title: IAP User is able to access a Cloud Run without permission
body: <p>Steps to reproduce this:</p>
  <ul>
  <li>create a Cloud Run service with &quot;Require authentication&quot; options setup
  ingress options to be &quot;Allow internal traffic and traffic from Cloud Load Balancing&quot;</li>
  <li>expose the service using and External Load Balancer with IAP enabled</li>
  <li>give the user the role &quot;IAP-Secured Web App User&quot; for the backend service</li>
  </ul>
  <p>The user will be able to access the Cloud Run service without explicit permission.</p>
  <p>You can follow this tutorial to have a working examples <a href="https://hodo.dev/posts/post-30-gcp-cloudrun-iap/" rel="nofollow noreferrer">hodo.dev/posts/post-30-gcp-cloudrun-iap/</a></p>
  <p>Is this a bug or is the expected behavior?</p>
  <p>If this is expected then where this implicit user permission is documented?</p>