Cloud Run adds direct Identity-Aware Proxy integration

Google Cloud made direct Identity-Aware Proxy integration generally available for Cloud Run, according to its March 14 announcement. The change lets teams enable IAP on a service without first configuring a separate application load balancer for that integration.

Access protection moves closer to the service

The announcement also introduces a public-access setting compatible with Domain Restricted Sharing. These address different needs: IAP restricts access to an application, while the public-access option changes whether Cloud Run performs its IAM invoker check.

Engineers should keep those choices distinct in deployment reviews. Removing an invoker check is not equivalent to adding user authentication, and a reachable endpoint still needs the intended application-level permissions.

For internal tools, direct IAP can reduce the number of infrastructure components a team must provision simply to establish an access boundary. The important operational benefit is a simpler configuration to understand and maintain.

Verify every request path

A rollout should begin with an inventory of service endpoints, custom domains, load-balancer paths, and machine callers. Test the intended employee or partner sign-in path, then test a user without access and a request that arrives through an alternative route.

Browser preflight behavior also belongs in the test plan. A permitted preflight must not be mistaken for permission to execute the subsequent application request.

Separate the human access policy from service-to-service authorization. An integration that works for a browser may need a different identity path for scheduled jobs or backend callers.

The next step is a small internal service migration with a documented before-and-after request path. Keep the old configuration until the team has verified denial behavior and can explain where authentication and authorization occur.