# Configuring Identity Aware Proxy With Google Iap

Configuring Google Cloud Identity-Aware Proxy (IAP) to enforce per-request identity...

- Repository: https://github.com/AgentFlocks/flocks (504 stars)
- Category: Engineering
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add AgentFlocks/flocks --skill configuring-identity-aware-proxy-with-google-iap -g -a claude-code -y`
Codex: `npx skills add AgentFlocks/flocks --skill configuring-identity-aware-proxy-with-google-iap -g -a codex -y`
Cursor: `npx skills add AgentFlocks/flocks --skill configuring-identity-aware-proxy-with-google-iap -g -a cursor -y`
Gemini CLI: `npx skills add AgentFlocks/flocks --skill configuring-identity-aware-proxy-with-google-iap -g -a gemini-cli -y`

## Description

Configuring Google Cloud Identity-Aware Proxy (IAP) to enforce per-request identity verification for Compute Engine, App Engine, Cloud Run, and GKE services using access levels, context-aware policies, and programmatic access with service accounts.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Configuring Identity-Aware Proxy with Google IAP

## When to Use

- When protecting Google Cloud applications (App Engine, Cloud Run, GKE, Compute Engine) with identity-based access
- When implementing context-aware access requiring device posture and location verification
- When providing secure access to internal tools without VPN or public IP exposure
- When needing per-request authentication and authorization for web applications and TCP services
- When configuring programmatic access to IAP-protected resources using service accounts

**Do not use** for non-HTTP applications that cannot be placed behind an HTTPS load balancer, for public-facing applications that need unauthenticated access, or when applications handle their own authentication and IAP would conflict with existing auth flows.

## Prerequisites

- Google Cloud project with billing enabled
- IAP API enabled (`gcloud services enable iap.googleapis.com`)
- Application deployed behind HTTPS Load Balancer, App Engine, or Cloud Run
- Cloud Identity or Google Workspace for user management
- Access Context Manager API enabled for access levels
- OAuth consent screen configured for the project

## Workflow

### Step 1: Enable IAP on Backend Services

Configure IAP for different GCP compute platforms.

```bash
# Enable required APIs
gcloud services enable iap.googleapis.com
gcloud services enable accesscontextmanager.googleapis.com

# Create OAuth consent screen
gcloud iap oauth-brands create \
  --application_title="Internal Applications" \
  --support_email=security@company.com

# Create OAuth client
gcloud iap oauth-clients create \
  projects/PROJECT_ID/brands/BRAND_ID \
  --display_name="IAP Web Client"

# === Enable IAP on Compute Engine Backend Service ===
gcloud compute backend-services update my-backend-service \
  --iap=enabled,oauth2-client-id=CLIENT_ID,oauth2-client-secret=CLIENT_SECRET \
  --global

The rest: https://github.com/AgentFlocks/flocks/blob/HEAD/.flocks/flockshub/plugins/skills/Anthropic-Cybersecurity-Skills/configuring-identity-aware-proxy-with-google-iap/SKILL.md