tl;dr

Ansible is awesome, but whats more awesome is using it to manage cloud instances without exposing them to the public internet.

how to configure iap

IAP is a feature of Google Cloud Platform that allows you to access your instances over a secure, identity-based tunnel. The SSH port is exposed only to the IAP proxy CIDR range, and you connect to it using your Google Cloud identity.

First, you need to enable IAP for the SSH port. You can do this by running the following command:

gcloud compute firewall-rules create allow-iap-ssh --allow=tcp:22 --source-ranges=35.235.240.0/20

or the equivalent Terraform would be:

resource "google_compute_firewall" "allow-iap-ssh" {
  name = "allow-iap-ssh"
  allow {
    protocol = "tcp"
    ports = ["22"]
  }
  source_ranges = ["35.235.240.0/20"]
}

This will create a firewall rule that allows SSH traffic from the IAP proxy CIDR range.

how to configure ansible

Until recently, Ansible had no built-in support for IAP.

StackOverflow #1
StackOverflow #2

thenets wrote a plugin for this that in 2023 to solve this gap. It modifies Ansible to invoke the gcloud compute ssh command.

But luckily in September 2025, the google.cloud collection for Ansible added support for IAP.

Setup is straightforward and only requires the following:

Addition of the hostnames key to the native Google Cloud inventory plugin.

hostnames:
  - name

Addition of the google.cloud.iap connection plugin to a playbook.

connection: google.cloud.iap

A full example can be found here.