Allows you to authenticate user TCP traffic through IAP before sending it to your VM instances. And what’s more, this also works for private VM’s without an external IP address. So no need for VPN or a bastion host!

IAP for TCP forwarding

gcloud compute start-iap-tunnel VM_NAME VM_PORT [--local-host-port=LOCAL_HOST_PORT; default="localhost:0"] [--zone=ZONE] [GCLOUD_WIDE_FLAG …]

Example: to connect to VM catdcwebt1, starts a tunnel to Cloud IAP (Identity-Aware Proxy) for TCP forwarding RDP port 3389 on the VM and turned it to the localhost with port 1975

gcloud compute start-iap-tunnel catdcwebt1 3389 --local-host-port=localhost:1975

IAP Desktop

Easily way to connect to the VM by using RDP/SSH within a Desktop app. IAP Desktop uses Identity-Aware-Proxy (IAP) to connect to VM instances so that you can:

• Connect to VM instances that don’t have a public IP address
• Connect from anywhere over the internet

Together, IAP Desktop and Identity-Aware-Proxy (IAP) let you apply zero-trust security to your VMs:

• Apply fine-grained access controls that define who can access which VM
• Use access levels to restrict access by time or location
• Use BeycondCorp Enterprise to limit access to trusted devices

The application automatically manages IAP TCP tunnels for you, and protects them so that no other users or programs can access them.

• Use multiple Remote Desktop sessions at the same time
• Upload and download files over SFTP
• Automatically generate Windows credentials by using the Compute Engine guest agent environment
• Encrypt and store your Windows credentials locally
• Automatically create and publish SSH keys to OS Login or metadata
• Use OS Login 2-factor authentication
• Store our SSH keys locally using Windows CNG
• Connect to SQL Server and other server applications
• …

IAP Desktop is an open-source project developed and maintained by the Google Cloud Solutions Architects team. You can download here:
https://github.com/GoogleCloudPlatform/iap-desktop

2021/07/13 at 7:15 pm

Last modified on October 9th, 2024 at 7:27 pm

gcloud GCP