Configure Identity-Aware Proxy for Cloud Run

Stay organized with collections Save and categorize content based on your preferences.

Console

To enable IAP from Cloud Run:

1. In the Google Cloud console, go to the Cloud Run page:

   Go to Cloud Run

2. If you are configuring a new service you are deploying to, select Deploy container > Service. If you are configuring and deploying an existing service, click the service, then click Edit and deploy new revision.

3. If you are configuring a new service, fill out the initial service settings page as needed, then select Advanced authentication with Identity Aware Proxy (IAP).

4. If you are configuring and deploying an existing service, click the service and then select Advanced authentication with Identity Aware Proxy (IAP).

5. Click Edit policy to create a context-aware access policy:

   • Add one or more principals and, optionally, the access level that each principal is required to satisfy for application access.

   • Click Save.

6. Click Save.

gcloud

To enable IAP directly from Cloud Run, add the --iap flag when deploying your app:

1. Deploy your Cloud Run service using one of the following commands:

   For a new service:

   gcloud beta run deploy SERVICE_NAME \
   --region=REGION \
   --image=IMAGE_URL \
   --no-allow-unauthenticated \
   --iap

   For an existing service:

   gcloud beta run services update SERVICE_NAME \
   --region=REGION \
   --iap

   Replace:

   • SERVICE_NAME with the name of your Cloud Run service.
   • REGION with the name of your Cloud Run region.
   • IMAGE_URL with a reference to the container image, for example, us-docker.pkg.dev/cloudrun/container/hello:latest. If you use Artifact Registry, the repository REPO_NAME must already be created. The URL has the shape LOCATION-docker.pkg.dev/PROJECT_ID/REPO_NAME/PATH:TAG

2. To verify that your service is configured with IAP enabled, run the following command:

   gcloud beta run services describe SERVICE_NAME \
     --region=REGION \
     --format=export

   The output should contain the following string:

   run.googleapis.com/iap-enabled: 'true'
   

You are now routing all traffic bound for the configured Cloud Run service to IAP for authentication before passing to the container.

Console

To disable IAP from Cloud Run:

1. In the Google Cloud console, go to the Cloud Run page:

   Go to Cloud Run

2. Click the existing service you want to modify.

3. Click Security and then clear Advanced authentication with Identity Aware Proxy (IAP).

4. Click Save.

gcloud

To disable IAP directly from Cloud Run, add the --no-iap flag when deploying your app:

1. Deploy your Cloud Run service using either of the following commands:

   For a new service:

   gcloud beta run deploy SERVICE_NAME \
   --region=REGION \
   --image=IMAGE_URL \
   --no-iap

   For an existing service:

   gcloud beta run services update SERVICE_NAME \
   --region=REGION \
   --no-iap

   Replace:

   • SERVICE_NAME with the name of your Cloud Run service.
   • REGION with the name of your Cloud Run region.
   • IMAGE_URL with a reference to the container image, for example, us-docker.pkg.dev/cloudrun/container/hello:latest. If you use Artifact Registry, the repository REPO_NAME must already be created. The URL has the shape LOCATION-docker.pkg.dev/PROJECT_ID/REPO_NAME/PATH:TAG

2. To verify that your service is no longer configured with IAP enabled, run the following command:

   gcloud beta run services describe SERVICE_NAME \
     --region=REGION \
     --format=export

   The output should contain the following string:

   run.googleapis.com/iap-enabled: 'false'
   

You are no longer routing all traffic bound for the configured Cloud Run service to IAP for authentication before passing to the container.

Console

To add or remove access:

1. In the Google Cloud console, go to the Cloud Run page:

   Go to Cloud Run

2. Click the existing service you want to modify, and then click Security.

3. Under IAP, click Edit policy.

4. To add access, enter the principal and, optionally, the access level or levels that you want to add.

5. To remove access from an existing principal, click the Delete policy icon next to Access levels.

6. Click Save.

gcloud

To add or remove access to a Cloud Run service for individual users or groups within your organization, run one of the following commands:

• To add access:

  gcloud beta iap web add-iam-policy-binding \
  --member=user:USER_EMAIL \
  --role=roles/iap.httpsResourceAccessor \
  --region=REGION \
  --resource-type=cloud-run \
  --service=SERVICE_NAME

• To remove access:

  gcloud beta iap web remove-iam-policy-binding \
  --member=user:USER_EMAIL \
  --role=roles/iap.httpsResourceAccessor \
  --region=REGION \
  --resource-type=cloud-run \
  --service=SERVICE_NAME

  Replace:

  • USER_EMAIL with the user's email address.
  • REGION with the name of your Cloud Run region.
  • SERVICE_NAME with the name of your Cloud Run service.