Google Cloud Compliance ControlsGoogle Cloud VPC
Firewall rules for IAP-protected instances should allow only Google Cloud Load Balancer health check and proxy traffic
Access to VMs should be restricted by firewall rules that allow only IAP traffic by ensuring only connections proxied by the IAP are allowed. To ensure that load balancing works correctly health checks should also be allowed.
What this control checks
Firewall rules for IAP-protected instances allow only health check and proxy traffic
Framework mappings
The clauses this control is mapped to in each framework.
- 3.10 Ensure Firewall Rules for instances behind Identity Aware Proxy (IAP) only allow the traffic from Google Cloud Loadbalancer (GCLB) Health Check and Proxy Addresses
Related controls
- Firewall rules should allow TCP traffic only from Google IP ranges for Identity-Aware Proxy (IAP)
- Firewall rules should prohibit ingress from 0.0.0.0/0 to HTTP port 80
- Compute Engine instances should have 'Enable connecting to serial ports' disabled
- GKE clusters should have HTTP load balancing enabled
- Compute Engine target HTTPS proxies should use custom SSL policies
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_firewall_allow_connections_proxied_by_iap - Powerpipe Control:
gcp_compliance.control.compute_firewall_allow_connections_proxied_by_iap
Last reviewed: 2026-10-09