Core concept
Frontend for App Engine, Cloud Run, GCE via HTTP LB. TCP forwarding for SSH/RDP.
Advertisement
How it works
User must have IAM permission on IAP-secured resource. Federated with Google Workspace or Cloud Identity.
Advertisement
Trade-offs + gotchas
Internal apps behind IAP. SSH via IAP tunneling (no external IPs). BeyondCorp implementation.