--- title: GCP IAP Tunnelling on Ansible with Dynamic Inventory description: There's a great feature in GCP that you can use to connect instances and/or apps in the private network without installing a VPN solution. In this blog post, I'll go through every step of the configuration with detailed explanations. image: https://www.bionconsulting.com/hubfs/gcp_iap_tunnelling_on_ansible_with_dynamic_inventory_1x.webp --- [![bion-logo-122x40](https://www.bionconsulting.com/hubfs/bion-logo-122x40.png)](https://www.bionconsulting.com) - [Home](https://www.bionconsulting.com) - Services - DevOps - [DevOps as a Service](https://www.bionconsulting.com/devops-as-a-service) - [DevOps Services](https://www.bionconsulting.com/services/devops/devops-services) - [AWS DevOps Consulting](https://www.bionconsulting.com/services/devops/aws-devops-consulting) - DevSecOps - [DevSecOps Consulting](https://www.bionconsulting.com/services/devsecops) - [DevSecOps Assessment](https://www.bionconsulting.com/services/devsecops-assessment) - [Software Supply Chain Security](https://www.bionconsulting.com/partnerships/anchore) - Kubernetes - [Kubernetes Consulting](https://www.bionconsulting.com/services/kubernetes/kubernetes-consulting-services) - [Kubernetes Security](https://www.bionconsulting.com/services/kubernetes/security) - [Kubernetes Managed Services](https://www.bionconsulting.com/services/kubernetes/managed-services) - [Kubernetes Migration Services](https://www.bionconsulting.com/services/kubernetes/migration-services) - [Kubernetes Training](https://www.bionconsulting.com/services/kubernetes/training) - AWS - [AWS Security Assessment](https://www.bionconsulting.com/services/aws/security-assessment) - [AWS Cloud Security](https://www.bionconsulting.com/services/aws/cloud-security) - [AWS Architecture Design](https://www.bionconsulting.com/services/aws/architecture-design) - [AWS Managed Services](https://www.bionconsulting.com/services/aws/managed-services) - [AWS Migration Services](https://www.bionconsulting.com/services/aws/migration-services) - [AWS Cost Optimisation](https://www.bionconsulting.com/services/aws/aws-cost-optimisation) - [AWS CPPO](https://www.bionconsulting.com/services/aws/aws-cppo) - AI Infrastructure Services - [AI Platform Architecture](https://www.bionconsulting.com/ai-platform-architecture) - [Generative AI & LLM Deployment on AWS](https://www.bionconsulting.com/generative-ai-llm-deployment-aws) - [AI Platform Operations and MLOps](https://www.bionconsulting.com/ai-platform-operations-and-mlops-on-aws) - Observability & Monitoring - [New Relic](https://www.bionconsulting.com/partnerships/new-relic) - [Application Performance Monitoring](https://www.bionconsulting.com/new-relic/application-performance-monitoring) - [Observability for DevOps Teams](https://www.bionconsulting.com/new-relic/observability-for-devops-teams) - [New Relic Health Check](https://www.bionconsulting.com/services/new-relic/observability-health-check) - [SAP Monitoring with New Relic](https://www.bionconsulting.com/partnerships/new-relic/sap-monitoring-with-new-relic) - [Migration from Datadog](https://www.bionconsulting.com/partnerships/new-relic/migration-from-datadog) - Industries - [Financial Services & Insurance](https://www.bionconsulting.com/industries/financial-services-insurance) - [SaaS & ISV](https://www.bionconsulting.com/industries/saas-isv) - [Retail & E-commerce](https://www.bionconsulting.com/industries/retail-e-commerce) - [Travel & Hospitality](https://www.bionconsulting.com/industries/travel-hospitality) - [Healthcare & Life Sciences](https://www.bionconsulting.com/industries/healthcare-life-sciences) - [Education & EdTech](https://www.bionconsulting.com/industries/education-edtech) - Startups - [DaaS for Startups](https://www.bionconsulting.com/startups/devops) - [AWS Migration for Startups](https://www.bionconsulting.com/startups/aws-migration) - Partnerships - [AWS](https://www.bionconsulting.com/partnerships/aws) - [New Relic](https://www.bionconsulting.com/partnerships/new-relic) - [Anchore](https://www.bionconsulting.com/partnerships/anchore) - [Octopus](https://www.bionconsulting.com/partnerships/octopus) - [DBmaestro](https://www.bionconsulting.com/partnerships/dbmaestro) - [Eclypses](https://www.bionconsulting.com/partnerships/eclypses) - [Vanta](https://www.bionconsulting.com/partnerships/vanta) - [Palo Alto](https://www.bionconsulting.com/partnerships/palo-alto) - [About us](https://www.bionconsulting.com/about) - [Case Studies](https://www.bionconsulting.com/case-studies) - [Blog](https://www.bionconsulting.com/blog) - [Contact us](https://www.bionconsulting.com/contact-us) This is a search field with an auto-suggest feature attached. - There are no suggestions because the search field is empty. # GCP IAP Tunnelling on Ansible with Dynamic Inventory [Bion DevOps Team](https://www.bionconsulting.com/blog/author/bion-devops-team) Apr 11, 2022, 10:30:15 AM One of our main motivations at Bion is to automate everything eventually. With this motivation in mind, I was recently automating one of my projects using Ansible. I wanted to combine GCP Identity Aware Proxy (which from now on I'll refer to as IAP) with Ansible, but I discovered a lack of available information about configuring IAP settings for Ansible. There's a great feature in GCP that you can use to connect instances and/or apps in the private network without installing a VPN solution. In this blog post, I'll go through every step of the configuration with detailed explanations. Before going deeper with IAP, I'll also explain a common security practice in identity, which is called zero trust. ## **What is Zero Trust Identity Security?** A zero-trust network is one in which no person, device, or network enjoys inherent trust. All trust, which allows access to information, must be earned. The first toward earning that trust demonstrating valid identity. A system needs to know who you are, confidently, before it can determine what you should have access to. Add to that the understanding of what you can access–authorization–and you've got the core foundation of zero-trust security. I know, the quote from the documentation won’t help you understand the main idea, but Google Cloud has already explained the Zero Trust Identity Security pretty well with a real-world example using the comic below. ![Google-Cloud-Comic-issue5-Full-Comic\_full-.max-2200x2200](https://www.bionconsulting.com/hs-fs/hubfs/Google-Cloud-Comic-issue5-Full-Comic_full-.max-2200x2200.png?width=745&name=Google-Cloud-Comic-issue5-Full-Comic_full-.max-2200x2200.png)Google Cloud Comics Zero Trust: Identity.\[[1](https://cloud.google.com/blog/topics/developers-practitioners/what-zero-trust-identity-security)\] ## **What is IAP?** Identity-Aware Proxy (IAP) is a Google Cloud Platform service that centralizes user access to SaaS applications and other cloud resources accessed by HTTPS. IAP secures authentication for requests made to virtual machines running on GCP and other cloud-based and on-premises applications, only granting access to users you authorize. With IAP, users can connect from untrusted networks without using a VPN. ![](https://www.bionconsulting.com/hs-fs/hubfs/Google%20Drive%20Integration/Bion%20Consulting-GCP%20IAP%20Tunneling%20on%20Ansible%20with%20Dynamic%20Inventory-1.jpeg?width=600&name=Bion%20Consulting-GCP%20IAP%20Tunneling%20on%20Ansible%20with%20Dynamic%20Inventory-1.jpeg) After receiving all the incoming traffic, the IAP identifies which user is sending the request by adding a header when sending it to the internal resources. Other instances in the same data center may be compromised and fake requests with changed headers (username/mail) may come to the webserver. Thanks to the JWT header, we can avoid this. JWT can't be spoofed because It's digitally signed by **Google**. ![](https://www.bionconsulting.com/hs-fs/hubfs/Google%20Drive%20Integration/Bion%20Consulting-GCP%20IAP%20Tunneling%20on%20Ansible%20with%20Dynamic%20Inventory-Apr-04-2022-10-02-51-83-AM.png?width=745&name=Bion%20Consulting-GCP%20IAP%20Tunneling%20on%20Ansible%20with%20Dynamic%20Inventory-Apr-04-2022-10-02-51-83-AM.png) Example diagram of IAP workflow on Compute Engine \[[2](https://cloud.google.com/iap/docs/concepts-overview)\] Google’s Identity-Aware Proxy aims to increase security, allowing admins to establish and enforce access-control policies. The service simplifies access for cloud administrators and remote workers, eliminating the need for a VPN. IAP provides a zero-trust access model for GCP resources such as Google Compute Engine and Google Kubernetes Engine (GKE) instances, allowing access only to users with the correct identity and access management (IAM) role. Additionally, you can use TCP forwarding to control access to SSH and RDP. With proper configuration, IAP will also authenticate to apps on other clouds and on-premises. ![](https://www.bionconsulting.com/hs-fs/hubfs/Google%20Drive%20Integration/Bion%20Consulting-GCP%20IAP%20Tunneling%20on%20Ansible%20with%20Dynamic%20Inventory-4.png?width=745&name=Bion%20Consulting-GCP%20IAP%20Tunneling%20on%20Ansible%20with%20Dynamic%20Inventory-4.png) ## **Example IAP Architecture in Google Cloud Platform** ### **Use cases** - Authentication for web applications and cloud resources. - Access control for SSH and RDP. ### **Pluses** - SSH access is available. - RDP access is available. - Automatically creates an OAuth 2.0 client ID and secret. - Easy to integrate with other GCP services. ### **Minuses** - Limited third-party integration. - The initial setup is complex**.** ## **Ansible Configuration** Now that we’ve already learned about zero-trust policy and IAP, we can continue with the required configuration for the Ansible side. The required configuration should include 3 files in total. The order of the files doesn’t matter. - **ansible.cfg** contains the required configuration for using misc/inventory.gcp.yml and enables the gcp\_compute plugin. - **misc/inventory.gcp.yml** contains plugin settings for dynamic configuration. - **group\_vars/all.yml** contains the ssh argument configuration. Let’s deep dive into the files. ### **ansible.cfg** Contents: | \[inventory\] enable\_plugins = gcp\_compute \[defaults\] inventory = misc/inventory.gcp.yml interpreter\_python = /usr/bin/python3 \[ssh\_connection\] pipelining= True ssh\_args = -o ControlPersist=15m -o ControlMaster=auto -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null scp\_if\_ssh = True private\_key\_file = ~/.ssh/google\_compute\_engine | | --- | First things first - we are telling Ansible that we want to use the gcp\_compute plugin for our inventory. Then we are pointing Ansible to our inventory configuration file from which the contents can be found at misc/inventory.gcp.yml. A second important thing to add is the private\_key\_file. Basically, we are telling ansible we will be using the default google\_compute\_engine private key while connecting to our instances. Your SSH key could be different than the default google\_compute\_engine. If you would like to get the key without any further configuration, you can run the below gcloud command. | gcloud auth login | | --- | The above command will redirect you to log in. Once you logged in, your key will be available at ~/.ssh/google\_compute\_engine ### **misc/inventory.gcp.yml** Contents: | plugin: gcp\_compute projects: \- \[YOUR\_PROJECT\_HERE\] auth\_kind: application keyed\_groups: \- key: labels groups: redis : "redis in label" compose: \# set the ansible\_host variable to connect with the private IP address without changing the hostname ansible\_host: name | | --- | The above code will enable the automatic inventory of all the “to compute” instances running in the **\[YOUR\_PROJECT\_HERE\]**. Groups will be generated based on the given keyed\_groups configuration. In the above configuration, I’m just looking for a “redis” in labels of the instance. ![](https://www.bionconsulting.com/hs-fs/hubfs/Google%20Drive%20Integration/Bion%20Consulting-GCP%20IAP%20Tunneling%20on%20Ansible%20with%20Dynamic%20Inventory-1.png?width=745&name=Bion%20Consulting-GCP%20IAP%20Tunneling%20on%20Ansible%20with%20Dynamic%20Inventory-1.png) ### **Instance Configuration Details** Setting the ansible\_host to the name will make sure our ssh command will work. Without ansible\_host Ansible will pass the instance IP address which does not fit for the gcloud ssh command. ### **/group\_vars/all.yml** Contents: | ansible\_ssh\_common\_args: "-o ProxyCommand='gcloud compute start-iap-tunnel %h %p --listen-on-stdin --zone  --project '" | | --- | As a final configuration file, this one will be passed to our ssh command as an argument. Basically, gcloud ssh uses the same argument while connecting an instance (you will get a similar output with increasing the verbose level of gcloud ssh) through the gcloud command. and will be passed by Ansible. ### **Test Flight!** Since we are done with the Ansible configuration part, that means we are ready to try out our inventory file with the below command. | ansible-inventory -i misc/inventory.gcp.yml --graph | | --- | The output will be similar to below, based on your keyed\_groups and labels. ![](https://www.bionconsulting.com/hs-fs/hubfs/Google%20Drive%20Integration/Bion%20Consulting-GCP%20IAP%20Tunneling%20on%20Ansible%20with%20Dynamic%20Inventory-3.png?width=261&height=404&name=Bion%20Consulting-GCP%20IAP%20Tunneling%20on%20Ansible%20with%20Dynamic%20Inventory-3.png) Let’s ping our redis group with an Ansible ping module! | ansible \[YOUR\_GROUP\] -i misc/inventory.gcp.yml -m ping | | --- | ![](https://www.bionconsulting.com/hubfs/Google%20Drive%20Integration/Bion%20Consulting-GCP%20IAP%20Tunneling%20on%20Ansible%20with%20Dynamic%20Inventory.png) It worked like a charm! We successfully configured Ansible to use GCP IAP tunnelling along with the dynamic inventory. I hope you found this post helpful, and if you enjoyed reading it, please don’t forget to share. [IAP](https://www.bionconsulting.com/blog/tag/iap) [ZeroTrust](https://www.bionconsulting.com/blog/tag/zerotrust) [dynamicinventory](https://www.bionconsulting.com/blog/tag/dynamicinventory) [GCP](https://www.bionconsulting.com/blog/tag/gcp) [Ansible](https://www.bionconsulting.com/blog/tag/ansible) ## Leave a Comment ## Related Posts ### [Jun 11, 2021, 9:33:59 AM Amazon EKS: IAM Roles for Service Accounts (IRSA)](https://www.bionconsulting.com/blog/amazon-eks-irsa) ### [Sep 1, 2021, 12:07:44 PM Securing Kubernetes Workloads Using Anchore Engine](https://www.bionconsulting.com/blog/securing-kubernetes-workloads-using-anchore-engine) ### [Jun 16, 2022, 8:16:40 AM Running Production-Ready Databases on EKS - Part 1](https://www.bionconsulting.com/blog/running-production-ready-databases-on-eks-part-1) ![bion-logo-white-122x40](https://www.bionconsulting.com/hubfs/bion-logo-white-122x40.png) Bion Consulting helps organisations build secure, scalable, and high-performing cloud environments. With deep expertise in DevOps, security, containerisation, observability, and AI platform operations, we deliver resilient solutions for complex and evolving business needs. - [Home](https://www.bionconsulting.com) - [DevOps](https://www.bionconsulting.com/devops-as-a-service) - [AWS](https://www.bionconsulting.com/partnerships/aws) - [New Relic](https://www.bionconsulting.com/partnerships/new-relic) - [Octopus](https://www.bionconsulting.com/partnerships/octopus) - [DBmaestro](https://www.bionconsulting.com/partnerships/dbmaestro) - [Anchore](https://www.bionconsulting.com/partnerships/anchore) - [About us](https://www.bionconsulting.com/about) - [Contact Us](https://www.bionconsulting.com/contact-us) © 2026 All rights reserved.