A cloud engineer needs to configure network access for administrative maintenance on private Compute Engine instances in a custom VPC network. The instances do not have external IP addresses. The engineer wants to enable secure SSH access through Identity-Aware Proxy (IAP) TCP forwarding without exposing the instances to the public internet. Which two operational steps must be performed to meet these networking requirements?
- Create an ingress firewall rule in the VPC network allowing TCP traffic on port 22 from the source IP range 35.235.240.0/20.Answer
- Execute the command gcloud compute ssh specifying the --tunnel-through-iap flag when connecting to the VM instance.Answer
- CCreate an egress firewall rule allowing outbound TCP traffic on port 22 from the VM instances to destination IP range 35.235.240.0/20.
- DConfigure a Cloud NAT gateway in the subnet and set its public IP address as the source IP range in the ingress firewall rule.
Answer
To securely access private VM instances via IAP TCP forwarding, you must create an ingress firewall rule in the custom VPC allowing TCP port 22 from the IAP proxy CIDR range 35.235.240.0/20, and connect using gcloud compute ssh with the --tunnel-through-iap flag.
Enabling Identity-Aware Proxy (IAP) TCP forwarding requires allowing ingress TCP traffic on port 22 from Google's dedicated IAP range (35.235.240.0/20) into the VPC network. Additionally, connecting to a private VM without a public IP requires passing the --tunnel-through-iap flag to gcloud compute ssh.
Step-by-Step Solution
Key Concept
Identity-Aware Proxy (IAP) TCP Forwarding for VPC Network Management