Validates an IAP JWT for your (Compute|Container) Engine service.

  Args:
    iap_jwt: The contents of the X-Goog-IAP-JWT-Assertion header.
    cloud_project_number: The project *number* for your Google Cloud project.
      This is returned by 'gcloud projects describe $PROJECT_ID', or in the
      Project Info card in Cloud Console.
    backend_service_id: The ID of the backend service used to access the
      application. See https://cloud.google.com/iap/docs/signed-headers-howto
        for details on how to get this value.

  Returns:
    A tuple of (user_id, user_email).

  Raises:
    IAPValidationFailedError: if the validation has failed.

def ValidateIapJwtFromComputeEngine(iap_jwt, cloud_project_number,
                                    backend_service_id):
  """Validates an IAP JWT for your (Compute|Container) Engine service.

  Args:
    iap_jwt: The contents of the X-Goog-IAP-JWT-Assertion header.
    cloud_project_number: The project *number* for your Google Cloud project.
      This is returned by 'gcloud projects describe $PROJECT_ID', or in the
      Project Info card in Cloud Console.
    backend_service_id: The ID of the backend service used to access the
      application. See https://cloud.google.com/iap/docs/signed-headers-howto
        for details on how to get this value.

  Returns:
    A tuple of (user_id, user_email).

  Raises:
    IAPValidationFailedError: if the validation has failed.
  """
  expected_audience = "/projects/{}/global/backendServices/{}".format(
      cloud_project_number, backend_service_id)
  return ValidateIapJwt(iap_jwt, expected_audience)