Identity-Aware Proxy
| methodName | Description | Log type | Sample | Rule |
|---|---|---|---|---|
| AuthorizeUser | Records a connection attempt through IAP TCP forwarding (SSH/RDP via an IAP tunnel), gated by the iap.tunnelInstances.accessViaIAP permission. Requires Data Access logging to be enabled for the IAP API. | data_access | N | N |
| google. | Sets the IAM policy on an IAP-secured resource, gated by iap.web.setIamPolicy or iap.webServices.setIamPolicy depending on resource scope. | activity | N | Y |
| google. | Reads the IAM policy on an IAP-secured resource (ADMIN_READ). | data_access | N | N |
| google. | Reads IAP settings (access levels, reauthentication policy) for a project, folder, or resource (ADMIN_READ). | data_access | N | N |
| google. | Updates IAP settings, including access levels and reauthentication policy (DATA_WRITE). | data_access | N | N |
| google. | Creates a TCP tunnel destination group used to scope IAP TCP forwarding (DATA_WRITE). | data_access | N | N |
| google. | Updates a TCP tunnel destination group (DATA_WRITE). | data_access | N | N |
| google. | Deletes a TCP tunnel destination group (DATA_WRITE). | data_access | N | N |
| google. | Reads a single TCP tunnel destination group (DATA_READ). | data_access | N | N |
| google. | Lists TCP tunnel destination groups in a project (DATA_READ). | data_access | N | N |
| google. | Validates an IAP attribute-based access-control (CEL) expression before it is applied (DATA_WRITE). | data_access | N | N |
google.cloud.iap.IdentityAwareProxyAdminService.SetIamPolicy: Set IAP IAM policy
#Description
Sets the IAM policy on an IAP-secured resource, gated by iap.web.setIamPolicy or iap.webServices.setIamPolicy depending on resource scope.
Detection Fields #
Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.
| Name | Rules | Vendors |
|---|---|---|
protoPayload.methodName | 1 detection rule | Panther |
Detection Rules #
Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →Panther #
google.cloud.iap.IdentityAwareProxyAdminService.GetIamPolicy: Get IAP IAM policy
#Description
Reads the IAM policy on an IAP-secured resource (ADMIN_READ).
Data Access audit logs are disabled by default.
google.cloud.iap.IdentityAwareProxyAdminService.GetIapSettings: Get IAP settings
#Description
Reads IAP settings (access levels, reauthentication policy) for a project, folder, or resource (ADMIN_READ).
Data Access audit logs are disabled by default.
google.cloud.iap.IdentityAwareProxyAdminService.UpdateIapSettings: Update IAP settings
#Description
Updates IAP settings, including access levels and reauthentication policy (DATA_WRITE).
Data Access audit logs are disabled by default.
google.cloud.iap.IdentityAwareProxyAdminService.CreateTunnelDestGroup: Create tunnel destination group
#Description
Creates a TCP tunnel destination group used to scope IAP TCP forwarding (DATA_WRITE).
Data Access audit logs are disabled by default.
google.cloud.iap.IdentityAwareProxyAdminService.UpdateTunnelDestGroup: Update tunnel destination group
#Description
Updates a TCP tunnel destination group (DATA_WRITE).
Data Access audit logs are disabled by default.
google.cloud.iap.IdentityAwareProxyAdminService.DeleteTunnelDestGroup: Delete tunnel destination group
#Description
Deletes a TCP tunnel destination group (DATA_WRITE).
Data Access audit logs are disabled by default.
google.cloud.iap.IdentityAwareProxyAdminService.GetTunnelDestGroup: Get tunnel destination group
#Description
Reads a single TCP tunnel destination group (DATA_READ).
Data Access audit logs are disabled by default.
google.cloud.iap.IdentityAwareProxyAdminService.ListTunnelDestGroups: List tunnel destination groups
#Description
Lists TCP tunnel destination groups in a project (DATA_READ).
Data Access audit logs are disabled by default.
google.cloud.iap.IdentityAwareProxyAdminService.ValidateIapAttributeExpression: Validate IAP attribute expression
#Description
Validates an IAP attribute-based access-control (CEL) expression before it is applied (DATA_WRITE).
Data Access audit logs are disabled by default.
any: iap.googleapis.com (any method)
#Scope grouping: This repository-authored catalog entry represents a broad attribution scope, not a distinct emitted event or operation. Any sample below is a representative record from that scope; attached rules, if any, are listed separately.
Description
Catch-all entry for iap.googleapis.com. Source-only rules that attribute to the service without a specific method attribute here. Not a distinct audit log operation.