iapc

iapc

Alternative client and Go library for Google Cloud's Identity-Aware Proxy. This is based on an implementation in gartnera/gcloud and the official gcloud source code. It aims to expose more functionality and have better performance. It's worth mentioning that the IAP speaks a slightly modified version of the SSH Relay v4 protocol documented here.

flowchart LR
    subgraph Client
        Client1[Client 1] --- IAPC
        Client2[Client 2] --- IAPC
    end
    subgraph Google Cloud
        IAPC -- WebSocket --> IAP(Identity-Aware Proxy)
        IAP --- Instance
        IAP --- HostIP["Host (requires BeyondCorp)"]
    end

Usage

The CLI needs to acquire Application Default Credentials (ADC) to authenticate with the proxy, so make sure you're logged in.

Here's an example of how to create a tunnel to an instance.

$ iapc to-instance prod-1 --project analog-figure-330721 --zone europe-west2-a

Here's an example of how to create a tunnel to a private IP or FQDN in a VPC. This requires BeyondCorp Enterprise and a TCP Destination Group.

$ iapc to-host 192.168.0.1 --project analog-figure-330721 --region europe-west2 --network prod --dest-group prod