feat: adding IAP config object for regional lb

build/int.cloudbuild.yaml

@@ -93,6 +93,27 @@ steps:
     - verify internal-lb-http gce mig
   name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
   args: ['/bin/bash', '-c', 'cft test run TestInternalLbGCEMIG --stage teardown --verbose']
+  # Backend Service with IAP Enabled
+- id: init backend-with-iap
+  waitFor:
+    - teardown internal-lb-http gce mig
+  name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
+  args: ['/bin/bash', '-c', 'cft test run TestLbBackendServiceIap --stage init --verbose']
+- id: apply backend-with-iap
+  waitFor:
+    - init backend-with-iap
+  name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
+  args: ['/bin/bash', '-c', 'cft test run TestLbBackendServiceIap --stage apply --verbose']
+- id: verify backend-with-iap
+  waitFor:
+    - apply backend-with-iap
+  name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
+  args: ['/bin/bash', '-c', 'cft test run TestLbBackendServiceIap --stage verify --verbose']
+- id: teardown backend-with-iap
+  waitFor:
+    - verify backend-with-iap
+  name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
+  args: ['/bin/bash', '-c', 'cft test run TestLbBackendServiceIap --stage teardown --verbose']
 tags:
 - 'ci'
 - 'integration'

examples/backend-services-with-iap/main.tf

@@ -0,0 +1,28 @@
+/**
+ * Copyright 2025 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+module "lb-backend-iap" {
+  source  = "GoogleCloudPlatform/regional-lb-http/google//modules/backend"
+  version = "~> 0.4.0"
+
+  project_id = var.project_id
+  region     = "us-central1"
+  name       = "regional-backend-service-with-iap"
+  iap_config = {
+    enable      = true
+    iap_members = ["user:test@test.test"]
+  }
+}

examples/backend-services-with-iap/outputs.tf

@@ -0,0 +1,15 @@
+/**
+ * Copyright 2025 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */

examples/backend-services-with-iap/variables.tf

@@ -0,0 +1,19 @@
+/**
+ * Copyright 2025 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+variable "project_id" {
+  type = string
+}

metadata.yaml

@@ -36,6 +36,8 @@ spec:
       - name: frontend
         location: modules/frontend
     examples:
+      - name: backend-services-with-iap
+        location: examples/backend-services-with-iap
       - name: cloud-run
         location: examples/cloud-run
       - name: gce-mig

modules/backend/README.md

@@ -15,6 +15,7 @@ This module creates `google_compute_region_backend_service` resource and its dep
 | groups | The list of backend instance group which serves the traffic. | <pre>list(object({<br>    group       = string<br>    description = optional(string)<br><br>    balancing_mode               = optional(string)<br>    capacity_scaler              = optional(number, 1.0)<br>    max_connections              = optional(number)<br>    max_connections_per_instance = optional(number)<br>    max_connections_per_endpoint = optional(number)<br>    max_rate                     = optional(number)<br>    max_rate_per_instance        = optional(number)<br>    max_rate_per_endpoint        = optional(number)<br>    max_utilization              = optional(number)<br>  }))</pre> | `[]` | no |
 | health\_check | Input for creating HttpHealthCheck or HttpsHealthCheck resource for health checking this BackendService. A health check must be specified unless the backend service uses an internet or serverless NEG as a backend. | <pre>object({<br>    host                = optional(string, null)<br>    request_path        = optional(string, null)<br>    request             = optional(string, null)<br>    response            = optional(string, null)<br>    port                = optional(number, null)<br>    port_name           = optional(string, null)<br>    proxy_header        = optional(string, null)<br>    port_specification  = optional(string, null)<br>    protocol            = optional(string, null)<br>    check_interval_sec  = optional(number, 10)<br>    timeout_sec         = optional(number, 10)<br>    healthy_threshold   = optional(number, 2)<br>    unhealthy_threshold = optional(number, 2)<br>    logging             = optional(bool, true)<br>  })</pre> | `null` | no |
 | host\_path\_mappings | The list of host/path for which traffic should be sent to this backend service | <pre>list(object({<br>    host = string<br>    path = string<br>  }))</pre> | <pre>[<br>  {<br>    "host": "*",<br>    "path": "/*"<br>  }<br>]</pre> | no |
+| iap\_config | Settings for enabling Cloud Identity Aware Proxy and Users/SAs to be given IAP HttpResourceAccessor access to the service. | <pre>object({<br>    enable               = bool<br>    oauth2_client_id     = optional(string)<br>    oauth2_client_secret = optional(string)<br>    iap_members          = optional(list(string))<br>  })</pre> | <pre>{<br>  "enable": false<br>}</pre> | no |
 | load\_balancing\_scheme | Load balancing scheme type (EXTERNAL for classic external load balancer, EXTERNAL\_MANAGED for Envoy-based load balancer, and INTERNAL\_MANAGED for internal load balancer) | `string` | `"EXTERNAL_MANAGED"` | no |
 | locality\_lb\_policy | The load balancing algorithm used within the scope of the locality. | `string` | `null` | no |
 | name | Name for the load balancer backend service. | `string` | n/a | yes |

modules/backend/main.tf

@@ -14,6 +14,10 @@
  * limitations under the License.
  */
 
+locals {
+  iap_access_members = var.iap_config.enable ? coalesce(var.iap_config.iap_members, []) : []
+}
+
 resource "google_compute_region_backend_service" "default" {
   provider = google-beta
 
@@ -62,6 +66,15 @@ resource "google_compute_region_backend_service" "default" {
       capacity_scaler = var.load_balancing_scheme != "INTERNAL" ? backend.value.capacity_scaler : null
     }
   }
+
+  dynamic "iap" {
+    for_each = var.iap_config.enable ? [1] : []
+    content {
+      oauth2_client_id     = lookup(var.iap_config, "oauth2_client_id", "")
+      enabled              = var.iap_config.enable
+      oauth2_client_secret = lookup(var.iap_config, "oauth2_client_secret", "")
+    }
+  }
 }
 
 resource "google_compute_region_health_check" "default" {
@@ -217,3 +230,12 @@ resource "google_compute_region_network_endpoint_group" "serverless_negs" {
     create_before_destroy = true
   }
 }
+
+resource "google_iap_web_region_backend_service_iam_member" "member" {
+  for_each                   = toset(local.iap_access_members)
+  project                    = google_compute_region_backend_service.default.project
+  region                     = google_compute_region_backend_service.default.region
+  web_region_backend_service = google_compute_region_backend_service.default.name
+  role                       = "roles/iap.httpsResourceAccessor"
+  member                     = each.value
+}

modules/backend/metadata.display.yaml

@@ -59,6 +59,15 @@ spec:
           name: host_path_mappings
           title: Host Path Mappings
           level: 1
+        iap_config:
+          name: iap_config
+          title: Iap Config
+          properties:
+            iap_members:
+              name: iap_members
+              title: Iap Members
+              regexValidation: ^(?:allUsers|allAuthenticatedUsers)$|^((?:user|group|serviceAccount):(?:[a-zA-Z0-9._-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,})|(?:domain:(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,})|(?:projectOwner|projectEditor|projectViewer):[a-z][a-z0-9-]{0,28}[a-z0-9])$
+              validation: Must be allUsers, allAuthenticatedUsers, or a service account in the format serviceAccount:email@example.com. [More info](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/iap_web_region_backend_service_iam#google_iap_web_region_backend_service_iam_member).
         load_balancing_scheme:
           name: load_balancing_scheme
           title: Load Balancing Scheme

modules/backend/metadata.yaml

@@ -32,6 +32,8 @@ spec:
     description: {}
   content:
     examples:
+      - name: backend-services-with-iap
+        location: examples/backend-services-with-iap
       - name: cloud-run
         location: examples/cloud-run
       - name: gce-mig
@@ -184,6 +186,17 @@ spec:
       - name: timeout_sec
         description: This has different meaning for different type of load balancing. Please refer https://cloud.google.com/load-balancing/docs/backend-service#timeout-setting
         varType: number
+      - name: iap_config
+        description: Settings for enabling Cloud Identity Aware Proxy and Users/SAs to be given IAP HttpResourceAccessor access to the service.
+        varType: |-
+          object({
+              enable               = bool
+              oauth2_client_id     = optional(string)
+              oauth2_client_secret = optional(string)
+              iap_members          = optional(list(string))
+            })
+        defaultValue:
+          enable: false
     outputs:
       - name: backend_service_info
         description: Host, path and backend service mapping

modules/backend/variables.tf

@@ -190,3 +190,14 @@ variable "timeout_sec" {
   type        = number
   default     = null
 }
+
+variable "iap_config" {
+  description = "Settings for enabling Cloud Identity Aware Proxy and Users/SAs to be given IAP HttpResourceAccessor access to the service."
+  type = object({
+    enable               = bool
+    oauth2_client_id     = optional(string)
+    oauth2_client_secret = optional(string)
+    iap_members          = optional(list(string))
+  })
+  default = { enable = false }
+}

modules/frontend/metadata.yaml

@@ -32,6 +32,8 @@ spec:
     description: {}
   content:
     examples:
+      - name: backend-services-with-iap
+        location: examples/backend-services-with-iap
       - name: cloud-run
         location: examples/cloud-run
       - name: gce-mig

test/integration/backend-services-with-iap/backend_services_with_iap_test.go

@@ -0,0 +1,43 @@
+// Copyright 2025 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package backend_services_with_iap
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/GoogleCloudPlatform/cloud-foundation-toolkit/infra/blueprint-test/pkg/tft"
+	"github.com/stretchr/testify/assert"
+	"github.com/GoogleCloudPlatform/cloud-foundation-toolkit/infra/blueprint-test/pkg/gcloud"
+)
+
+func TestLbBackendServiceIap(t *testing.T) {
+	backendServiceWithIAP := tft.NewTFBlueprintTest(t)
+
+	backendServiceWithIAP.DefineVerify(func(assert *assert.Assertions) {
+
+		projectID := backendServiceWithIAP.GetTFSetupStringOutput("project_id")
+		serviceName := "regional-backend-service-with-iap"
+		region := "us-central1"
+
+		backendServiceDescribeCmd := gcloud.Run(t, "compute backend-services describe", gcloud.WithCommonArgs([]string{serviceName, "--project", projectID, "--region", region ,"--format", "json"}))
+
+		//verify IAP is enabled in backend-services
+		iapConfig := backendServiceDescribeCmd.Get("iap").Map()
+		assert.Equal("true", iapConfig["enabled"].String(), fmt.Sprintf("IAP should be enabled"))
+	})
+	backendServiceWithIAP.Test()
+}
+

test/setup/iam.tf

@@ -32,7 +32,8 @@ locals {
       "roles/iam.serviceAccountUser",
       "roles/certificatemanager.owner",
       "roles/vpcaccess.admin",
-      "roles/iam.serviceAccountAdmin"
+      "roles/iam.serviceAccountAdmin",
+      "roles/iap.admin"
     ]
     frontend = [
       "roles/storage.admin",

test/setup/main.tf

@@ -45,6 +45,7 @@ locals {
       "iam.googleapis.com",
       "certificatemanager.googleapis.com",
       "vpcaccess.googleapis.com",
+      "iap.googleapis.com",
     ]
   }
 }