IP restriction in GCP Identity-Aware Proxy

[osk_thanhnt32]

Thanks for watching my question..

I'm working with Cloud IAP (Identity-Aware Proxy) to define a SSH tunnel to my GCE instance.
And to secure access by restricting IP addresses, I did following action

1. In IAP console in GCP, choose target GCE
2. Share that GCE to specific user, with role  [IAP-secured Tunnel User], and role condition is Access Level contain my IP Address.

It works OK when I shared a specific user (A) to IAP (with the role [IAP-secured Tunnel User], and condition is IP sets)
Because role has condition with IP restriction, so accessed IP will be checked when user use IAP to connect to GCE.

But when the user (B) has [Editor] role in project level, and because [Editor] role contains [IAP-secured Tunnel User] role,
So the user (B) can use IAP without IP restriction.
Even if I shared user (B) to specific IAP with IP restriction, the connection from user (B) will ignore because [Editor] role contains [IAP-secured Tunnel User] role.

My question is: With the user has high permission in project, how can I secure access to IAP from a specific IP sets.
I want to apply this rule (IP restriction when using IAP) to all user in the project.

[VishalBulbule · Accepted solution]

I think the Editor role does not contain the IAP-Secured Tunnel User role.

Verify below, that you replace it with your project id.

Check - https://console.cloud.google.com/iam-admin/roles/details/roles%3Ceditor?project=<your-project-id>

[osk_thanhnt32]

Thank you @VishalBulbule  for your reply.

May be it was my mistake(?)

I have re-checked and see that IAP-Secured Tunnel User only contains in Owner role.

So the user without owner role can be controlled to apply IP Restriction.

I think my question has been resolved. Thank you.