Firewall rules for IAP-protected instances should allow only Google Cloud Load Balancer health check and proxy traffic
Access to VMs should be restricted by firewall rules that allow only IAP traffic by ensuring only connections proxied by the IAP are allowed. To ensure that load balancing works correctly health checks should also be allowed.
Access to VMs should be restricted by firewall rules that allow only IAP traffic by ensuring only connections proxied by the IAP are allowed.
What this control checks
Firewall rules for IAP-protected instances allow only health check and proxy traffic
Common pitfalls
Health checks should also be allowed
To ensure that load balancing works correctly health checks should also be allowed.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.compute_firewall_allow_connections_proxied_by_iap.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to PR.IR-01 (Networks and environments are protected from unauthorized logical access and usage.).
Framework mappings
The clauses this control is mapped to in each framework.
- 3.10 Ensure Firewall Rules for instances behind Identity Aware Proxy (IAP) only allow the traffic from Google Cloud Loadbalancer (GCLB) Health Check and Proxy Addresses
Related controls
- Firewall rules should allow TCP traffic only from Google IP ranges for Identity-Aware Proxy (IAP)
- Firewall rules should prohibit ingress from 0.0.0.0/0 to HTTP port 80
- Compute Engine instances should have 'Enable connecting to serial ports' disabled
- GKE clusters should have HTTP load balancing enabled
- Compute Engine target HTTPS proxies should use custom SSL policies
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_firewall_allow_connections_proxied_by_iap - Powerpipe Control:
gcp_compliance.control.compute_firewall_allow_connections_proxied_by_iap
Last reviewed: 2026-10-09