If you are creating a new function, see the Console Quickstart on Cloud Run. The content on this page only applies to existing legacy functions created with the Cloud Functions v1 API.
Stay organized with collections
Save and categorize content based on your preferences.
Supported Services
Access Google Cloud APIs from Cloud Run functions by using a service account
to act on your behalf. The service account provides
Application Default Credentials
for your functions.
Supported APIs
Cloud Run functions can access most major Google Cloud services via
language-specific API client libraries and/or REST APIs, including the following:
Google API Client Libraries that use application default credentials automatically
obtain the built-in service account credentials from the Cloud Run functions host at
runtime. By default, the client
authenticates using
the YOUR_PROJECT_ID@appspot.gserviceaccount.com
service account.
Routing with Cloud Load Balancing
Cloud Load Balancing
is a separate product that enables advanced network configurations for all of
your applications running on Google Cloud.
Configure your serverless app to serve from a dedicated IPv4 and/or IPv6 IP
address that is not shared with other services.
Reuse the same SSL certificates and private keys that you use for
Compute Engine, Google Kubernetes Engine, and Cloud Storage. This eliminates
the need to manage separate certificates for serverless apps.
Note the following limitation and recommendations:
To use Cloud Load Balancing-enabled security capabilities such as
Cloud Armor or security policies, you must change the
ingress settings
to be internal_and_gclb. Users who already have the Cloud Run functions's
default URL can otherwise bypass the load balancer and go directly to the
function's URL.
Support for Identity-Aware Proxy integrated with Cloud Load Balancing for
Cloud Run functions is not available.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-07 UTC."],[[["\u003cp\u003eCloud Run functions can access most major Google Cloud services via language-specific API client libraries and/or REST APIs, including BigQuery, Bigtable, Cloud Storage, and more.\u003c/p\u003e\n"],["\u003cp\u003eCloud Run functions use service accounts for authentication, providing Application Default Credentials for accessing Google Cloud APIs, with all communication encrypted in transit within Google's network.\u003c/p\u003e\n"],["\u003cp\u003eCloud Run functions can be triggered by various events from services like HTTP requests, Cloud Storage, Pub/Sub, Firebase, and Cloud Logging.\u003c/p\u003e\n"],["\u003cp\u003eCloud Load Balancing enables advanced network configurations for Cloud Run, including dedicated IP addresses, shared SSL certificates, and integration with services like Cloud CDN and Google Cloud Armor.\u003c/p\u003e\n"],["\u003cp\u003eTo utilize Cloud Load Balancing security capabilities like Cloud Armor, you need to configure the ingress settings to \u003ccode\u003einternal_and_gclb\u003c/code\u003e, otherwise the load balancer can be bypassed.\u003c/p\u003e\n"]]],[],null,["# Supported Services\n==================\n\nAccess Google Cloud APIs from Cloud Run functions by using a service account\nto act on your behalf. The service account provides\n[Application Default Credentials](https://developers.google.com/identity/protocols/application-default-credentials)\nfor your functions.\n| **Note:** All communication between Cloud Run functions and these services using [Cloud Client Libraries](/apis/docs/cloud-client-libraries) is encrypted in transit and transmitted entirely within [Google's network](/products/networking).\n\nSupported APIs\n--------------\n\nCloud Run functions can access most major Google Cloud services via\nlanguage-specific API client libraries and/or REST APIs, including the following:\n\n- [BigQuery](/bigquery/docs/reference/libraries)\n\n- [Bigtable](/bigtable/docs/reference/libraries)\n\n- [Cloud Data Loss Prevention](/sensitive-data-protection/docs/reference/libraries)\n\n- [Datastore](/datastore/docs/reference/libraries)\n\n- [Cloud DNS](/dns)\n\n- [Cloud Firestore](/firestore)\n\n- [Cloud Machine Learning Engine](/ml-engine)\n\n- [Cloud Natural Language API](/natural-language/docs/reference/libraries)\n\n- [Pub/Sub](/pubsub/docs/reference/libraries)\n\n- [Resource Manager](/resource-manager/docs/libraries)\n\n- [Spanner](/spanner/docs/reference/libraries)\n\n- [Speech-to-Text API](/speech-to-text/docs/reference/libraries)\n\n- [Cloud SQL](/sql/docs/mysql/connect-functions)\n\n- [Cloud Storage](/storage/docs/reference/libraries)\n\n- [Cloud Translation API](/translate/docs/reference/libraries)\n\n- [Cloud Vision API](/vision/docs/libraries)\n\n- [Video Intelligence API](/video-intelligence/docs/libraries)\n\n- [Firebase (DB, Storage, Analytics, Auth)](https://firebase.google.com/)\n\n- [Error Reporting Client Libraries](/error-reporting/docs/reference/libraries)\n\n- [Logging Client Libraries](/logging/docs/reference/libraries)\n\n- [Monitoring Client Libraries](/monitoring/docs/reference/libraries)\n\n- [Cloud Trace](/trace)\n\n- [Google Compute Engine](/compute)\n\nSupported event providers\n-------------------------\n\nCloud Run functions can be triggered by events provided by the following\nservices:\n\n- [HTTP](/functions/1stgendocs/calling/http)---invoke functions directly via HTTP\n requests\n\n- [Cloud Storage](/storage)\n\n- [Pub/Sub](/pubsub)\n\n- [Firebase (DB, Storage, Analytics, Auth)](https://firebase.google.com/)\n\n- [Cloud Logging](/logging)\n\nUsing services with Cloud Run functions\n---------------------------------------\n\nGoogle API Client Libraries that use application default credentials automatically\nobtain the built-in service account credentials from the Cloud Run functions host at\nruntime. By default, the client\n[authenticates](/docs/authentication/production) using\nthe \u003cvar translate=\"no\"\u003eYOUR_PROJECT_ID\u003c/var\u003e`@appspot.gserviceaccount.com`\nservice account.\n| **Note:** To learn more about the API client libraries provided by Google for the Node.js runtime, see [GitHub](https://github.com/GoogleCloudPlatform/google-cloud-node).\n\nRouting with Cloud Load Balancing\n---------------------------------\n\n[Cloud Load Balancing](/load-balancing/docs/https/setting-up-https-serverless)\nis a separate product that enables advanced network configurations for all of\nyour applications running on Google Cloud.\n\nWhen [HTTP(S) Load Balancing](/load-balancing/docs/negs/serverless-neg-concepts)\nis enabled for serverless apps, you can:\n\n- Configure your serverless app to serve from a dedicated IPv4 and/or IPv6 IP\n address that is not shared with other services.\n\n- Reuse the same SSL certificates and private keys that you use for\n Compute Engine, Google Kubernetes Engine, and Cloud Storage. This eliminates\n the need to manage separate certificates for serverless apps.\n\n- Use additional services that integrate with Cloud Load Balancing such as\n [Cloud CDN](/cdn/docs/overview),\n [Google Cloud Armor](/armor/docs/security-policy-overview), or\n [security policies](/load-balancing/docs/ssl-policies-concepts).\n\nNote the following limitation and recommendations:\n\n- To use Cloud Load Balancing-enabled security capabilities such as\n Cloud Armor or security policies, you must change the\n [ingress settings](/sdk/gcloud/reference/functions/deploy#--ingress-settings)\n to be `internal_and_gclb`. Users who already have the Cloud Run functions's\n default URL can otherwise bypass the load balancer and go directly to the\n function's URL.\n\n- Support for Identity-Aware Proxy integrated with Cloud Load Balancing for\n Cloud Run functions is not available."]]
