There are two ways to create a public Cloud Run service:
- Disable the Cloud Run Invoker IAM check (recommended).
- Assign the Cloud Run Invoker IAM role to the
allUsers
member type.
Required roles
To disable or re-enable the Invoker IAM check on a service, you must have the following permissions:
run.services.create
run.services.update
run.services.setIamPolicy
These permissions are included in the
Cloud Run Admin
(roles/run.admin
) role. See
Cloud Run IAM roles
for the full list of roles and their associated permissions.
Disable the Cloud Run Invoker IAM check
The recommended way to make a public service is to disable the Cloud Run Invoker IAM check. Cloud Run enforces this check by default. Use this solution when the project is subject to the domain restricted sharing constraint in an organization policy.
To disable the check:
Console
In the Google Cloud console, go to the Cloud Run page:
Click Create Service if you are configuring a new service, then fill out the initial service settings page as needed.
If you are configuring an existing service, click the service, then click the Security tab.
Select Allow public access.
Click Create or Save.
gcloud
For a new service, use the
gcloud run deploy
command with the--no-invoker-iam-check
flag:gcloud run deploy SERVICE_NAME --no-invoker-iam-check
Replace
SERVICE_NAME
with the service name.For an existing service, use the
gcloud run services update
command with the--no-invoker-iam-check
flag:gcloud run services update SERVICE_NAME --no-invoker-iam-check
Replace SERVICE_NAME
with the service name.
YAML
To view and download the configuration:
gcloud run services describe SERVICE --format export > service.yaml
Update the
run.googleapis.com/invoker-iam-disabled:
annotation:apiVersion: serving.knative.dev/v1 kind: Service metadata: annotations: run.googleapis.com/invoker-iam-disabled: true name: SERVICE_NAME
Replace SERVICE_NAME with the name of your Cloud Run service.
Replace the service with its new configuration using the following command:
gcloud run services replace service.yaml
Verify that the check is disabled after deployment by navigating to the service's HTTPS endpoint.
Re-enable the Cloud Run Invoker IAM check
To re-enable the check:
Console
In the Google Cloud console, go to the Cloud Run page:
Click the service, then click Security.
Select Require authentication and select Identity and Access Management (IAM).
Click Save.
gcloud
Update the service by passing the
--invoker-iam-check
flag:gcloud run services update SERVICE_NAME --invoker-iam-check
Replace
SERVICE_NAME
with the service name.
YAML
To view and download the configuration:
gcloud run services describe SERVICE --format export > service.yaml
Update the
run.googleapis.com/invoker-iam-disabled:
annotation:apiVersion: serving.knative.dev/v1 kind: Service metadata: annotations: run.googleapis.com/invoker-iam-disabled: false name: SERVICE_NAME
Replace
SERVICE_NAME
with the name of your Cloud Run service.
Verify that the check is re-enabled after deployment by navigating to the service's HTTPS endpoint.
Configure organization policy for the Cloud Run invoker IAM check
If you're an administrator, you can restrict the ability to
disable the Invoker IAM check
by using the constraints/run.managed.requireInvokerIam
managed constraint.
This constraint is not enforced by default.
Assign the Cloud Run IAM Invoker role to the allUsers
member type
You can allow public access to a service by assigning the
Cloud Run Invoker IAM role to the allUsers
member type.
You must have the run.services.setIamPolicy
permission to configure authentication
on a Cloud Run service. This permission is included in the
Cloud Run Admin role. See
Cloud Run IAM roles
for the full list of roles and their associated permissions.
Console
For an existing Cloud Run service:
In the Google Cloud console, go to the Cloud Run page:
To the left of the service that you want to make public, click the checkbox. Don't click the service itself.
In the information pane in the top-right corner, click the Permissions tab. If the information pane isn't visible, you might need to click Show Info Panel, then click Permissions.
Click Add principal.
In the New principals field, enter the value allUsers
.
From the Select a role menu, select the Cloud Run Invoker role.
Click Save.
You will be prompted to verify that you would like to make this resource public. Click Allow public access to apply the change to the service IAM settings.
For a new service you are creating, create the service and select Allow public access in the Authentication section to make the service publicly available. To make a service private, select Require authentication.
gcloud
To make a service publicly accessible, use the gcloud run services
command
to add the special allUsers
member type to a service and grant it the
roles/run.invoker
role:
gcloud run services add-iam-policy-binding [SERVICE_NAME] \ --member="allUsers" \ --role="roles/run.invoker"
Run the gcloud run deploy
command to make your service
publicly accessible when you deploy your service:
gcloud run deploy [SERVICE_NAME] ... --allow-unauthenticated
YAML
Create a file named policy.yaml
with the following content:
bindings:
- members:
- allUsers
role: roles/run.invoker
Allow public access for the existing SERVICE using:
gcloud run services set-iam-policy SERVICE policy.yaml
Terraform
To learn how to apply or remove a Terraform configuration, see Basic Terraform commands.
Add the following to agoogle_cloud_run_v2_service
resource in your Terraform configuration:To update the service IAM binding for roles/run.invoker
, add
the following resource referencing your Cloud Run service:
This binding is only authoritative for the given role. Other IAM bindings within the service IAM policy are preserved.