You cannot get a Google profile photo from Cloud IAP alone. IAP gives you identity for access control, not an OAuth access token for Google APIs. The headers and the IAP JWT are only meant for your app to verify who the caller is. They do not include a profile picture and they are not valid to call Google APIs like People.