Firewall rules should allow TCP traffic only from Google IP ranges for Identity-Aware Proxy (IAP)
IAP authenticates the user requests to your apps via a Google single sign in. You can then manage these users with permissions to control access. Use both IAP permissions and firewalls to restrict access to apps with sensitive information.
IAP authenticates the user requests to your apps via a Google single sign in. It is recommended to use both IAP permissions and firewalls to restrict this access to your apps with sensitive information.
What this control checks
Firewall rules allowing tcp for IAP only accept traffic from Google IAP IP ranges
Common pitfalls
Health checks should also be allowed
To ensure that load balancing works correctly health checks should also be allowed.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe controls gcp_compliance.control.compute_firewall_allow_connections_proxied_by_iap and gcp_compliance.control.compute_firewall_allow_tcp_connections_proxied_by_iap.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to PR.IR-01 (Networks and environments are protected from unauthorized logical access and usage.).
Framework mappings
The clauses this control is mapped to in each framework.
- 3.10 Use Identity Aware Proxy (IAP) to Ensure Only Traffic From Google IP Addresses are 'Allowed'
- 3.10 Use Identity Aware Proxy (IAP) to Ensure Only Traffic From Google IP Addresses are 'Allowed'
- 3.10 Use Identity Aware Proxy (IAP) to Ensure Only Traffic From Google IP Addresses are 'Allowed'
- 3.10 Use Identity Aware Proxy (IAP) to Ensure Only Traffic From Google IP Addresses are 'Allowed'
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_firewall_allow_tcp_connections_proxied_by_iap - Powerpipe Controls:
gcp_compliance.control.compute_firewall_allow_connections_proxied_by_iap,gcp_compliance.control.compute_firewall_allow_tcp_connections_proxied_by_iap
Last reviewed: 2026-10-09