Setting up IAP for Compute Engine

This guide describes how to set up a Compute Engine instance with Identity-Aware Proxy (IAP). If you already have your Compute Engine instance set up and only need to enable IAP, see Enabling IAP for Compute Engine.

Objectives

In this tutorial, you learn about the following:

  • Creating a Compute Engine instance template and managed instance group (MIG).
  • Getting a domain name and certificate.
  • Creating an HTTPS load balancer with a certificate.
  • Enabling IAP.
  • Testing that IAP is working.

Costs

This tutorial uses billable components of Google Cloud, including the following:

  • Compute Engine
    • 4 Virtual Machines (VMs)
  • Networking
    • Global Load Balancer Forwarding Rule
    • Ingress Traffic

For a cost estimate based on projected usage, see this Pricing Calculator.

New Cloud Platform users might be eligible for a free trial.

Before you begin

Before you start this tutorial, you need the following:

  1. Select or create a Google Cloud project.
    GO TO THE PROJECTS PAGE

  2. Enable billing for your project. Read about how to Modify a project's billing settings

Step 1: Create a Compute Engine template

In the Google Cloud console, go to the Compute Engine > Create an instance template page and select the project where you want to create a template.

GO TO THE CREATE AN INSTANCE TEMPLATE PAGE

Use the default values except for the following:

  • Machine type:
    • micro (f1-micro)
  • Access scopes:
    • Set access for each API
    • Compute Engine: Read Only
  • Firewall:
    • Allow HTTP traffic
  • In the Management section, under Automation > Startup script, copy and paste the following script: 
    # Copyright 2021 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software