003e\n\n[Learn more](/iap/docs/managing-access) \nUse case \nUse cases\n\n### Admin access without open network ports\n\n\nIAP secures SSH and RDP access to cloud VMs without exposing public IPs.\nEliminate jump hosts, static SSH keys, and long-lived credentials with secure,\nidentity-based access.\n\nAdmin Access SSH Security\n\n\u003cbr /\u003e\n\n[Learn more](/iap/docs/using-tcp-forwarding)\n\nRelated videos\n--------------"]]
