# gcloud compute ssh: ERROR: (gcloud.compute.start-iap-tunnel) Error while connecting [4033: 'not authorized']

**Code:** `IAP tunnel: Error 4033 not authorized` · **Category:** Google Cloud / Firebase · **Seen on:** Google Cloud, Linux

SSH through Identity-Aware Proxy failed because you lack IAP tunnel permission or the firewall doesn't allow IAP's range.

## Meaning

Grant `roles/iap.tunnelResourceAccessor`, allow ingress from 35.235.240.0/20 on port 22, and make sure the VM and instance exist. Error 4003 means the instance isn't listening or the firewall blocks; 4033 means no permission.

## Common causes

- Missing roles/iap.tunnelResourceAccessor
- Firewall doesn't allow 35.235.240.0/20 to tcp:22
- Wrong VM name/zone
- Org policy restricting IAP
- OS Login permissions missing (roles/compute.osLogin)

## Quick fix

1. `gcloud projects add-iam-policy-binding PROJECT --member=user:you@example.com --role=roles/iap.tunnelResourceAccessor`
2. Create a firewall rule allowing 35.235.240.0/20 to tcp:22
3. Use `--tunnel-through-iap` with the right zone

## Detailed fix by platform

### gcloud

1. `gcloud compute firewall-rules create allow-ssh-iap --network default --allow tcp:22 --source-ranges 35.235.240.0/20`

## How to diagnose

1. **Code** — 4033 or 4003?
2. **Role** — iap.tunnelResourceAccessor?
3. **Firewall** — IAP range allowed?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/gcp/iap-tunnel-error-4033)