IAM based authentication for GCP HTTPS Load Balancers

I have an internal HTTPS load balancer in GCP and I need to attach IAM policy to it to restrict the ingress requests from other compute instances. I'm rather confused by GCP IAM and wonder if it's possible to set up IAM policy for my load balancer to only allow the traffic from certain compute instances/service accounts.

For example, I have 2 instances running with service account A (A@developer.gserviceaccount.com) and B (B@developer.gserviceaccount.com) respectively, I need to set the IAM policy for my load balancer to only accept requests from VM that runs with service account A.

So I have run gcloud cli on my load balancer's backend using the following policy:

gcloud compute backend-services set-iam-policy https-backend policy.json

Content of policy.json

{
  "bindings": [
    {
      "role": "roles/compute.loadBalancerAdmin",
      "members": ["serviceAccount:A@developer.gserviceaccount.com"]
    }
  ]
}

I thought this policy would effectively only allow service account A to access the load balancer as compute.loadBalanceAdmin but apparently I can still hit the load balancer from VM that runs with service account B.

You are close, but it's not exactly that.

When you create an internal Load Balancer, you have an IP address (you can set it ephemeral, but it's better to have a static one.)

Therefore, if you want to grant, or to deny traffic between your VMs and the load balancer, you have to use firewall rules.

One of the cool feature of firewall rules is that you can use a service account as the source of the traffic. Like that, you can grant the A and B service account to access the load balancer through firewall filtering.