When you enable IAM Auth, the proxy will use the IAM token from the machine where it is running. When you run the proxy locally, it will use your gcloud auth credentials. However, if you run it on the bastion host, it will use the service account from that host.

We recommend running the Auth Proxy locally, however, mainly for security reasons.