Allowing public (unauthenticated) access

This option is for a Cloud Run service that is a public API or website.

There are two ways to create a public Cloud Run service:

  • Disable the Cloud Run IAM Invoker check (recommended).
  • Assign the Cloud Run IAM Invoker role to the allUsers member type.

Disable the Cloud Run IAM Invoker check

The recommended way to make a public service is to disable the Cloud Run IAM Invoker check. The check is enforced by default. This is notably the solution if the project is subject to the domain restricted sharing constraint in an organization policy.

To disable or re-enable the Invoker IAM check on a service, you must have the following permissions:

  • run.services.create
  • run.services.update
  • run.services.setIamPolicy

These permissions are included in both the Owner and Cloud Run Admin roles. See [Cloud Run IAM roles][1] for the full list of roles and their associated permissions.

Disable the Cloud Run IAM Invoker IAM check

Console

  1. Go to Cloud Run

  2. Click Create Service if you are configuring a new service, then fill out the initial service settings page as needed. If you are configuring an existing service, click the service, then click Security.

  3. Clear Use Cloud IAM to authenticate incoming requests.

  4. Click Create or Save.

gcloud

  • For a new service, use the gcloud run deploy command with the --no-invoker-iam-check flag:

    gcloud run deploy SERVICE_NAME --no-invoker-iam-check

    where SERVICE_NAME is the service name.

  • For an existing service, use the gcloud run services update command with the --no-invoker-iam-check flag:

    gcloud run services update SERVICE_NAME --no-invoker-iam-check

    where SERVICE_NAME is the service name.

YAML

  1. To view and download the configuration:

    gcloud run services describe SERVICE --format export > service.yaml
  2. Update the run.googleapis.com/invoker-iam-disabled: annotation:

    apiVersion: serving.knative.dev/v1
    kind: Service
    metadata:
        annotations:
          run.googleapis.com/invoker-iam-disabled: true
        name: SERVICE_NAME

    where SERVICE_NAME is the name of your Cloud Run service.

  3. Replace the service with its new configuration using the following command:

    gcloud run services replace service.yaml

Verify that the check is disabled after deployment by navigating to the service's HTTPS endpoint.

Re-enable the Cloud Run IAM Invoker IAM check

To re-enable the check:

Console

  1. Go to Cloud Run

  2. Click the service, then click Security.

  3. Select Use Cloud IAM to authenticate incoming requests.

  4. Click Save.

gcloud

  • Update the service by passing the --invoker-iam-check flag:

    gcloud run services update SERVICE_NAME --invoker-iam-check

    where SERVICE_NAME is the service name.

YAML

  1. To view and download the configuration:

    gcloud run services describe SERVICE --format export > service.yaml
  2. Update the run.googleapis.com/invoker-iam-disabled: annotation:

    apiVersion: serving.knative.dev/v1
     kind: Service
     metadata:
        annotations:
           run.googleapis.com/invoker-iam-disabled: false
        name: SERVICE_NAME

    where SERVICE_NAME is the name of your Cloud Run service.

Verify that the check is re-enabled after deployment by navigating to the service's HTTPS endpoint.

Assign the Cloud Run IAM Invoker role to the allUsers member type

You can allow unauthenticated invocations to a service by assigning the Cloud Run Invoker IAM role to the allUsers member type.

You must have the run.services.setIamPolicy permission to configure authentication on a Cloud Run service. This permission is included in both the Owner and Cloud Run Admin roles. See Cloud Run IAM roles for the full list of roles and their associated permissions.

Console UI

For an existing Cloud Run service:

  1. Go to the Google Cloud console:

    Go to Google Cloud console

  2. Click the checkbox at the left of the service you want to make public. (Don't click the service itself.)

  3. In the information pane in the top right corner click the Permissions tab. If the information pane isn't visible, you may need to click Show Info Panel, then click Permissions.

  4. Click Add principal.

In the New principals field, enter the value allUsers

  1. From the Role drop-down menu, select the Cloud Run Invoker role.

  2. Click Save.

  3. You will be prompted to verify that you would like to make this resource public. Click Allow public access to apply the change to the service IAM settings.

For a new service you are creating, create the service but make sure you select Allow unauthenticated invocations in the Authentication tab to make the service publicly available. Selecting Require authentication will make the service private.

gcloud

To make a service publicly accessible, use the gcloud run services command to add the special allUsers member type to a service and grant it the roles/run.invoker role:

  gcloud run services add-iam-policy-binding [SERVICE_NAME] \
    --member="allUsers" \
    --role="roles/run.invoker"

Run the gcloud run deploy command to make your service publicly accessible when you deploy your service:

gcloud run deploy [SERVICE_NAME] ... --allow-unauthenticated

YAML

Create a file named policy.yaml with the following content:

bindings:
- members:
  - allUsers
  role: roles/run.invoker

Allow unauthenticated invocations for the existing SERVICE using:

gcloud run services set-iam-policy SERVICE policy.yaml

Terraform

To create a Cloud Run service, add the following to your to your existing main.tf file:

resource "google_cloud_run_v2_service" "default" {
  name     = "public-service"
  location = "us-central1"

  deletion_protection = false # set to "true" in production

  template {
    containers {
      image = "us-docker.pkg.dev/cloudrun/container/hello"
    }
  }
}

To update the service IAM binding for roles/run.invoker, add the following resource referencing your Cloud Run service:

resource "google_cloud_run_service_iam_binding" "default" {
  location = google_cloud_run_v2_service.default.location
  service  = google_cloud_run_v2_service.default.name
  role     = "roles/run.invoker"
  members = [
    "allUsers"
  ]
}

This binding is only authoritative for the given role. Other IAM bindings within the service IAM policy are preserved.