What problem does it solve? Securing Google Cloud Run behind a Global HTTPS Load Balancer with Identity-Aware Proxy often causes persistent 403 Forbidden errors when native Cloud Run IAP and Load Balancer IAP are both enabled, because their OAuth Client IDs produce mismatched JWT tokens. ## Core Features & Use Cases - Architecture Guidance: Explains the correct least-privilege pattern where IAP runs only at the Load Balancer, Cloud Run ingress is restricted to internal-and-cloud-load-balancing, and the IAP Service Agent receives roles/run.invoker. - Troubleshooting Commands: Provides gcloud commands to disable native IAP with --no-iap, re-apply the IAP Service Agent invoker binding, and enforce private ingress. - Deployment Scripting Pattern: Shows a shell script pattern using ENABLE_IAP and LOAD_BALANCER_IAP flags to skip native Cloud Run IAP when a Load Balancer handles authentication. - Use Case: A team deploys a Cloud Run service behind a custom domain with a Global HTTPS Load Balancer and hits GFE 403 errors; this Skill walks them through disabling native IAP and granting the IAP Service Agent invoker access. ## Quick Start Diagnose why my Cloud Run service behind an HTTPS Load Balancer with IAP returns 403 Forbidden errors and give me the gcloud commands to fix it.
