How to use the Google IAP Configuration agent skill

What is an agent skill and what does this one do?

An agent skill is a folder containing a SKILL.md instruction file, plus optional reference documents, templates and scripts, that an AI agent can load when a task matches the skill's description. This one is about Google Cloud IAP. Once loaded, the agent can produce gcloud commands to turn on IAP for App Engine, Cloud Run, Compute Engine and similar backends, grant user and group access with conditions such as device or time rules, and define access levels with Access Context Manager.

The skill's bundled Python scripts can also call Google Cloud APIs to list and audit existing IAP settings. The skill is meant to be used when you are replacing VPN access to internal web apps with identity-based access.

• Enables IAP on App Engine, Cloud Run and Compute Engine backends, plus IAP TCP forwarding for SSH and RDP
• Writes IAM bindings for groups and users, with optional conditions on access level, time or URL path
• Drafts Access Context Manager access levels from device, network and CEL rules
• Adds re-authentication settings per application
• Runs audit scripts that read IAP configuration through Google Cloud APIs

Install the skill in Claude

Download the ZIP file for this skill from this page. You can install it in one of two ways. For personal use across all your projects, unzip it into ~/.claude/skills/. For a single project, unzip it into that project's .claude/skills/ folder. The skill folder should contain SKILL.md at its top level, alongside the assets, references and scripts folders.

You can also upload the ZIP in the Claude apps under Settings → Capabilities → Skills.

• Personal install: unzip into ~/.claude/skills/
• Project install: unzip into .claude/skills/ inside your project
• Claude apps: Settings → Capabilities → Skills, then upload the ZIP

Set up what the skill needs before you start

The skill assumes a Google Cloud environment is already in place. Check these items first, because the commands will fail without them.

The scripts need Python 3 and several Google Cloud client packages. The skill's API reference lists installing google-cloud-iap and google-cloud-resource-manager with pip. The scripts also import google-cloud-compute, google-auth and requests.

• Google Cloud project with billing enabled
• gcloud CLI installed and authenticated
• Python 3 with google-cloud-iap, google-cloud-resource-manager, google-cloud-compute, google-auth and requests
• Cloud Identity or Google Workspace for user management
• OAuth consent screen and OAuth client credentials
• IAP and Access Context Manager APIs enabled

Ask for help with natural requests

You do not need to name the skill or any command. Describe the outcome you want and include the names of your project resources, such as the backend service, group email or access policy ID. The agent will then match the request to this skill and draft the steps.

Give concrete details. The skill's own examples use placeholders such as PROJECT_ID, CLIENT_ID and POLICY_ID, so mention which values you have and which you still need to look up.

• "Turn on IAP for my Cloud Run service internal-api and give the engineering group access."
• "Give the finance group access to finance-app only from corporate managed devices."
• "Audit the IAP settings and IAM bindings on my project and tell me which backends have no access level."
• "Create an access level that requires an encrypted, admin-approved device on the corporate IP range."

Review the output before anything changes access

The commands alter access control. A wrong binding can lock out users or expose a resource that should be private. Read every command the agent produces, confirm the project, zone, region and policy IDs, and test in a non-production project first. Changes like these are best reviewed by a second person.

Keep in mind what IAP is not for. The skill's own guidance says not to use it for public-facing applications that must allow anonymous users, for non-HTTP applications that cannot sit behind an HTTPS load balancer, or where the app handles its own authentication and IAP would conflict with it.

• Confirm PROJECT_ID, region, zone and POLICY_ID before running a command
• Test in a non-production project first
• Keep a record of the current IAP settings so you can revert
• Do not use IAP for anonymous public apps

Safety notes: scripts and network use

This skill runs scripts and uses the network. The bundled scripts, scripts/agent.py and scripts/process.py, call Google Cloud APIs, and the skill is marked as using the network. Read the scripts before running them, and run them under an identity with the least permissions needed for auditing. The skill's reference material also lists external links to Google Cloud, NIST and CISA documentation.

• Scripts call Google Cloud APIs using your authenticated gcloud or application credentials
• Read scripts/agent.py and scripts/process.py before running them
• Use a read-only identity when you only want an audit

Tips for better results

Name the resource type when you can. The skill covers several backends, and commands differ between App Engine, Cloud Run and Compute Engine. Also check the checklist template in assets/template.md, which lists fields such as platform, access level, re-auth setting and groups for each backend. Filling it in before you ask gives the agent better input.

Be aware of a placeholder in the source. The re-authentication example in SKILL.md ends with an incomplete setting name, so verify the exact flag and value against Google's current IAP documentation before you run it.

• Name the platform: App Engine, Cloud Run, GKE or Compute Engine
• Fill in assets/template.md as a checklist before you start
• Verify the re-authentication command, which the source leaves incomplete
• Check the links in references/standards.md for current Google documentation