Access control with IAM (original) (raw)

By default, only project owners and editors can create, update, delete, or invoke Cloud Run resources, and only project owners and Cloud Run Admins can modify Identity and Access Management (IAM) policies—for example, to make a service public. Refer toCloud Run IAM roles for details.

To grant other principals or groups the ability to perform these actions, useIAM to grant roles to differentprincipals.

If you've created or deployed functions usinggcloud functions commands or theCloud Functions v2 APIs and need to use these options for backward compatibility, seeAccess control with IAM.

Cloud Run predefined roles

Compared to basic roles (Owner, Editor, and Viewer), the following predefined roles have finer-grained access control for accessing Cloud Run resources:

Control access on an individual Cloud Run resource

You can control access on a per-service, per-job, or per-worker-pool basis using IAM.

Add principals

To add principals to a service:

Console

1. In the Google Cloud console, go to the Cloud Run page:
   Go to Cloud Run
2. Click the checkbox next to the service that you want to add principals to. Don't click the service itself.
3. In the information pane in the top right corner click thePermissions tab. If the information pane isn't visible, you may need to click Show Info Panel, then clickPermissions.
4. Click Add principal.
5. In the New principals field, enter one or more identities that need access to your service.
6. From the Assign roles drop-down menu, select a role or roles. The roles you select appear in the pane with a short description of the permissions they grant.
7. Click Save.

gcloud

Use the following command:

gcloud run services add-iam-policy-binding SERVICE_NAME
--member=PRINCIPAL
--role=ROLE

Replace the following:

• SERVICE_NAME: the service name.
• PRINCIPAL: the principal type (e.g. user:email@domain.com). For a list of acceptable values for PRINCIPAL, seePrincipal identifiers.
• ROLE: the role. For a list of acceptable values for ROLE, seeCloud Run IAM roles.

Remove principals from a role

To remove principals from a role for a service:

Console

1. In the Google Cloud console, go to the Cloud Run page:
   Go to Cloud Run
2. Click the checkbox next to the service you want to remove principals from. Don't click the service itself.
3. In the information pane in the top right corner click thePermissions tab. If the information pane isn't visible, you may need to click Show Info Panel, then clickPermissions.
4. Enter the principal you want to remove in the roles list filter, which displays all roles granted to that principal.
5. Click the delete trash can next to the principal within the desired role to remove that role from the principal.
6. In the confirmation dialog, you have the option to remove that principal from all roles in the service. Click Remove to remove the principal from the role.

gcloud

Use the following command:

gcloud run services remove-iam-policy-binding SERVICE_NAME
--member=PRINCIPAL
--role=ROLE

Replace the following:

• SERVICE_NAME: the service name.
• PRINCIPAL: the principal type (e.g. user:email@domain.com). For a list of acceptable values for PRINCIPAL, see thePrincipal identifiers.
• ROLE: the role. For a list of acceptable values for ROLE, seeCloud Run IAM roles.

Bulk addition or removal of principals

To do a bulk add or remove for a service:

Console

1. In the Google Cloud console, go to the Cloud Run page:
   Go to Cloud Run
2. Click the checkbox at the left of the service you want to add principals to or remove principals from. Don't click the service itself.
3. Select the service you want to add principals to or remove principals from.
4. In the information pane in the top right corner click thePermissions tab. If the information pane isn't visible, you may need to click Show Info Panel, then clickPermissions.

If you want to add principals:

1. Click Add principal.
2. In the New principals field, enter one or more identities that need access to your service.
3. From the Assign roles menu, select a role (or roles). The roles you select appear in the pane with a short description of the permissions they grant.
4. Click Save.

If you want to remove principals:

1. Enter the principal you want to remove in the roles list filter, which displays all roles granted to that principal.
2. Click the delete trash can on the row of the principal.
3. In the confirmation dialog, you have the option to remove that principal from all roles in the service. Click Remove to remove the principal from the role.

gcloud

Create an IAM policy:

cat < policy.json { "bindings": [ { "role": ROLE, "members": [ PRINCIPAL ] } ] } EOF

Use the gcloud run services set-iam-policy command:

gcloud run services set-iam-policy SERVICE_NAME policy.json

For a list of acceptable values for PRINCIPAL, see the Principal identifiers. For a list of acceptable values for ROLE, seeCloud Run IAM roles.

View principals

To view principals for a service:

Console

1. In the Google Cloud console, go to the Cloud Run page:
   Go to Cloud Run
2. Click the checkbox at the left of the service you want to view for principals and roles. Don't click the service itself.
3. Select the service you want to view for principals and roles.
4. In the information pane in the top right corner click thePermissions tab. If the information pane isn't visible, you may need to click Show Info Panel, then clickPermissions.
5. The list of roles and principals will be shown, grouped by role granted.

gcloud

Use the following command:

gcloud run services get-iam-policy SERVICE_NAME

Control access on all Cloud Run resources in a project

If you want to grant roles to principals on all services and jobs in a project, you can useproject-level IAM.

Console

1. In the Google Cloud console, go to the IAM page:
   Go to IAM
2. Find the principal you want to grant a project-wide role.
3. Click the edit Pencil on the right side of the principal's row.
4. Click Add another role and pick the needed role.
5. Click Save.

gcloud

Use the gcloud projects add-iam-policy-binding command:

gcloud projects add-iam-policy-binding PROJECT_ID
--member=PRINCIPAL
--role=ROLE

Replace the following:

• PROJECT_ID: the ID of your Google Cloud project.
• PRINCIPAL: the principal (for example, user:email@domain.com).
• ROLE: the role (for example, roles/run.admin).

The allUsers and allAuthenticatedUsers principal types can't be applied at the project level, and instead must be added to each service individually.

Make a service public

There are two ways to create a public Cloud Run service:

• Disable the Cloud Run Invoker IAM check (recommended).
• Assign the Cloud Run Invoker IAM role to the allUsers member type.

Required roles

To disable or re-enable the Invoker IAM check on a service, you must have the following permissions:

• run.services.create
• run.services.update
• run.services.setIamPolicy

These permissions are included in theCloud Run Admin(roles/run.admin) role. SeeCloud Run IAM rolesfor the full list of roles and their associated permissions.

Disable the Cloud Run Invoker IAM check

The recommended way to make a public service is to disable the Cloud Run Invoker IAM check. Cloud Run enforces this check by default. Use this solution when the project is subject to thedomain restricted sharing constraint in an organization policy.

To disable the check:

Console

1. In the Google Cloud console, go to the Cloud Run page:
   Go to Cloud Run
2. Click Create Service if you are configuring a new service, then fill out the initial service settings page as needed.
   If you are configuring an existing service, click the service, then click the Security tab.
3. Select Allow public access.
4. Click Create or Save.

gcloud

• For a new service, use the gcloud run deploy command with the--no-invoker-iam-check flag:
  gcloud run deploy SERVICE_NAME --no-invoker-iam-check
  Replace SERVICE_NAME with the service name.
• For an existing service, use the gcloud run services update command with the --no-invoker-iam-check flag:
  gcloud run services update SERVICE_NAME --no-invoker-iam-check

Replace SERVICE_NAME with the service name.

YAML

1. To view and download the configuration:
   gcloud run services describe SERVICE --format export > service.yaml
2. Update the run.googleapis.com/invoker-iam-disabled: annotation:
   apiVersion: serving.knative.dev/v1
   kind: Service
   metadata:
   annotations:
   run.googleapis.com/invoker-iam-disabled: 'true'
   name: SERVICE_NAME
   Replace SERVICE_NAME with the name of your Cloud Run service.
3. Replace the service with its new configuration using the following command:
   gcloud run services replace service.yaml

Terraform

To learn how to apply or remove a Terraform configuration, seeBasic Terraform commands.

Add the following to agoogle_cloud_run_v2_service resource in your Terraform configuration:

resource "google_cloud_run_v2_service" "default" {
   name     = "SERVICE"
   location = "REGION"
   invoker_iam_disabled = true

   template {
      containers {
      image = "IMAGE_URL"
      }
   }
}

Replace the following:

• SERVICE: the name of your Cloud Run service.
• REGION: the Google Cloud region—for example,europe-west1.
• IMAGE_URL: a reference to the container image, for example, us-docker.pkg.dev/cloudrun/container/hello:latest. If you use Artifact Registry, the repository REPO_NAME must already be created. The URL follows the format of LOCATION-docker.pkg.dev/PROJECT_ID/REPO_NAME/PATH:TAG

Verify that the check is disabled after deployment by navigating to the service's HTTPS endpoint.

Re-enable the Cloud Run Invoker IAM check

To re-enable the check:

Console

1. In the Google Cloud console, go to the Cloud Run Services page:
   Go to Cloud Run
2. Click the service, then click Security.
3. Select Require authentication and select Identity and Access Management (IAM).
4. Click Save.

gcloud

• Update the service by passing the --invoker-iam-check flag:
  gcloud run services update SERVICE_NAME --invoker-iam-check
  Replace SERVICE_NAME with the service name.

YAML

1. To view and download the configuration:
   gcloud run services describe SERVICE --format export > service.yaml
2. Update the run.googleapis.com/invoker-iam-disabled: annotation:
   apiVersion: serving.knative.dev/v1
   kind: Service
   metadata:
   annotations:
   run.googleapis.com/invoker-iam-disabled: 'false'
   name: SERVICE_NAME
   Replace SERVICE_NAME with the name of your Cloud Run service.

Terraform

To learn how to apply or remove a Terraform configuration, seeBasic Terraform commands.

Add the following to agoogle_cloud_run_v2_service resource in your Terraform configuration:

resource "google_cloud_run_v2_service" "default" {
   name     = "SERVICE"
   location = "REGION"
   invoker_iam_disabled = false

   template {
      containers {
      image = "IMAGE_URL"
      }
   }
}

Replace the following:

• SERVICE: the name of your Cloud Run service.
• REGION: the Google Cloud region—for example,europe-west1.
• IMAGE_URL: a reference to the container image, for example, us-docker.pkg.dev/cloudrun/container/hello:latest. If you use Artifact Registry, the repository REPO_NAME must already be created. The URL follows the format of LOCATION-docker.pkg.dev/PROJECT_ID/REPO_NAME/PATH:TAG

Verify that the check is re-enabled after deployment by navigating to the service's HTTPS endpoint.

Configure organization policy for the Cloud Run invoker IAM check

If you're an administrator, you can restrict the ability todisable the Invoker IAM checkby using the constraints/run.managed.requireInvokerIam managed constraint. This constraint is not enforced by default.

Assign the Cloud Run IAM Invoker role to the allUsers member type

You can allow public access to a service by assigning the Cloud Run Invoker IAM role to the allUsers member type.

You must have the run.services.setIamPolicy permission to configure authentication on a Cloud Run service. This permission is included in the Cloud Run Admin role. SeeCloud Run IAM rolesfor the full list of roles and their associated permissions.

Console

For an existing Cloud Run service:

1. In the Google Cloud console, go to the Cloud Run Services page:
   Go to Google Cloud console
2. To the left of the service that you want to make public, click the checkbox. Don't click the service itself.
3. In the information pane in the top-right corner, click thePermissions tab. If the information pane isn't visible, you might need to click Show Info Panel, then click Permissions.
4. Click Add principal.

In the New principals field, enter the value allUsers.

1. From the Select a role menu, select theCloud Run Invoker role.
2. Click Save.
3. You will be prompted to verify that you would like to make this resource public. Click Allow public access to apply the change to the service IAM settings.

For a new service you are creating, create the serviceand select Allow public access in the Authentication section to make the service publicly available. To make a service private, selectRequire authentication.

gcloud

To make a service publicly accessible, use the gcloud run services command to add the special allUsers member type to a service and grant it theroles/run.invoker role:

gcloud run services add-iam-policy-binding [SERVICE_NAME]
--member="allUsers"
--role="roles/run.invoker"

Run the gcloud run deploy command to make your service publicly accessible when you deploy your service:

gcloud run deploy [SERVICE_NAME] ... --allow-unauthenticated

YAML

Create a file named policy.yaml with the following content:

bindings:
- members:
  - allUsers
  role: roles/run.invoker

Allow public access for the existing SERVICE using:

gcloud run services set-iam-policy SERVICE policy.yaml

Terraform

To learn how to apply or remove a Terraform configuration, seeBasic Terraform commands.

Add the following to agoogle_cloud_run_v2_service resource in your Terraform configuration:

To update the service IAM binding for roles/run.invoker, add the following resource referencing your Cloud Run service:

This binding is only authoritative for the given role. Other IAM bindings within the service IAM policy are preserved.

Use IAM Conditions

You can use IAM Conditions to define and enforce conditional, attribute-based access control for certain Cloud Run resources. Cloud Run supports the (request.host) and (request.path) condition attributes to grant conditional access when invoking Cloud Run services and worker pools.

For example, to grant conditional access with the request.host andrequest.path attributes when invoking Cloud Run services, add the condition field when running the following command:

gcloud run services add-iam-policy-binding SERVICE_NAME
--member=PRINCIPAL
--role=ROLE
--region=REGION
--condition=[KEY=VALUE,...]

Replace the following:

• SERVICE_NAME: the service name (for example,my-service).
• PRINCIPAL: the principal (for example,user:email@domain.com).
• ROLE: the role (for example, roles/run.invoker).
• REGION: the region (for example,europe-west1).
• KEY=VALUE: acondition to include in the binding. The --condition flag must include the key-value pairs expression and title.

Next steps

Learn how to securely authenticate developers, services, and usersto the services you just secured.