Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Ada dua cara untuk membuat layanan Cloud Run publik:
Nonaktifkan pemeriksaan IAM Cloud Run Invoker (direkomendasikan).
Tetapkan peran IAM Cloud Run Invoker ke jenis anggota allUsers.
Peran yang diperlukan
Untuk menonaktifkan atau mengaktifkan kembali pemeriksaan IAM Pemanggil pada layanan, Anda
harus memiliki izin berikut:
run.services.create
run.services.update
run.services.setIamPolicy
Izin ini disertakan dalam peran
Admin Cloud Run
(roles/run.admin). Lihat
Peran IAM Cloud Run
untuk mengetahui daftar lengkap peran dan izin terkaitnya.
Menonaktifkan pemeriksaan IAM Cloud Run Invoker
Cara yang direkomendasikan untuk membuat layanan publik adalah dengan menonaktifkan pemeriksaan IAM Cloud Run Invoker.
Cloud Run menerapkan pemeriksaan ini secara default. Gunakan solusi ini saat project tunduk pada
batasan berbagi yang dibatasi domain dalam kebijakan organisasi.
Ganti SERVICE_NAME dengan nama layanan Cloud Run Anda
Pastikan pemeriksaan diaktifkan kembali setelah deployment dengan membuka
endpoint HTTPS layanan.
Mengonfigurasi kebijakan organisasi untuk pemeriksaan IAM pemanggil Cloud Run
Jika Anda adalah administrator, Anda dapat membatasi kemampuan untuk
menonaktifkan pemeriksaan IAM Pemanggil
dengan menggunakan batasan terkelola constraints/run.managed.requireInvokerIam.
Batasan ini tidak diterapkan secara default.
Tetapkan peran Cloud Run IAM Invoker ke jenis anggota allUsers
Anda dapat mengizinkan akses publik ke layanan dengan menetapkan
peran IAM Cloud Run Invoker ke jenis anggota allUsers.
Anda harus memiliki izin run.services.setIamPolicy untuk mengonfigurasi autentikasi
pada layanan Cloud Run. Izin ini disertakan dalam
peran Cloud Run Admin. Lihat
Peran IAM Cloud Run
untuk mengetahui daftar lengkap peran dan izin terkaitnya.
Di sebelah kiri layanan yang ingin Anda publikasikan, klik kotak centang. Jangan mengklik layanan itu sendiri.
Di panel informasi di pojok kanan atas, klik tab
Izin. Jika panel informasi tidak terlihat, Anda mungkin
perlu mengklik Tampilkan Panel Info, lalu klik Izin.
Klik Tambahkan akun utama.
Di kolom Akun utama baru, masukkan nilai allUsers.
Dari menu Select a role, pilih peran
Cloud Run Invoker.
Klik Simpan.
Anda akan diminta untuk memverifikasi bahwa Anda ingin menjadikan referensi ini publik. Klik Izinkan akses publik untuk menerapkan perubahan pada setelan IAM layanan.
Untuk layanan baru yang Anda buat, buat layanan
dan pilih Izinkan akses publik di bagian Autentikasi
untuk membuat layanan tersedia untuk publik. Untuk membuat layanan menjadi pribadi, pilih
Wajibkan autentikasi.
gcloud
Untuk membuat layanan dapat diakses secara publik, gunakan perintah gcloud run services
untuk menambahkan jenis anggota allUsers khusus ke layanan dan memberikan peran
roles/run.invoker:
resource"google_cloud_run_v2_service""default"{name="public-service"location="us-central1"deletion_protection=false # set to "true" in productiontemplate{containers{image="us-docker.pkg.dev/cloudrun/container/hello"}}}
Untuk memperbarui binding IAM layanan untuk roles/run.invoker, tambahkan resource berikut yang merujuk ke layanan Cloud Run Anda:
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-21 UTC."],[],[],null,["# Allowing public (unauthenticated) access\n\nThere are two ways to create a public Cloud Run service:\n\n- [Disable](#invoker_check) the Cloud Run Invoker IAM check (recommended).\n- [Assign](#assign-allusers-iam-invoker) the Cloud Run Invoker IAM role to the `allUsers` member type.\n\n### Required roles\n\nTo disable or re-enable the Invoker IAM check on a service, you\nmust have the following permissions:\n\n- `run.services.create`\n- `run.services.update`\n- `run.services.setIamPolicy`\n\nThese permissions are included in the\n[Cloud Run Admin](/iam/docs/roles-permissions/run#run.admin)\n(`roles/run.admin`) role. See\n[Cloud Run IAM roles](/run/docs/reference/iam/roles)\nfor the full list of roles and their associated permissions.\n\n#### Disable the Cloud Run Invoker IAM check\n\nThe recommended way to make a public service is to disable the\nCloud Run Invoker IAM check.\nCloud Run enforces this check by default. Use this solution when\nthe project is subject to the\n[domain restricted sharing constraint in an organization policy](/resource-manager/docs/organization-policy/restricting-domains).\n\nTo disable the check: \n\n### Console\n\n1. In the Google Cloud console, go to the Cloud Run page:\n\n [Go to Cloud Run](https://console.cloud.google.com/run)\n2. Click **Create Service** if you are configuring a new service, then\n fill out the initial service settings page as needed.\n\n If you are configuring an existing service, click the service, then click\n the **Security** tab.\n3. Select **Allow public access**.\n\n4. Click **Create** or **Save**.\n\n### gcloud\n\n- For a new service, use the `gcloud run deploy` command with the\n `--no-invoker-iam-check` flag:\n\n ```bash\n gcloud run deploy SERVICE_NAME --no-invoker-iam-check\n ```\n\n Replace \u003cvar translate=\"no\"\u003eSERVICE_NAME\u003c/var\u003e with the service name.\n- For an existing service, use the `gcloud run services update` command with\n the `--no-invoker-iam-check` flag:\n\n ```bash\n gcloud run services update SERVICE_NAME --no-invoker-iam-check\n ```\n\nReplace \u003cvar translate=\"no\"\u003eSERVICE_NAME\u003c/var\u003e with the service name.\n\n### YAML\n\n1. To view and download the configuration:\n\n ```bash\n gcloud run services describe SERVICE --format export \u003e service.yaml\n ```\n2. Update the `run.googleapis.com/invoker-iam-disabled:` annotation:\n\n ```yaml\n apiVersion: serving.knative.dev/v1\n kind: Service\n metadata:\n annotations:\n run.googleapis.com/invoker-iam-disabled: true\n name: SERVICE_NAME\n ```\n\n Replace \u003cvar translate=\"no\"\u003eSERVICE_NAME\u003c/var\u003e with the name of your Cloud Run\n service.\n3. Replace the service with its new configuration using the following command:\n\n ```bash\n gcloud run services replace service.yaml\n ```\n\nVerify that the check is disabled after deployment by navigating to the\nservice's HTTPS endpoint.\n\n#### Re-enable the Cloud Run Invoker IAM check\n\nTo re-enable the check: \n\n### Console\n\n1. In the Google Cloud console, go to the Cloud Run page:\n\n [Go to Cloud Run](https://console.cloud.google.com/run)\n2. Click the service, then click **Security**.\n\n3. Select **Require authentication** and select **Identity and Access Management (IAM)**.\n\n4. Click **Save**.\n\n### gcloud\n\n- Update the service by passing the `--invoker-iam-check` flag:\n\n ```bash\n gcloud run services update SERVICE_NAME --invoker-iam-check\n ```\n\n Replace \u003cvar translate=\"no\"\u003eSERVICE_NAME\u003c/var\u003e with the service name.\n\n### YAML\n\n1. To view and download the configuration:\n\n ```bash\n gcloud run services describe SERVICE --format export \u003e service.yaml\n ```\n2. Update the `run.googleapis.com/invoker-iam-disabled:` annotation:\n\n \u003cbr /\u003e\n\n ```yaml\n apiVersion: serving.knative.dev/v1\n kind: Service\n metadata:\n annotations:\n run.googleapis.com/invoker-iam-disabled: false\n name: SERVICE_NAME\n ```\n\n \u003cbr /\u003e\n\n Replace \u003cvar translate=\"no\"\u003eSERVICE_NAME\u003c/var\u003e with the name of your\n Cloud Run service.\n\nVerify that the check is re-enabled after deployment by navigating to the\nservice's HTTPS endpoint.\n\n### Configure organization policy for the Cloud Run invoker IAM check\n\n| **Note:** If you participated in the invitation-only access to this feature, you might have an additional constraint (`constraints/run.requireInvokerIam`) that also controls access to the check.\n\nIf you're an administrator, you can restrict the ability to\n[disable the Invoker IAM check](#invoker_check)\nby using the `constraints/run.managed.requireInvokerIam` managed constraint.\nThis constraint is not enforced by default.\n\n### Assign the Cloud Run IAM Invoker role to the `allUsers` member type\n\n| **Important:** These instructions won't succeed if your project is under a [domain restricted sharing organization policy](/resource-manager/docs/organization-policy/restricting-domains) that restricts granting IAM roles to the `allUsers` member type as described in this page. If that is the case, you should [disable the Cloud RunIAM Invoker IAM check](#disable_invoker) instead.\n\nYou can allow public access to a service by assigning the\nCloud Run Invoker IAM role to the `allUsers` member type.\n\nYou must have the `run.services.setIamPolicy` permission to configure authentication\non a Cloud Run service. This permission is included in the\nCloud Run Admin role. See\n[Cloud Run IAM roles](/run/docs/reference/iam/roles)\nfor the full list of roles and their associated permissions. \n\n### Console\n\nFor an existing Cloud Run service:\n\n1. In the Google Cloud console, go to the Cloud Run page:\n\n [Go to Google Cloud console](https://console.cloud.google.com/run/)\n2. To the left of the service that you want to make public, click the\n checkbox. Don't click the service itself.\n\n3. In the information pane in the top-right corner, click the\n **Permissions** tab. If the information pane isn't visible, you might\n need to click **Show Info Panel** , then click **Permissions**.\n\n4. Click **Add principal**.\n\nIn the **New principals** field, enter the value `allUsers`.\n\n1. From the **Select a role** menu, select the\n **Cloud Run Invoker** role.\n\n2. Click **Save**.\n\n3. You will be prompted to verify that you would like to make this resource\n public. Click **Allow public access** to apply the change to the service\n IAM settings.\n\nFor a new service you are creating, [create the service](/run/docs/deploying#service)\nand select **Allow public access** in the **Authentication** section\nto make the service publicly available. To make a service private, select\n**Require authentication**.\n\n### gcloud\n\nTo make a service publicly accessible, use the `gcloud run services` command\nto add the special `allUsers` member type to a service and grant it the\n`roles/run.invoker` role: \n\n```bash\n gcloud run services add-iam-policy-binding [SERVICE_NAME] \\\n --member=\"allUsers\" \\\n --role=\"roles/run.invoker\"\n```\n\nRun the `gcloud run deploy` command to make your service\npublicly accessible when you deploy your service: \n\n```bash\ngcloud run deploy [SERVICE_NAME] ... --allow-unauthenticated\n```\n\n### YAML\n\nCreate a file named `policy.yaml` with the following content: \n\n bindings:\n - members:\n - allUsers\n role: roles/run.invoker\n\nAllow public access for the existing \u003cvar translate=\"no\"\u003eSERVICE\u003c/var\u003e using: \n\n```bash\ngcloud run services set-iam-policy SERVICE policy.yaml\n```\n\n### Terraform\n\nTo learn how to apply or remove a Terraform configuration, see\n[Basic Terraform commands](/docs/terraform/basic-commands).\nAdd the following to a [`google_cloud_run_v2_service`](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/cloud_run_v2_service) resource in your Terraform configuration: \n\n resource \"google_cloud_run_v2_service\" \"default\" {\n name = \"public-service\"\n location = \"us-central1\"\n\n deletion_protection = false # set to \"true\" in production\n\n template {\n containers {\n image = \"us-docker.pkg.dev/cloudrun/container/hello\"\n }\n }\n }\n\nTo update the service IAM binding for `roles/run.invoker`, add\nthe following resource referencing your Cloud Run service: \n\n resource \"google_cloud_run_service_iam_binding\" \"default\" {\n location = google_cloud_run_v2_service.default.location\n service = google_cloud_run_v2_service.default.name\n role = \"roles/run.invoker\"\n members = [\n \"allUsers\"\n ]\n }\n\nThis binding is only authoritative for the given role. Other IAM\nbindings within the service IAM policy are preserved."]]
