IAP vs Bastion for Private SSH Access | GCP PCA

While preparing for the GCP PCA exam, many candidates get confused by secure remote access patterns in cloud infrastructure without exposing instances to the public Internet. In the real world, this is fundamentally a decision about leveraging managed security services versus DIY bastion hosts. Let’s drill into a simulated scenario.

The Scenario

#

OptiFin, a rapidly scaling fintech startup with global regulatory compliance demands, hosts several Linux-based Compute Engine VMs without public IP addresses for security. Their engineering team must routinely SSH into specific VMs to perform maintenance and troubleshooting. However, OptiFin currently has no VPN connectivity between their corporate network and Google Cloud and cannot expose any VM directly to the Internet per security policy.

Key Requirements

#

Establish a secure, auditable, and least-privilege SSH access method to these private VMs without violating the no-public-IP and no-VPN constraints.

The Options

#

• A) Configure Cloud NAT on the subnet where the instances are hosted. Create an SSH connection to the Cloud NAT public IP to reach the instances.
• B) Add all instances to an unmanaged instance group. Configure TCP Proxy Load Balancing with the instance group as a backend. Connect to the instances using the TCP Proxy IP address.
• C) Configure Identity-Aware Proxy (IAP) for the instances and ensure that users have the role IAP-secured Tunnel User. Use the gcloud command line tool to SSH into instances via IAP.
• D) Create a bastion host VM with a public IP address in the same VPC. SSH into the bastion host from your office, then SSH internally from the bastion into the private instances.

Correct Answer

#

Option C: Identity-Aware Proxy (IAP) with the IAP-secured Tunnel User role.

Step-by-Step Winning Logic

#

IAP creates an encrypted, outbound SSH tunnel from the user’s local machine to the private instance without exposing the VM’s IP publicly or requiring a VPN. It leverages Google’s managed infrastructure and integrates with Cloud IAM for fine-grained access control, central audit logging, and no need to manage SSH bastion hosts. This aligns with modern SRE principles of reducing operational toil through managed services and achieving zero trust security.

💎 Professional-Level Analysis

#

This section breaks down the scenario from a professional exam perspective, focusing on constraints, trade-offs, and the decision signals used to eliminate incorrect options.

🔐 Expert Deep Dive: Why Options Fail

#

This walkthrough explains how the exam expects you to reason through the scenario step by step, highlighting the constraints and trade-offs that invalidate each incorrect option.

Prefer a quick walkthrough before diving deep?
[Video coming soon] This short walkthrough video explains the core scenario, the key trade-off being tested, and why the correct option stands out, so you can follow the deeper analysis with clarity.

🔐 The Traps (Distractor Analysis)

#

This section explains why each incorrect option looks reasonable at first glance, and the specific assumptions or constraints that ultimately make it fail.

The difference between the correct answer and the distractors comes down to one decision assumption most candidates overlook.

🔐 The Solution Blueprint

#

This blueprint visualizes the expected solution, showing how services interact and which architectural pattern the exam is testing.

Seeing the full solution end to end often makes the trade-offs—and the failure points of simpler options—immediately clear.

graph TD
    User[Engineer] -->|gcloud ssh via IAP| IAP[IAP Service]
    IAP --> ComputeInstance[Private Compute Engine VM]
    style IAP fill:#4285F4,stroke:#333,color:#fff
    style ComputeInstance fill:#0f9d58,stroke:#333,color:#fff

🔐 The Decision Matrix

#

This matrix compares all options across cost, complexity, and operational impact, making the trade-offs explicit and the correct choice logically defensible.

At the professional level, the exam expects you to justify your choice by explicitly comparing cost, complexity, and operational impact.

🔐 Real-World Practitioner Insight

#

This section connects the exam scenario to real production environments, highlighting how similar decisions are made—and often misjudged—in practice.

This is the kind of decision that frequently looks correct on paper, but creates long-term friction once deployed in production.