Using Identity-Aware Proxy (IAP) for managing SSH access to private VMs ensures secure access control and avoids the need for public IPs. IAP allows you to enforce identity-based access control policies.
* Enable IAP: Ensure that IAP is enabled for your project. This can be done via the Google Cloud Console under "Security" -> "Identity-Aware Proxy".
* Set Up Firewall Rule: Create a firewall rule to allow SSH traffic from the IAP IP ranges.
* Navigate to "VPC network" -> "Firewall".
* Create a new rule allowing ingress traffic on port 22 (SSH) from the IAP IP ranges.
* Assign IAP-Secured Tunnel User Role: Grant the roles/iap.tunnelResourceAccessor role to the administrators who need SSH access.
* Go to "IAM & Admin" -> "IAM".
* Assign the IAP-Secured Tunnel User role to the relevant users or groups.
* SSH Using IAP: Administrators can now use IAP to SSH into the instances. This can be done using the gcloud command:
gcloud compute ssh [INSTANCE_NAME] --tunnel-through-iap
References:
* Using Identity-Aware Proxy for TCP forwarding
* Google Cloud Firewall Rules