IAP tunnel: Error 4033 not authorized Google Cloud / Firebase Origin: Platform & cloud Last updated 4 Nov 2026

gcloud compute ssh: ERROR: (gcloud.compute.start-iap-tunnel) Error while connecting [4033: 'not authorized']

SSH through Identity-Aware Proxy failed because you lack IAP tunnel permission or the firewall doesn't allow IAP's range.

Exact message you may see Error while connecting [4033: 'not authorized']ERROR: (gcloud.compute.start-iap-tunnel) Error while connecting [4003: 'failed to connect to backend']gcloud compute ssh IAP tunnel not authorizedfailed to connect to backend 4003 IAP
Explore the map of this error Full error map →
Seen on: Google Cloud Linux

Meaning

Grant roles/iap.tunnelResourceAccessor, allow ingress from 35.235.240.0/20 on port 22, and make sure the VM and instance exist. Error 4003 means the instance isn't listening or the firewall blocks; 4033 means no permission.

Common causes

  • Missing roles/iap.tunnelResourceAccessor
  • Firewall doesn't allow 35.235.240.0/20 to tcp:22
  • Wrong VM name/zone
  • Org policy restricting IAP
  • OS Login permissions missing (roles/compute.osLogin)

⚡ Quick fix

  1. gcloud projects add-iam-policy-binding PROJECT --member=user:you@example.com --role=roles/iap.tunnelResourceAccessor
  2. Create a firewall rule allowing 35.235.240.0/20 to tcp:22
  3. Use --tunnel-through-iap with the right zone

Detailed fix by platform

gcloud

  1. gcloud compute firewall-rules create allow-ssh-iap --network default --allow tcp:22 --source-ranges 35.235.240.0/20

How to diagnose

  1. Code — 4033 or 4003?
  2. Role — iap.tunnelResourceAccessor?
  3. Firewall — IAP range allowed?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Platform & cloud. Errors that are often confused with or caused by this one (click to open):

409: The resource already exists — Compute Engine: ERROR: (gcloud.compute.instances.create) Could not fetch resource: The resource 'projects/p/zones/z/instances/vm-1' already exists (Google Cloud / Firebase)409: The resource alr…API has not been used in project before or it is disabled — Google Cloud: 403 SERVICE_DISABLED — Cloud Resource Manager API has not been used in project 123456 before or it is disabled. Enable it by visiting (Google Cloud / Firebase)API has not been used…Artifact Registry: Permission artifactregistry.repositories.uploadArtifacts denied — Docker push: denied: Permission "artifactregistry.repositories.uploadArtifacts" denied on resource "projects/p/locations/l/repositories/r" (Google Cloud / Firebase)Artifact Registry: Pe…Compute Engine: Quota exceeded (regional limit) — Compute Engine: Quota 'N2_CPUS' exceeded. Limit: 24.0 in region europe-west1 / QUOTA_EXCEEDED (Google Cloud / Firebase)Compute Engine: Quota…PERMISSION_DENIED: Permission 'x' denied on resource — Google Cloud: 403 PERMISSION_DENIED — Permission 'storage.objects.get' denied on resource (or it may not exist) (Google Cloud / Firebase)PERMISSION_DENIED: Pe…Your active project does not match the quota project in your local ADC — gcloud/ADC: WARNING: Your active project does not match the quota project in your local Application Default Credentials file (Google Cloud / Firebase)Your active project d…ZONE_RESOURCE_POOL_EXHAUSTED — Compute Engine: The zone 'projects/p/zones/us-central1-a' does not have enough resources available to fulfill the request (ZONE_RESOURCE_POOL_EXHAUSTED) (Google Cloud / Firebase)ZONE_RESOURCE_POOL_EX…IAP tunne…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.