Google Cloud Compliance ControlsGoogle Cloud App Engine
App Engine applications should have IAP enabled
This control ensures that App Engine application IAP (Identity-Aware Proxy) is enabled. IAP is used to enforce access control policies for applications and resources. Activating IAP is a suggested practice for enhancing the security of your App Engine application.
What this control checks
App Engine applications should have Identity-Aware Proxy (IAP) enabled
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
app_engine_application_iap_enabled - Powerpipe Control:
gcp_compliance.control.app_engine_application_iap_enabled
Last reviewed: 2026-10-09