diff --git a/.changelog/3814.txt b/.changelog/3814.txt
new file mode 100644
index 00000000000..6669cfc1501
--- /dev/null
+++ b/.changelog/3814.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+`appengine`: Set `iap` to computed in `google_app_engine_application`
+```
diff --git a/google/resource_app_engine_application.go b/google/resource_app_engine_application.go
index 892ce434289..ec6dad76539 100644
--- a/google/resource_app_engine_application.go
+++ b/google/resource_app_engine_application.go
@@ -119,6 +119,7 @@ func resourceAppEngineApplication() *schema.Resource {
 			"iap": {
 				Type:        schema.TypeList,
 				Optional:    true,
+				Computed:    true,
 				MaxItems:    1,
 				Description: `Settings for enabling Cloud Identity Aware Proxy`,
 				Elem: &schema.Resource{