What is Google IAP (Identity-Aware Proxy)?

Identity-Aware Proxy (IAP) is Google Cloud's way of putting a login check in front of a resource instead of a firewall rule. It answers "who are you and are you allowed?" for every request or connection, so a web app or a VM never needs to be reachable from the public internet at all. It comes in two flavours — one for web apps, one for raw TCP connections such as SSH and RDP — and for Google Cloud-hosted resources it has no charge.

1. The idea: application-level access control

Google's own description: IAP "lets you establish a central authorization layer for applications accessed by HTTPS, so you can use an application-level access control model instead of relying on network-level firewalls."

The traditional model trusts a network location — an office IP range, a VPN address, a bastion host. IAP trusts an identity. A request only reaches your resource after Google has authenticated the person (Google Account, Workforce Identity Federation or Identity Platform) and checked that an IAM role allows them in. If the role is removed, the next request is refused — nothing to revoke on the client, no VPN credential to rotate.

This is the same model Google runs internally under the name BeyondCorp, offered as a managed service.

2. Two products under one name

	IAP for web apps	IAP TCP forwarding
Protects	HTTPS apps behind a load balancer — App Engine, Cloud Run, Compute Engine, GKE, on-prem via a connector	Any TCP port on a Compute Engine VM — SSH (22), RDP (3389), databases, anything
Role that grants access	`roles/iap.httpsResourceAccessor` (IAP-secured Web App User)	`roles/iap.tunnelResourceAccessor` (IAP-secured Tunnel User)
How the user connects	Browser — IAP shows a Google sign-in, sets a cookie, then forwards the request	A tunnel from `gcloud` (or a client that speaks the IAP tunnel protocol) to a local port; the app connects to `localhost`
Does the resource need a public IP?	The load balancer does; backends don't	No — the VM only needs an internal IP

The rest of this cluster is about the second flavour, because that is what removes bastion hosts and public RDP/SSH ports. See IAP TCP forwarding explained for the mechanics.

3. How a TCP-forwarded connection is authorised

Authentication. The client (normally gcloud) signs the user in with their Google identity.
Authorization. IAP checks that the identity holds roles/iap.tunnelResourceAccessor on the target — at project level, or on that one instance. Optional IAM conditions can narrow it further, for example destination.port == 22, or require a Context-Aware Access level (device policy, corporate network, and so on).
Forwarding. IAP connects to the VM's internal IPv4 address on nic0 from its own address range (35.235.240.0/20; 2600:2d00:1:7::/64 for IPv6). Your firewall only needs to allow that range on the port — nothing else on the internet can reach it.

Because the check is per connection and per identity, IAP access shows up in Cloud Audit Logs with the principal, caller IP and whether access was granted.

4. What it costs

Google's pricing page states that IAP's features for protecting Google Cloud-hosted resources are available at no charge; networking and compute charges apply where a load balancer is required (the web-app flavour), and some capabilities — such as proxying resources outside Google Cloud and certificate-based access — are paid features of Chrome Enterprise Premium. For TCP forwarding to a VM there is no load balancer, so the only costs are the VM itself and any network egress you already pay for.

5. When IAP is the right tool

You want RDP or SSH to VMs without a public IP, a bastion host or a VPN.
Access should be tied to named people or groups, revocable in one IAM change.
Contractors or an outsourced IT team need access to specific VMs only.
You already use Google Workspace, so identities exist and MFA is enforced there.

When it isn't: IAP TCP forwarding "isn't intended for bulk transfer of data", Google reserves the right to rate-limit abusive use, and idle sessions are disconnected after one hour. Large file moves belong on Cloud Storage or a VPN. Mobile devices can't call the TCP forwarding service.

Common questions

Is Google IAP a VPN?

No. A VPN puts your device on a private network; IAP grants a single identity access to a single resource, per connection, with nothing else on that network exposed. Many teams use IAP instead of a VPN for VM access.

No. IAP decides whether the tunnel may be opened. Windows still asks for a username and password over RDP, and Linux still checks your SSH key or OS Login identity.

Do I need Chrome Enterprise Premium?

Not for gating Google Cloud-hosted web apps or VMs. The paid tier adds things like certificate-based access and proxying on-premises apps.

Where can I see who connected?

In Logs Explorer, filter on protoPayload.serviceName="iap.googleapis.com" — see IAM roles and audit logs.