Troubleshooting IAP TCP Forwarding Permission Denied: Enable the Service
A large organization uses Shared VPC with hundreds of projects. They want to implement fine-grained access control for SSH access to Compute Engine instances using IAP TCP forwarding. They have created a custom IAM role with the necessary permissions (iap.tunnel.dest, iap.tunnel.getIamPolicy, compute.instances.use) and granted it to a group of developers. The developers have also been granted the iap.tunnelUser role on the project. However, when they try to use `gcloud compute ssh --tunnel-through-iap instance-name`, they get a permission error: "Permission 'iap.tunnel.dest' denied on resource 'projects/project/zones/zone/instances/instance'". The network admin has verified that the custom role includes the required permissions and that the developers are members of the group with the role. What is the most likely missing configuration?
Quick Answer
The answer is that IAP TCP forwarding is not enabled for the project or VPC. Even when a custom IAM role correctly includes the `iap.tunnel.dest` permission and the developers hold the `iap.tunnelUser` role, the IAP TCP forwarding service itself must be activated at the infrastructure level; without enabling the IAP API on the project and the service for the VPC, the proxy cannot intercept TCP traffic, causing the permission check to fail before IAM evaluation. On the Google Professional Cloud Network Engineer exam, this scenario tests your understanding that IAP TCP forwarding is a two-layer configuration—IAM permissions alone are insufficient if the underlying service is disabled, a common trap where candidates focus only on roles. Remember the memory tip: "IAM says yes, but the service says no"—always verify the IAP API is enabled before troubleshooting permissions.
⚠ Common exam trap
Candidates often assume the error is due to missing IAM permissions or instance configuration, when in fact the IAP TCP forwarding service must be explicitly enabled at the project level, which is a prerequisite often forgotten in Shared VPC environments.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
IAP TCP forwarding is not enabled for the project or VPC.
IAP TCP forwarding requires the IAP API to be enabled on the project and the service to be activated for the VPC. Without this, the IAP proxy cannot intercept and forward TCP traffic to the instance, even if the IAM permissions are correctly assigned. The error 'Permission 'iap.tunnel.dest' denied' typically occurs when the IAP TCP forwarding service itself is not enabled, as the permission check fails at the service level before evaluating the IAM role.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The developers need the `iap.tunnel` resource-level permission on the IAP TCP forwarding resource.
Why it's wrong here
The correct permission is `iap.tunnel.dest`, which they already have.
- ✓
IAP TCP forwarding is not enabled for the project or VPC.
Why this is correct
IAP TCP forwarding must be explicitly enabled at the project level. If not enabled, the permission check fails.
- ✗
The instances do not have the required network tags for IAP.
Why it's wrong here
IAP does not rely on network tags; it uses IAM permissions.
- ✗
The developers need the `compute.instances.osLogin` permission.
Why it's wrong here
OS Login is unrelated to IAP TCP forwarding permissions.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNE question from scratch — 961 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on PCNE
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. A network engineer is unable to SSH to instance-1 using IAP TCP forwarding. What is the most likely reason?
easy- A.IAP TCP forwarding is not enabled for the project.
- ✓ B.The instance does not have the 'ssh-iap' tag that the firewall rule applies to.
- C.The instance's service account does not have the necessary IAP permissions.
- D.SSH keys are not configured on the instance.
Why B: The exhibit shows a firewall rule that allows IAP TCP forwarding traffic from the IAP source range (35.235.240.0/20) to instances with the network tag 'ssh-iap'. Since instance-1 lacks this tag, the firewall rule does not apply, and SSH traffic from IAP is blocked. Without the tag, the instance's firewall policy drops the forwarded TCP connections, preventing SSH access.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.