Single service comparison

CBH is a managed bastion host appliance, not an identity-aware L4 reverse proxy. Where IAP TCP Forwarding front-ends arbitrary TCP ports through Google's global load balancer and decides authorization per IAM binding on the forwarding rule, CBH intermediates sessions through a single-tenant instance hosting its own account, role, and access-control model. Consequently CBH must be provisioned for concurrency and asset count (tiers from 50 up to 10,000 assets), while IAP scales horizontally without sizing an intermediate gateway. The access boundary for IAP is an IAM permission; for CBH it is a managed asset inventory plus role-based permissions inside the bastion.

Operating models diverge on tunnelling, clients, and telemetry. IAP requires no client agent and consumes standard SSH/RDP/native-TCP callers using an IAP desktop or gcloud tunnel; CBH concentrates sessions in its own web console and broker, recording screen replay and command logs as the primary audit artifact. IAP emits Cloud Audit Logs of authorization decisions but does not record session payloads, whereas CBH records full session video and command telemetry. Operators migrating from IAP therefore trade a stateless proxy with IAM-driven auth for a stateful inspection bastion with richer session evidence.

Integration and responsibility boundaries differ. IAP TCP Forwarding coexists with VPC Service Controls and Google-managed perimeter enforcement, outsourcing trust to Google front-ends. CBH is deployed inside a customer VPC, requires route/security-group planning to reach managed hosts, and the customer owns instance HA (single instance per spec; DR via backup/restore). Database O&M audit is a CBH professional-edition capability, while IAP does not provide database-specific session recording. Treat the two as adjacent but not equivalent: zero-trust tunnel authorization policy (IAP) versus privileged-session broker with audit (CBH).

Assess per-asset authorization semantics first. Inventory every IAP forwarding rule, the IAM bindings granting iap.tunnelInstances.accessViaBindings, the underlying TCP ports, the caller identities (user/workload), and any VPC Service Controls perimeter. Map each IAP-protected target to a CBH managed host resource and decide whether the IAM principal-to-permission model is reproduced via CBH users, roles, and access control policies, or whether Huawei IAM plus CCE/DCS-style resource-scoped grants are required to preserve least-privilege intent. Document gaps where IAP authorizes by binding and CBH by asset group.

Plan the data-plane migration. CBH does not expose a generic TCP-forwarding ingress; clients connect through the CBH web console or third-party client integration, and sessions originate from the CBH instance's own network interface. Re-architect ingress for RDP/SSH/SQL/custom-TCP targets so that security groups and NACLs permit CBH egress instead of Google IAP egress ranges. For working-directory fan-out targets, run CBH professional edition if database O&M audit or automated playbooks are needed. There is no automated IAP-to-CBH converter; move host inventory via export/import and manually recreate access-control policies.

Validate auth, session replay, and audit before cutover. Pilot on a non-production asset set: confirm MFA enrollment, remote authentication to enterprise IdP, and that concurrent sessions fit the chosen CBH tier (50-10,000 assets; concurrency equals assets up to 500). Verify audit fields map to existing IAP Cloud Logging consumers (CBH exports logs via OBS and alarm settings rather than per-request audit entries), and adjust downstream SIEM ingestion. Confirm DR posture, since CBH HA is instance-level.

Recompute TCO and beware cost-model changes. CBH is billed by edition tier and managed-asset count as an annual subscription (standard/professional editions), unlike IAP which bills network egress, the IAP API call volume, and any Context-Aware Access add-ons. Recalculate with peak concurrent sessions, asset count, retention for session recordings, and OBS storage for exported audit data. Do not assume feature-for-feature parity on VPC Service Controls, Context-Aware Access, managed-identity workload access, or per-request authorization: these may require IAM, CFW, DEW, or DSC services alongside CBH, and any cross-service bill goes into the migrated TCO.