Add optional IAP support to Cloud Run services.

[wlynch]

cc @jonjohnsonjr @imjasonh

[imjasonh]

Do you have an example of how this is used, both from the IAP config side, and from the app side to get the currently IAP'ed user's identity and/or token?

[wlynch]

https://cloud.google.com/iap/docs/enabling-cloud-run has good documentation on this.

This bit of terraform is really configuring the GCLB with the an oauth app's creds so IAP knows how to auth. presumably you could also tf gen this and pass it through.

There is an extra step where you need to grant the IAP SA cloud run invoker, but this can't easily be done within these modules:

resource "google_project_service" "iap" {
  project = var.project_id
  service = "iap.googleapis.com"

  timeouts {
    create = "30m"
    update = "40m"
  }

  disable_on_destroy = false
}

resource "google_project_service_identity" "iap_sa" {
  provider = google-beta

  project = var.project_id
  service = "iap.googleapis.com"
}

resource "google_cloud_run_service_iam_member" "invoker" {
  for_each   = module.networking.regional-networks
  depends_on = [google_project_service.iap]
  project    = var.project_id
  location   = each.key
  service    = var.name
  role       = "roles/run.invoker"
  member     = "serviceAccount:${google_project_service_identity.iap_sa.email}"
}

from there you can grant access by granting users to the IAP via https://cloud.google.com/iap/docs/managing-access#add_access

[wlynch]

On the app side, there a bunch of headers that IAP provides. a few useful ones;

• X-Goog-Authenticated-User-Email - authenticated user's email

• X-Goog-Iap-Jwt-Assertion - federated user oidc token

    {
        "aud": "/projects/123526589617/global/backendServices/842338515430489131",
        "azp": "/projects/123526589617/global/backendServices/842338515430489131",
        "email": "billy@chainguard.dev",
        "exp": 1719507640,
        "hd": "chainguard.dev",
        "iat": 1719507040,
        "identity_source": "GOOGLE",
        "iss": "https://cloud.google.com/iap",
        "sub": "accounts.google.com:104847474376810186341"
    }

• X-Serverless-Authorization - oidc token of IAP -> app

  {
  "aud": "/projects/123526589617/locations/us-east4/services/foo",
  "azp": "107617952505205565908",
  "email": "service-123526589617@gcp-sa-iap.iam.gserviceaccount.com",
  "email_verified": true,
  "exp": 1719436271,
  "iat": 1719432671,
  "iss": "https://accounts.google.com",
  "sub": "107617952505205565908"
  }