Google Cloud Compliance ControlsGoogle Cloud Load Balancing
Compute Engine external backend services should have IAP enabled
This control ensures that an external backend service has IAP enabled. The powerpipe check is titled "Ensure external backend service has IAP enabled" and evaluates whether Identity-Aware Proxy is turned on for each such backend service.
What this control checks
Identity-Aware Proxy (IAP) status on external Compute Engine backend services
Related controls
- Firewall rules without specific targets should prohibit ingress from 0.0.0.0/0 to any port
- Firewall rules should prohibit unrestricted SSH access from the internet
- Firewall rules should prohibit unrestricted TCP/UDP access from the internet to all ports
- VPC subnets should have Private Google Access enabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_external_backend_service_iap_enabled - Powerpipe Control:
gcp_compliance.control.compute_external_backend_service_iap_enabled
Last reviewed: 2026-10-09