Substitua SERVICE_NAME pelo nome do
serviço do Cloud Run.
Confira se a verificação foi reativada após a implantação acessando o
endpoint HTTPS do serviço.
Configurar a política da organização para a verificação do IAM do invocador do Cloud Run
Se você for administrador, poderá restringir a capacidade de
desativar a verificação do IAM do invocador
usando a restrição gerenciada constraints/run.managed.requireInvokerIam.
Essa restrição não é aplicada por padrão.
Atribua o papel de invocador do Cloud Run IAM ao tipo de membro allUsers
É possível permitir o acesso público a um serviço atribuindo o papel de invocador do Cloud Run do IAM
ao tipo de membro allUsers.
É preciso ter a permissão run.services.setIamPolicy para configurar a autenticação
em um serviço do Cloud Run. Essa permissão está incluída no papel de administrador do Cloud Run. Confira a lista completa de papéis e permissões associadas em
Papéis do IAM do Cloud Run.
Console
Para um serviço do Cloud Run existente:
No console Google Cloud , acesse a página do Cloud Run:
À esquerda do serviço que você quer tornar público, clique na caixa de seleção. Não clique no próprio serviço.
No painel de informações no canto superior direito, clique na guia
Permissões. Se o painel de informações não estiver visível, clique em Mostrar painel de informações e em Permissões.
Clique em Adicionar principal.
No campo Novos participantes, insira o valor allUsers.
No menu Selecionar um papel, escolha o papel
Chamador do Cloud Run.
Clique em Salvar.
Você precisa selecionar uma opção para tornar esse recurso
público. Clique em Permitir acesso público para aplicar a mudança às configurações do IAM do serviço.
Para um novo serviço que você está criando, crie o serviço
e selecione Permitir acesso público na seção Autenticação
para disponibilizar o serviço publicamente. Para tornar um serviço particular, selecione
Exigir autenticação.
gcloud
Para tornar um serviço acessível publicamente, use o comando gcloud run services para adicionar o tipo de membro allUsers especial a um serviço e conceder a ele o papel roles/run.invoker:
resource"google_cloud_run_v2_service""default"{name="public-service"location="us-central1"deletion_protection=false # set to "true" in productiontemplate{containers{image="us-docker.pkg.dev/cloudrun/container/hello"}}}
Para atualizar a vinculação do IAM do serviço para roles/run.invoker, adicione
o seguinte recurso que faz referência ao serviço do Cloud Run:
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-08-21 UTC."],[],[],null,["# Allowing public (unauthenticated) access\n\nThere are two ways to create a public Cloud Run service:\n\n- [Disable](#invoker_check) the Cloud Run Invoker IAM check (recommended).\n- [Assign](#assign-allusers-iam-invoker) the Cloud Run Invoker IAM role to the `allUsers` member type.\n\n### Required roles\n\nTo disable or re-enable the Invoker IAM check on a service, you\nmust have the following permissions:\n\n- `run.services.create`\n- `run.services.update`\n- `run.services.setIamPolicy`\n\nThese permissions are included in the\n[Cloud Run Admin](/iam/docs/roles-permissions/run#run.admin)\n(`roles/run.admin`) role. See\n[Cloud Run IAM roles](/run/docs/reference/iam/roles)\nfor the full list of roles and their associated permissions.\n\n#### Disable the Cloud Run Invoker IAM check\n\nThe recommended way to make a public service is to disable the\nCloud Run Invoker IAM check.\nCloud Run enforces this check by default. Use this solution when\nthe project is subject to the\n[domain restricted sharing constraint in an organization policy](/resource-manager/docs/organization-policy/restricting-domains).\n\nTo disable the check: \n\n### Console\n\n1. In the Google Cloud console, go to the Cloud Run page:\n\n [Go to Cloud Run](https://console.cloud.google.com/run)\n2. Click **Create Service** if you are configuring a new service, then\n fill out the initial service settings page as needed.\n\n If you are configuring an existing service, click the service, then click\n the **Security** tab.\n3. Select **Allow public access**.\n\n4. Click **Create** or **Save**.\n\n### gcloud\n\n- For a new service, use the `gcloud run deploy` command with the\n `--no-invoker-iam-check` flag:\n\n ```bash\n gcloud run deploy SERVICE_NAME --no-invoker-iam-check\n ```\n\n Replace \u003cvar translate=\"no\"\u003eSERVICE_NAME\u003c/var\u003e with the service name.\n- For an existing service, use the `gcloud run services update` command with\n the `--no-invoker-iam-check` flag:\n\n ```bash\n gcloud run services update SERVICE_NAME --no-invoker-iam-check\n ```\n\nReplace \u003cvar translate=\"no\"\u003eSERVICE_NAME\u003c/var\u003e with the service name.\n\n### YAML\n\n1. To view and download the configuration:\n\n ```bash\n gcloud run services describe SERVICE --format export \u003e service.yaml\n ```\n2. Update the `run.googleapis.com/invoker-iam-disabled:` annotation:\n\n ```yaml\n apiVersion: serving.knative.dev/v1\n kind: Service\n metadata:\n annotations:\n run.googleapis.com/invoker-iam-disabled: true\n name: SERVICE_NAME\n ```\n\n Replace \u003cvar translate=\"no\"\u003eSERVICE_NAME\u003c/var\u003e with the name of your Cloud Run\n service.\n3. Replace the service with its new configuration using the following command:\n\n ```bash\n gcloud run services replace service.yaml\n ```\n\nVerify that the check is disabled after deployment by navigating to the\nservice's HTTPS endpoint.\n\n#### Re-enable the Cloud Run Invoker IAM check\n\nTo re-enable the check: \n\n### Console\n\n1. In the Google Cloud console, go to the Cloud Run page:\n\n [Go to Cloud Run](https://console.cloud.google.com/run)\n2. Click the service, then click **Security**.\n\n3. Select **Require authentication** and select **Identity and Access Management (IAM)**.\n\n4. Click **Save**.\n\n### gcloud\n\n- Update the service by passing the `--invoker-iam-check` flag:\n\n ```bash\n gcloud run services update SERVICE_NAME --invoker-iam-check\n ```\n\n Replace \u003cvar translate=\"no\"\u003eSERVICE_NAME\u003c/var\u003e with the service name.\n\n### YAML\n\n1. To view and download the configuration:\n\n ```bash\n gcloud run services describe SERVICE --format export \u003e service.yaml\n ```\n2. Update the `run.googleapis.com/invoker-iam-disabled:` annotation:\n\n \u003cbr /\u003e\n\n ```yaml\n apiVersion: serving.knative.dev/v1\n kind: Service\n metadata:\n annotations:\n run.googleapis.com/invoker-iam-disabled: false\n name: SERVICE_NAME\n ```\n\n \u003cbr /\u003e\n\n Replace \u003cvar translate=\"no\"\u003eSERVICE_NAME\u003c/var\u003e with the name of your\n Cloud Run service.\n\nVerify that the check is re-enabled after deployment by navigating to the\nservice's HTTPS endpoint.\n\n### Configure organization policy for the Cloud Run invoker IAM check\n\n| **Note:** If you participated in the invitation-only access to this feature, you might have an additional constraint (`constraints/run.requireInvokerIam`) that also controls access to the check.\n\nIf you're an administrator, you can restrict the ability to\n[disable the Invoker IAM check](#invoker_check)\nby using the `constraints/run.managed.requireInvokerIam` managed constraint.\nThis constraint is not enforced by default.\n\n### Assign the Cloud Run IAM Invoker role to the `allUsers` member type\n\n| **Important:** These instructions won't succeed if your project is under a [domain restricted sharing organization policy](/resource-manager/docs/organization-policy/restricting-domains) that restricts granting IAM roles to the `allUsers` member type as described in this page. If that is the case, you should [disable the Cloud RunIAM Invoker IAM check](#disable_invoker) instead.\n\nYou can allow public access to a service by assigning the\nCloud Run Invoker IAM role to the `allUsers` member type.\n\nYou must have the `run.services.setIamPolicy` permission to configure authentication\non a Cloud Run service. This permission is included in the\nCloud Run Admin role. See\n[Cloud Run IAM roles](/run/docs/reference/iam/roles)\nfor the full list of roles and their associated permissions. \n\n### Console\n\nFor an existing Cloud Run service:\n\n1. In the Google Cloud console, go to the Cloud Run page:\n\n [Go to Google Cloud console](https://console.cloud.google.com/run/)\n2. To the left of the service that you want to make public, click the\n checkbox. Don't click the service itself.\n\n3. In the information pane in the top-right corner, click the\n **Permissions** tab. If the information pane isn't visible, you might\n need to click **Show Info Panel** , then click **Permissions**.\n\n4. Click **Add principal**.\n\nIn the **New principals** field, enter the value `allUsers`.\n\n1. From the **Select a role** menu, select the\n **Cloud Run Invoker** role.\n\n2. Click **Save**.\n\n3. You will be prompted to verify that you would like to make this resource\n public. Click **Allow public access** to apply the change to the service\n IAM settings.\n\nFor a new service you are creating, [create the service](/run/docs/deploying#service)\nand select **Allow public access** in the **Authentication** section\nto make the service publicly available. To make a service private, select\n**Require authentication**.\n\n### gcloud\n\nTo make a service publicly accessible, use the `gcloud run services` command\nto add the special `allUsers` member type to a service and grant it the\n`roles/run.invoker` role: \n\n```bash\n gcloud run services add-iam-policy-binding [SERVICE_NAME] \\\n --member=\"allUsers\" \\\n --role=\"roles/run.invoker\"\n```\n\nRun the `gcloud run deploy` command to make your service\npublicly accessible when you deploy your service: \n\n```bash\ngcloud run deploy [SERVICE_NAME] ... --allow-unauthenticated\n```\n\n### YAML\n\nCreate a file named `policy.yaml` with the following content: \n\n bindings:\n - members:\n - allUsers\n role: roles/run.invoker\n\nAllow public access for the existing \u003cvar translate=\"no\"\u003eSERVICE\u003c/var\u003e using: \n\n```bash\ngcloud run services set-iam-policy SERVICE policy.yaml\n```\n\n### Terraform\n\nTo learn how to apply or remove a Terraform configuration, see\n[Basic Terraform commands](/docs/terraform/basic-commands).\nAdd the following to a [`google_cloud_run_v2_service`](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/cloud_run_v2_service) resource in your Terraform configuration: \n\n resource \"google_cloud_run_v2_service\" \"default\" {\n name = \"public-service\"\n location = \"us-central1\"\n\n deletion_protection = false # set to \"true\" in production\n\n template {\n containers {\n image = \"us-docker.pkg.dev/cloudrun/container/hello\"\n }\n }\n }\n\nTo update the service IAM binding for `roles/run.invoker`, add\nthe following resource referencing your Cloud Run service: \n\n resource \"google_cloud_run_service_iam_binding\" \"default\" {\n location = google_cloud_run_v2_service.default.location\n service = google_cloud_run_v2_service.default.name\n role = \"roles/run.invoker\"\n members = [\n \"allUsers\"\n ]\n }\n\nThis binding is only authoritative for the given role. Other IAM\nbindings within the service IAM policy are preserved."]]
