Identity-Aware Proxy 說明文件
Identity-Aware Proxy (IAP) 是傳統 VPN 的雲端原生替代方案，可管理在 Cloud Run、App Engine、Compute Engine 和 GKE 中執行的應用程式存取權。
IAP 會在應用程式層級驗證身分並強制執行授權，因此不必開放廣泛的網路存取權，也不必採用以周邊防禦為基礎的安全性措施。系統會即時評估每項要求，確保只有通過驗證且獲得授權的使用者，才能存取受保護的資源。
您可以根據使用者身分、群組成員資格、裝置安全性，以及位置或 IP 位址等情境信號，設定情境感知存取權政策。與 VPN 不同，IAP 不需要用戶端軟體或網路通道。使用者可直接透過 Chrome 存取應用程式，IT 團隊則可集中定義及強制執行存取政策。
瞭解詳情
使用價值 $300 美元的免費抵免額，開始進行概念驗證
-
取得 Gemini 2.0 Flash Thinking 的存取權
-
每月免費使用 AI API 和 BigQuery 等熱門產品
-
不會自動收費，也不會要求您一定要購買特定方案
繼續探索超過 20 項一律免費的產品
使用超過 20 項實用的免費產品，包括 AI API、VM 和 data warehouse 等。
訓練
訓練與教學課程
Google Cloud 的安全性
瞭解 Google Cloud 安全性控管機制和相關技術。探索 Google Cloud 元件，並部署安全解決方案。學習如何防範 Google Cloud 基礎架構中多個環節的攻擊，包括分散式阻斷服務攻擊、網路釣魚攻擊，以及與內容分類和使用相關的威脅。
用途
用途
員工透過瀏覽器存取
使用者透過瀏覽器登入，存取人力資源入口網站和資訊主頁等內部應用程式。存取權與身分、角色和裝置安全性相關聯，可確保最低權限存取權，且不會暴露整個網路。
員工存取權
零信任
安全性
用途
用途
控管供應商和承包商的存取權
讓外部合作夥伴存取特定應用程式，不必將他們納入您的網路。設定限時權限，並立即撤銷，不必變更防火牆。
供應商存取權
第三方
安全性
用途
用途
不開放網路連接埠的管理員存取權
IAP 可保護雲端 VM 的 SSH 和 RDP 存取權，且不會公開 IP 位址。透過安全的身分式存取權，淘汰跳躍主機、靜態 SSH 金鑰和長期有效的憑證。
管理員存取權
SSH
安全性
除非另有註明，否則本頁面中的內容是採用創用 CC 姓名標示 4.0 授權，程式碼範例則為阿帕契 2.0 授權。詳情請參閱《Google Developers 網站政策》。Java 是 Oracle 和/或其關聯企業的註冊商標。
上次更新時間：2025-09-04 (世界標準時間)。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eIdentity-Aware Proxy (IAP) manages access to applications in various environments like App Engine, Compute Engine, and GKE.\u003c/p\u003e\n"],["\u003cp\u003eIAP creates a central authorization layer for applications accessed via HTTPS, enabling application-level access control rather than network-level firewalls.\u003c/p\u003e\n"],["\u003cp\u003eTurning on IAP requires the use of signed headers to ensure app security.\u003c/p\u003e\n"],["\u003cp\u003eA wide array of documentation can be found such as quickstarts, guides, reference and faqs, to help set up and maintain IAP.\u003c/p\u003e\n"]]],[],null,["# Identity-Aware Proxy documentation\n==================================\n\n[Read product documentation](/iap/docs/concepts-overview)\nIdentity-Aware Proxy (IAP) is a cloud-native alternative to\ntraditional VPNs that manages access to applications running in\nCloud Run, App Engine, Compute Engine, and\nGKE.\n\n\nIAP verifies identity and enforces authorization at the\napplication level, eliminating broad network access and perimeter-based\nsecurity. Every request is evaluated in real time, ensuring only authenticated,\nauthorized users can reach protected resources.\n\n\nYou can configure context-aware access policies using user identity, group\nmembership, device security, and contextual signals like location or IP address.\nUnlike VPNs, IAP requires no client software or network tunneling.\nUsers access applications directly through Chrome, while IT teams centrally\ndefine and enforce access policies in one place.\n\n\n[Learn more](/iap/docs/concepts-overview)\n[Get started for free](https://console.cloud.google.com/freetrial) \n\n#### Start your proof of concept with $300 in free credit\n\n- Get access to Gemini 2.0 Flash Thinking\n- Free monthly usage of popular products, including AI APIs and BigQuery\n- No automatic charges, no commitment \n[View free product offers](/free/docs/free-cloud-features#free-tier) \n\n#### Keep exploring with 20+ always-free products\n\n\nAccess 20+ free products for common use cases, including AI APIs, VMs, data warehouses,\nand more.\n\nDocumentation resources\n-----------------------\n\nFind quickstarts and guides, review key references, and get help with common issues. \nformat_list_numbered\n\n### Guides\n\n-\n\n [Cloud IAP conceptual overview](/iap/docs/concepts-overview)\n\n-\n\n [Authenticate users with Google Accounts](/iap/docs/authenticate-users-google-accounts)\n\n-\n\n [Use IAP for TCP forwarding](/iap/docs/using-tcp-forwarding)\n\n-\n\n [Set up programmatic authentication](/iap/docs/authentication-howto)\n\n-\n\n [Configure context-aware access](/iap/docs/cloud-iap-context-aware-access-howto)\n\n-\n\n [Enable IAP for App Engine](/iap/docs/enabling-app-engine)\n\n-\n\n [Enable IAP for Cloud Run](/run/docs/securing/identity-aware-proxy-cloud-run)\n\n-\n\n [Enable IAP for Compute Engine](/iap/docs/enabling-compute-howto)\n\n-\n\n [Manage access to IAP-secured resources](/iap/docs/managing-access)\n\n-\n\n [Secure your app with signed headers](/iap/docs/signed-headers-howto)\n\nfind_in_page\n\n### Reference\n\n-\n\n [Using the API for IAP with App Engine](/iap/docs/reference/app-engine-apis)\n\n-\n\n [Using the API for IAP with Compute Engine apps](/iap/docs/reference/compute-engine-apis)\n\n-\n\n [Cloud IAP for on-premises apps](/iap/docs/cloud-iap-for-on-prem-apps-overview)\n\n-\n\n [TCP forwarding overview](/iap/docs/tcp-forwarding-overview)\n\n-\n\n [IAP client libraries](/iap/docs/reference/libraries)\n\n-\n\n [REST API](/iap/docs/reference/rest)\n\n-\n\n [RPC API](/iap/docs/reference/rpc)\n\ninfo\n\n### Resources\n\n-\n\n [Frequently asked questions](/iap/docs/faq)\n\n-\n\n [Pricing](/iap/pricing)\n\n-\n\n [Release notes](/iap/docs/release-notes)\n\n-\n\n [Get support](/iap/docs/getting-support)\n\n-\n\n [Code samples](/iap/docs/samples)\n\nRelated resources\n-----------------\n\nTraining and tutorials \nUse cases \nExplore self-paced training, use cases, reference architectures, and code samples with examples of how to use and connect Google Cloud services. Training \nTraining and tutorials\n\n### Security in Google Cloud\n\n\nLearn about Google Cloud security controls and techniques. Explore\nGoogle Cloud components and deploy a secure solution. Learn to mitigate\nattacks at several points in a Google Cloud infrastructure, including\ndistributed denial-of-service attacks, phishing attacks, and threats\ninvolving content classification and use.\n\n\n[Learn more](/training/course/security-in-google-cloud-platform) \nUse case \nUse cases\n\n### Employee access through browsers\n\n\nUsers log in through a browser to access internal apps like HR portals\nand dashboards. Access ties to identity, role, and device security, ensuring\nleast-privilege access without network-wide exposure.\n\nEmployee Access Zero Trust Security\n\n\u003cbr /\u003e\n\n[Learn more](/iap/docs/concepts-overview) \nUse case \nUse cases\n\n### Controlled vendor and contractor access\n\n\nGive external partners access to specific apps without putting them on\nyour network. Set time-limited permissions that you can revoke instantly with\nno firewall changes required.\n\nVendor Access Third-Party Security\n\n\u003cbr /\u003e\n\n[Learn more](/iap/docs/managing-access) \nUse case \nUse cases\n\n### Admin access without open network ports\n\n\nIAP secures SSH and RDP access to cloud VMs without exposing public IPs.\nEliminate jump hosts, static SSH keys, and long-lived credentials with secure,\nidentity-based access.\n\nAdmin Access SSH Security\n\n\u003cbr /\u003e\n\n[Learn more](/iap/docs/using-tcp-forwarding)\n\nRelated videos\n--------------"]]
