# How to Configure Identity-Aware Proxy (IAP) for Google Compute Engine VMs
Securing administrative access to cloud infrastructure is a critical priority. Historically, administrators relied on Virtual Private Networks (VPNs) or exposed Bastion hosts (jump servers) to connect to internal virtual machines. Both methods carry significant management overhead and security risks if compromised.
Google Cloud’s **Identity-Aware Proxy (IAP)** offers a modern, Zero-Trust alternative. IAP acts as a central authentication and authorization layer, verifying user identity and context (like device security status) before granting access to applications or VMs.
By using IAP for TCP forwarding, administrators can establish secure SSH or RDP connections to Compute Engine instances *without* assigning those instances public IP addresses, and without deploying a VPN.
This guide details the workflow for configuring IAP to securely SSH into a private Linux VM on Google Cloud Platform (GCP).
## Prerequisites
Before configuring IAP, ensure you have:
1. A **Google Cloud Project** with billing enabled.
2. The **Google Cloud CLI (`gcloud`)** installed and authenticated on your local machine.
3. The necessary IAM permissions (`Owner`, `Editor`, or specific IAM roles like `IAP Policy Admin` and `Compute Admin`).
## Step 1: Create a Private Compute Engine Instance
To demonstrate the power of IAP, we must first deploy a VM that has no route from the public internet.
1. Navigate to **Compute Engine > VM instances** in the GCP Console.
2. Click **Create Instance**.
3. Name the instance (e.g., `private-iap-test`).
4. Select a preferred Region and Zone.
5. In the **Advanced options > Networking** section, locate the **Network interfaces** card.
6. Click the default interface to edit it.
7. Change the **External IPv4 address** dropdown from `Ephemeral` to **None**.
8. Click **Create**.
Your VM is now running, but it is completely inaccessible from the outside world because it lacks a public IP.
## Step 2: Configure the IAP Firewall Rule
While IAP intercepts the traffic at Google’s edge, that traffic must still be allowed to travel from the IAP infrastructure into your Virtual Private Cloud (VPC) network.
Google’s IAP infrastructure operates from a specific, hardcoded IP range: `35.235.240.0/20`. You must create a firewall rule allowing TCP ingress from this range to your VMs.
1. Navigate to **VPC network > Firewall** in the GCP Console.
2. Click **Create Firewall Rule**.
3. **Name:** `allow-ingress-from-iap`
4. **Network:** default (or your custom VPC).
5. **Direction of traffic:** Ingress.
6. **Action on match:** Allow.
7. **Targets:** All instances in the network (or use target tags to restrict it to specific VMs).
8. **Source filter:** IPv4 ranges.
9. **Source IPv4 ranges:** `35.235.240.0/20`
10. **Protocols and ports:** Check **TCP** and enter `22` (for SSH) or `3389` (for RDP if connecting to Windows).
11. Click **Create**.
## Step 3: Grant IAM Permissions for IAP
Simply turning on IAP does not grant everyone access. You must explicitly authorize users to use the IAP TCP forwarding service.
1. Navigate to **Security > Identity-Aware Proxy** in the GCP Console.
2. If prompted, enable the IAP API.
3. Click on the **SSH and TCP Resources** tab.
4. You will see a list of your VM instances, including `private-iap-test`.
5. Check the box next to `private-iap-test`.
6. An information panel will slide out on the right. Click **Add Principal**.
7. Enter the email address of the user (or Google Group) you want to grant access to.
8. In the **Role** dropdown, select **Cloud IAP > IAP-secured Tunnel User**.
9. Click **Save**.
*Note: The user must also have the `roles/compute.instanceAdmin.v1` (or sufficient OS Login permissions) to actually authenticate with the guest operating system. The `IAP-secured Tunnel User` role only grants permission to use the tunnel itself.*
## Step 4: Connect to the Private VM via IAP
With the firewall rule in place and permissions granted, you can now connect to the private VM directly from your local machine.
Open your local terminal and run the following command using the `gcloud` CLI:
“`bash
gcloud compute ssh private-iap-test \
–zone=us-central1-a \
–tunnel-through-iap
“`
*(Ensure you change the zone to match where you deployed your VM).*
### What happens behind the scenes?
1. The `gcloud` tool authenticates your Google identity.
2. It verifies you hold the `IAP-secured Tunnel User` role.
3. It generates an ephemeral SSH key pair and uses Google’s OS Login metadata to push the public key to the VM.
4. It wraps your SSH traffic inside a secure WebSocket connection and sends it to the IAP endpoint.
5. IAP unwraps the traffic, verifies it, and forwards it to port 22 on your private VM using the internal IP.
You will see the familiar SSH prompt. You are now securely logged into a private server without using a VPN or a public IP address.
## Summary
By leveraging Identity-Aware Proxy for TCP forwarding, organizations can drastically reduce their external attack surface. It eliminates the cost and complexity of managing VPN appliances and bastion hosts while shifting access control to Google’s robust, identity-centric authorization engine.