Google Cloud Compliance ControlsGoogle Cloud VPC
Firewall rules should allow TCP traffic only from Google IP ranges for Identity-Aware Proxy (IAP)
IAP authenticates the user requests to your apps via a Google single sign in. You can then manage these users with permissions to control access. Use both IAP permissions and firewalls to restrict access to apps with sensitive information.
What this control checks
Firewall rules allowing tcp for IAP only accept traffic from Google IAP IP ranges
Framework mappings
The clauses this control is mapped to in each framework.
- 3.10 Use Identity Aware Proxy (IAP) to Ensure Only Traffic From Google IP Addresses are 'Allowed'
- 3.10 Use Identity Aware Proxy (IAP) to Ensure Only Traffic From Google IP Addresses are 'Allowed'
- 3.10 Use Identity Aware Proxy (IAP) to Ensure Only Traffic From Google IP Addresses are 'Allowed'
- 3.10 Use Identity Aware Proxy (IAP) to Ensure Only Traffic From Google IP Addresses are 'Allowed'
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_firewall_allow_tcp_connections_proxied_by_iap - Powerpipe Controls:
gcp_compliance.control.compute_firewall_allow_connections_proxied_by_iap,gcp_compliance.control.compute_firewall_allow_tcp_connections_proxied_by_iap
Last reviewed: 2026-10-09