How to Secure App Engine Using Identity-Aware Proxy

Identity-aware proxy lets you establish a central authorization layer for applications accessed by HTTPS, so you can use an application-level access control model instead of relying on network-level firewalls. IAP policies scale across your organization. You can define access policies centrally and apply them to all your applications and resources. When you assign a dedicated team to create and enforce policies, you protect your project from incorrect policy definition or implementation in any application. When to use IAP? Use IAP when you want to enforce access control policies for applications and resources. IAP works with signed headers or the App Engine standard environment Users API to secure your app.  With IAP, you can set up group-based application access: a resource could be accessible for employees and inaccessible for contractors, or only accessible to a specific department. How IAP works? When an application or resource is protected by IAP, it can only be accessed through the proxy by members, also known as users, who have the correct Cloud Identity and Access Management role. When you grant user access to an application or resource by IAP, they are subject to the fine-grained access controls implemented by the product in use without requiring a VPN.  When a user tries to access an IAP-secured resource, IAP performs authentication and authorization checks.