Reach Google Cloud VMs with no public IP

Identity-Aware Proxy tunnels SSH to a Compute Engine instance that has no internet-facing address at all. There is no open port to find, and no key stored on the phone.

Why this is the interesting case

The strongest thing you can do for a server's security is not give it a public address. That normally makes it unreachable from a phone without a VPN. IAP solves it from the other direction: Google's proxy reaches the instance from inside its own network, and authorises you by IAM identity rather than by network location.

How a connection goes

1. The app mints a short-lived access token from your service account key.
2. It generates a throwaway SSH keypair.
3. It publishes the public half through OS Login, valid for a few minutes.
4. It opens the IAP tunnel and connects through it.

All four happen per connection. Nothing is cached: the key is valid for minutes by design, and a stale copy of any of these fails in ways that are hard to read.

The username is decided for you

OS Login derives a POSIX username from the IAM identity, so a service account becomes something like sa_109377…. Nobody would guess that and everybody would mistype it, so the app reads it back from Google's response and uses it. Leave the username field blank.

Permissions it needs

Two roles on the project, neither of which allows changing, stopping or reading the instance:

roles/iap.tunnelResourceAccessor
roles/compute.osLogin

Setup guide, including Terraform for a test environment.