.. /GCP IAP TCP Forwarding
Star

Access
Shell Access

Identity-Aware Proxy (IAP) TCP forwarding in Google Cloud tunnels SSH, RDP or arbitrary TCP connections to VMs through Google’s endpoints, without public IPs on the target. With the right IAM permissions it can be used as an access path that is difficult to distinguish from administration.

Paths:

Resources:

Detections:

Access

  1. Opens a local listener that forwards to the given port on the instance over IAP.

    gcloud compute start-iap-tunnel <INSTANCE> <PORT> --local-host-port=localhost:<LOCAL_PORT> --zone=<ZONE>
    Use case
    Reaching internal VMs and services that have no external IP.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS

Shell Access

  1. SSH to an instance through IAP.

    gcloud compute ssh <INSTANCE> --tunnel-through-iap --zone=<ZONE>
    Use case
    Shell access to private instances.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS