Route events to an internal HTTP endpoint in a VPC network

Console

1. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

   Go to project selector

2. Enable the Cloud Logging and Eventarc APIs.

   Enable the APIs

3. If applicable, enable the API related to the direct events. For example, for Cloud Run functions events, enable cloudfunctions.googleapis.com.

4. If you don't already have one, create a user-managed service account, then grant it the roles and permissions necessary so that Eventarc can manage events for your target service.

   1. In the Google Cloud console, go to the Create service account page.

      Go to Create service account

   2. Select your project.

   3. In the Service account name field, enter a name. The Google Cloud console fills in the Service account ID field based on this name.

      In the Service account description field, enter a description. For example, Service account for event trigger.

   4. Click Create and continue.

   5. To provide appropriate access, in the Select a role list, select the required Identity and Access Management (IAM) roles to grant to your service account. For more information, see Roles and permissions for an internal HTTP endpoint in a VPC network.

      For additional roles, click add Add another role and add each additional role.

   6. Click Continue.

   7. To finish creating the account, click Done.

5. If you are creating a trigger for direct events from Cloud Storage, grant the Pub/Sub Publisher role (roles/pubsub.publisher) to the Cloud Storage service agent:

   1. In the Google Cloud console, go to the IAM page.

      Go to IAM

   2. Select the Include Google-provided role grants checkbox.

   3. In the Principal column, find the Cloud Storage Service Agent with the form service-PROJECT_NUMBER@gs-project-accounts.iam.gserviceaccount.com, and then click edit Edit principal in the corresponding row.

   4. Click either add Add role or add Add another role.

   5. In the Select a role list, filter for Pub/Sub Publisher, and then select the role.

   6. Click Save.

6. If the URI of the internal HTTP endpoint in the VPC network uses the internal DNS name of a service resolvable by Cloud DNS, grant the DNS Peer role (roles/dns.peer) on the VPC host project to the Eventarc service agent.

   Note that depending on how you have configured the VPC network, the VPC host project might also be your Eventarc trigger project.

   1. In the Google Cloud console, on the project selector page, select the VPC host project.

      Go to project selector

   2. In the Google Cloud console, go to the IAM page.

      Go to IAM

   3. Select the Include Google-provided role grants checkbox.

   4. Modify or add the Eventarc service agent as a principal:

      • If the Eventarc service agent already has other roles on the project, find the row containing the principal in the form service-PROJECT_NUMBER@gcp-sa-eventarc.iam.gserviceaccount.com, click edit Edit principal in that row, and click add Add another role.

      • If the Eventarc service agent doesn't have any existing roles on the project, click person_add Grant Access, then enter the email address in the form service-PROJECT_NUMBER@gcp-sa-eventarc.iam.gserviceaccount.com.

      Replace PROJECT_NUMBER with the Google Cloud project number for your Eventarc trigger project. You can find your project number on the Welcome page of the Google Cloud console or by running the following command:

      gcloud projects describe PROJECT_ID --format='value(projectNumber)'

   5. In the Select a role list, filter for DNS Peer, and then select the role.

   6. Click Save.

gcloud

1. In the Google Cloud console, activate Cloud Shell.

   Activate Cloud Shell

   At the bottom of the Google Cloud console, a Cloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

2. Enable the Cloud Logging, Eventarc, and Eventarc Publishing APIs.

   gcloud services enable logging.googleapis.com \
     eventarc.googleapis.com \
     eventarcpublishing.googleapis.com

3. If applicable, enable the API related to the events. For example, for Cloud Run functions events, enable cloudfunctions.googleapis.com.

4. If you don't already have one, create a user-managed service account and then grant it the roles and permissions necessary so that Eventarc can manage events for your target service.

   1. Create the service account:

      gcloud iam service-accounts create SERVICE_ACCOUNT_NAME

      Replace SERVICE_ACCOUNT_NAME with the name of the service account. It must be between 6 and 30 characters, and can contain lowercase alphanumeric characters and dashes. After you create a service account, you cannot change its name.

   2. Grant the required Identity and Access Management (IAM) roles or permissions. For more information, see Roles and permissions for an internal HTTP endpoint in a VPC network.

5. If the URI of the internal HTTP endpoint in the VPC network uses the internal DNS name of a service resolvable by Cloud DNS, grant the DNS Peer role (roles/dns.peer) on the VPC host project to the Eventarc service agent.

   Note that depending on how you have configured the VPC network, the VPC host project might also be your Eventarc trigger project.

   gcloud projects add-iam-policy-binding VPC_HOST_PROJECT_ID \
       --member=serviceAccount:service-PROJECT_NUMBER@gcp-sa-eventarc.iam.gserviceaccount.com \
       --role=roles/dns.peer

   Replace the following:

   • VPC_HOST_PROJECT_ID: the Google Cloud project ID for the VPC host project.
   • PROJECT_NUMBER: the Google Cloud project number for your Eventarc trigger project. You can find your project number on the Welcome page of the Google Cloud console or by running the following command:

   gcloud projects describe PROJECT_ID --format='value(projectNumber)'

6. If you are creating a trigger for direct events from Cloud Storage, grant the Pub/Sub Publisher role (roles/pubsub.publisher) on the project to the Cloud Storage service agent:

   gcloud projects add-iam-policy-binding PROJECT_ID \
       --member=serviceAccount:service-PROJECT_NUMBER@gs-project-accounts.iam.gserviceaccount.com \
       --role=roles/pubsub.publisher

Console

1. In the Google Cloud console, go to the Eventarc Triggers page.

   Go to Triggers

2. Click add_box Create trigger.
3. Type a Trigger name.

   This is the ID of the trigger and it must start with a letter. It can contain up to 63 lowercase letters, numbers, or hyphens.

4. For the Trigger type, select Google sources or Third-party.
5. Select an Event provider.

   This is the service that is the source of events. For a Google source, this is either directly or through its audit logs.

6. Depending on the event type that you are routing, do one of the following:
   1. Direct events—In the Event type list, from the Direct events, select an event type.
      1. For direct Cloud Pub/Sub events, in the Select a Cloud Pub/Sub topic list, select a topic or accept the default of None so that a new topic is created for you.
      2. For direct Cloud Storage events, specify or browse for the globally unique identifier of the Cloud Storage Bucket.
   2. Audit log events—In the Event type list, from the via Cloud Audit Logs events, select an event type, and then select one of the following:
      • Any resource—This is the default and includes dynamically created resources that have identifiers generated at creation time.
      • Specific resource—You must provide the full resource name.
      • Path pattern—You can filter for resources using a path pattern. For example, type projects/_/buckets/eventarc-bucket/objects/random.txt or type projects/_/buckets/**/r*.txt.
   3. Third-party events—In the Channel list, select a channel and then, in the Event type list, select an event.

      For more information, see Create a channel and retrieve its details.

7. If applicable to the event type, in the Event data content type list, select application/json or application/protobuf to specify the encoding of the event payload.

   Note that an event payload formatted in JSON is larger than one formatted in Protobuf. This might impact reliability depending on your event destination and its limits on event size. For more information, see Known issues.

8. If applicable to the event provider, click Add filter and specify the following:
   1. In the Attribute 1 field, depending on the direct event you chose, select a resource ID that can act as an event filter.
   2. Select an operator:
      • Equal
      • Path pattern

        For more information, see Understand path patterns.

   3. In the Attribute value 1 field, depending on the operator that you chose, type the exact value or apply a path pattern.
   4. If an Attribute 2 field is applicable, specify the appropriate values.
9. In the Region list, select a location.

   To avoid any performance and data residency issues, the location must match the location of the Google Cloud service that is generating events.

   Note that for this event destination, only the following locations are supported:

   • asia-east1
   • europe-north1
   • europe-west1
   • us-east1

   For more information, see Eventarc locations.

10. Select the Service account that will invoke your service.

    Or, you can create a new service account.

    This specifies the IAM service account email associated with the trigger and to which you previously granted specific roles required by Eventarc.

11. In the Event destination list, select HTTP endpoint (internal).
    1. Specify the Destination URI. This is the URI of the internal HTTP endpoint in the VPC network that receives the events for the trigger. The URI can be either a static internal IP address in the VPC network addressed by the network attachment or the internal DNS name of a service resolvable by Cloud DNS.

       If the HTTP endpoint uses an internal DNS name, Eventarc automatically creates DNS peering zones and forwards DNS requests to the DNS zones in the target VPC network. DNS peering lets you send requests for records that come from one zone's namespace to another VPC network. For more information, see Peering zones and Create a peering zone.

       Note that you can't create more than one trigger for the same DNS name.

    2. In the Network attachment list, select an identifier for the network attachment resource. This identifier is generated after you create a network attachment. For more information, see Create network attachments.

       Network attachments let service producer VPC networks initiate connections to consumer VPC networks. Eventarc uses the network attachment to establish a connection to the internal HTTP endpoint hosted in the consumer's VPC network and publish events.

       When you create a network attachment, you can explicitly authorize a connection through producer accept and reject lists; regardless, Eventarc can update the accept list of a network attachment with the appropriate project ID and without any intervention on your part.

12. Click Create.

After a trigger is created, the event source filters cannot be modified. Instead, create a new trigger and delete the earlier one. For more information, see Manage triggers.

gcloud

You can create a trigger by running a gcloud eventarc triggers create command along with required and optional flags.

gcloud eventarc triggers create TRIGGER \
    --location=LOCATION \
    --destination-http-endpoint-uri=ENDPOINT_URI \
    --network-attachment=NETWORK_ATTACHMENT_ID \
    --event-filters="type=EVENT_FILTER_TYPE" \
    --event-filters="COLLECTION_ID=RESOURCE_ID" \
    --event-filters-path-pattern="COLLECTION_ID=PATH_PATTERN" \
    --service-account=SERVICE_ACCOUNT_NAME@PROJECT_ID.iam.gserviceaccount.com"

gcloud eventarc triggers create helloworld-trigger \
    --location=us-central1 \
    --destination-http-endpoint-uri=http://my-vm.us-central1-a.c.my-project.internal \
    --network-attachment="projects/my-project/regions/us-central1/networkAttachments/my-attachment-name" \
    --event-filters="type=google.cloud.pubsub.topic.v1.messagePublished" \
    --service-account=my-service-account@my-project.iam.gserviceaccount.com

gcloud eventarc triggers create TRIGGER \
    --location=LOCATION \
    --destination-http-endpoint-uri=ENDPOINT_URI \
    --network-attachment=NETWORK_ATTACHMENT_ID \
    --event-filters="type=google.cloud.audit.log.v1.written" \
    --event-filters="serviceName=SERVICE_NAME" \
    --event-filters="methodName=METHOD_NAME" \
    --service-account=SERVICE_ACCOUNT_NAME@PROJECT_ID.iam.gserviceaccount.com"

gcloud eventarc triggers create helloworld-trigger \
    --location=us-central1 \
    --destination-http-endpoint-uri=http://10.10.10.2 \
    --network-attachment="projects/my-project/regions/us-central1/networkAttachments/my-attachment" \
    --event-filters="type=google.cloud.audit.log.v1.written" \
    --event-filters="serviceName=eventarc.googleapis.com" \
    --event-filters="methodName=google.cloud.eventarc.v1.Eventarc.GetTrigger" \
    --event-filters="resourceName=projects/my-project/locations/us-central1/triggers/my-trigger" \
    --service-account=my-service-account@my-project.iam.gserviceaccount.com

gcloud eventarc triggers create TRIGGER \
    --location=LOCATION \
    --destination-http-endpoint-uri=ENDPOINT_URI \
    --network-attachment=NETWORK_ATTACHMENT_ID \
    --event-filters="type=EVENT_FILTER_TYPE" \
    --channel=CHANNEL_NAME \
    --project=PROJECT_ID \
    --service-account=SERVICE_ACCOUNT_NAME@PROJECT_ID.iam.gserviceaccount.com"

gcloud eventarc triggers create helloworld-trigger \
    --location=us-central1 \
    --destination-http-endpoint-uri=http://my-vm.us-central1-a.c.my-project.internal \
    --network-attachment="projects/my-project/regions/us-central1/networkAttachments/my-attachment-name" \
    --event-filters="type=third-party-event-type" \
    --channel=my-channel \
    --project=my-project-ID \
    --service-account=my-service-account@my-project.iam.gserviceaccount.com

Console

1. In the Google Cloud console, go to the Eventarc Triggers page.

   Go to Triggers

   This page lists your triggers in all locations, and includes details such as names, regions, event providers, destinations, and more.

2. To filter your triggers:

   1. Click filter_list Filter or the Filter triggers field.
   2. In the Properties list, select an option to filter the triggers by.

   You can select a single property or use the logical operator OR to add more properties.

3. To sort your triggers, beside any supported column heading, click arrow_upward Sort.

gcloud

Run the following command to list your triggers:

gcloud eventarc triggers list --location=-

This command lists your triggers in all locations, and includes details such as names, types, destinations, and statuses.