# 3.10 Use Identity-Aware Proxy (IAP) to Restrict Access to Google IP Addresses Only (Manual) - Source: https://support.icompaas.com/support/solutions/articles/62000233014-3-10-use-identity-aware-proxy-iap-to-restrict-access-to-google-ip-addresses-only-manual- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ### Profile Applicability: Level 2 ### Description: Identity-Aware Proxy (IAP) authenticates user requests to applications using Google Single Sign-On (SSO). You can manage user access permissions and restrict application access using both IAP and firewall rules. It is recommended to configure firewalls to allow traffic only from Google-managed IP ranges to secure apps containing sensitive information. ### Rationale: IAP protects virtual machines (VMs) by ensuring that only authenticated requests can access applications. Without proper firewall rules, unauthenticated traffic can reach apps, increasing the risk of unauthorized access. Configuring firewalls to allow traffic exclusively from Google-managed IAP IP ranges mitigates these risks. Proper firewall settings ensure the security of sensitive applications while maintaining functionality. ### Impact: Improper firewall configuration may disrupt legitimate business services. Changes should be implemented during low-usage periods to minimize potential impact. ### Default Value: By default, GCP allows all incoming traffic unless restricted by firewall rules. ### Audit Steps: #### From Google Cloud Console: 1. For each app with IAP enabled: - Navigate to VPC Network > Firewall Rules.                           ![](https://support.icompaas.com/assets/kb/c487e901d9ed3027.png) ![](https://support.icompaas.com/assets/kb/6bffccc67ff3edd1.png) 2. Ensure firewall rules include the following values: - Targets: All instances in the network. - Source IP ranges: - IAP Proxy Addresses: 35.235.240.0/20. - Google Health Check: 130.211.0.0/22. - Google Health Check: 35.191.0.0/16. - Protocols and Ports: - Specify protocols and ports required for app access, such as: - TCP:80 (Default HTTP Health Check port). - TCP:443 (Default HTTPS Health Check port).                                 ![](https://support.icompaas.com/assets/kb/13ab170347196050.png) #### From Google Cloud CLI: List all firewall rules: gcloud compute firewall-rules list 1. Verify firewall rules match the following criteria: - Target Tags or Network: Include all relevant instances. - Source Ranges: - 35.235.240.0/20 - 130.211.0.0/22 - 35.191.0.0/16 - Allowed Protocols and Ports: - TCP:80, TCP:443. - Delete any rules that allow broader or insecure access. ### Remediation Steps: #### From Google Cloud Console: 1. Go to VPC Network > Firewall Rules.                        ![](https://support.icompaas.com/assets/kb/5132e31d39eaff05.png) 2. Identify and delete insecure default rules (e.g., default-allow-http, default-allow-https, default-allow-internal).            ![](https://support.icompaas.com/assets/kb/11ff9314b75c93fc.png) 3. Create a new firewall rule with the following values:                       ![](https://support.icompaas.com/assets/kb/12ea455465409fe6.png) - Name: allow-iap-traffic - Targets: All instances in the network. - Source IP Ranges: - 35.235.240.0/20 (IAP Proxy Addresses). - 130.211.0.0/22 (Google Health Check). - 35.191.0.0/16 (Google Health Check). - Protocols and Ports: - TCP:80 (HTTP). - TCP:443 (HTTPS). - Add any custom ports used by your load balancers.                      ![](https://support.icompaas.com/assets/kb/141c0d0f835bc80e.png) 4. Click Create to apply the changes.                      ![](https://support.icompaas.com/assets/kb/80397e74132eea26.png) #### From Google Cloud CLI: Delete default rules that allow insecure access: gcloud compute firewall-rules delete default-allow-http default-allow-https default-allow-internal Create a new firewall rule for IAP traffic: gcloud compute firewall-rules create allow-iap-traffic \\ --direction=INGRESS \\ --action=ALLOW \\ --rules=tcp:80,tcp:443 \\ --source-ranges=35.235.240.0/20,130.211.0.0/22,35.191.0.0/16 \\ --target-tags=all-instances ### References: 1. [IAP Overview](https://cloud.google.com/iap/docs/concepts-overview) 2. [Configuring IAP with Load Balancers](https://cloud.google.com/iap/docs/load-balancer-howto) 3. [GCP Health Checks](https://cloud.google.com/load-balancing/docs/health-checks) ### CIS Controls:

Control

Description

IG 1

IG 2

IG 3

5.6 Centralize Account Management

Centralize user account management through identity services.

✅

✅


16.2 Configure Centralized Authentication

Ensure all authentication is managed through centralized points.

✅

✅


## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.