By default, only project owners and editors can create, update, delete, or invoke Cloud Run resources, and only project owners and Cloud Run Admins can modify Identity and Access Management (IAM) policies---for example, to make a service public. Refer to [Cloud Run IAM roles](https://docs.cloud.google.com/run/docs/reference/iam/roles) for details. To grant other principals or groups the ability to perform these actions, use [IAM](https://docs.cloud.google.com/iam) to grant **roles** to different [principals](https://docs.cloud.google.com/iam/docs/overview#how_cloud_iam_works). If you've created or deployed functions using [`gcloud functions`](https://docs.cloud.google.com/sdk/gcloud/reference/functions) commands or the [Cloud Functions v2 APIs](https://docs.cloud.google.com/functions/docs/reference/rest) and need to use these options for backward compatibility, see [Access control with IAM](https://docs.cloud.google.com/functions/docs/concepts/iam). ## Cloud Run predefined roles Compared to basic roles (Owner, Editor, and Viewer), the following predefined roles have finer-grained access control for accessing Cloud Run resources: | Role | Description | |---|---| | Cloud Run Admin (`roles/run.admin`) | Can create, update, and delete services, jobs, and worker pools, can get, list, delete job executions. Can invoke services and jobs, can cancel job executions. Can get and set IAM policies. Can view, apply and dismiss [recommendations](https://docs.cloud.google.com/run/docs/recommender). Requires [additional configuration](https://docs.cloud.google.com/run/docs/reference/iam/roles#additional-configuration) in order to deploy services. | | Cloud Run Developer (`roles/run.developer`) | Can create, update, and delete services, jobs, and worker pools, can get, list, delete job executions. Can get but *not* set IAM policies. Can view, apply and dismiss [recommendations](https://docs.cloud.google.com/run/docs/recommender). | | Cloud Run Viewer (`roles/run.viewer`) | Can view services, jobs, job executions, and worker pools. Can get IAM policies. Can view [recommendations](https://docs.cloud.google.com/run/docs/recommender). | | Cloud Run Invoker (`roles/run.invoker`) | Can invoke services and jobs, can cancel job executions. | | Cloud Run Source Developer (`roles/run.sourceDeveloper`) | Can deploy and manage Cloud Run source-deployed resources. | | Cloud Run Builder (`roles/run.builder`) | Can build Cloud Run functions and source-deployed services. | | Cloud Run Service Invoker (`roles/run.servicesInvoker`) | Can invoke Cloud Run services. | | Cloud Run Jobs Executor (`roles/run.jobsExecutor`) | Can execute and cancel Cloud Run jobs. | | Cloud Run Jobs Executor With Overrides (`roles/run.jobsExecutorWithOverrides`) | Can execute and cancel Cloud Run jobs with overrides. | ## Control access on an individual Cloud Run resource You can control access on a per-service, per-job, per-worker-pool, or per-instance basis using IAM. Service Job Worker pool Instance ### Add principals To add principals to a service: ### Console 1. In the Google Cloud console, go to the **Cloud Run** page: [Go to Cloud Run](https://console.cloud.google.com/run/) 2. Click the checkbox next to the service that you want to add principals to. Don't click the service itself. 3. In the information pane in the top right corner click the **Permissions** tab. If the information pane isn't visible, you may need to click **Show Info Panel** , then click **Permissions**. 4. Click **Add principal**. 5. In the **New principals** field, enter one or more identities that need access to your service. 6. From the **Assign roles** drop-down menu, select a role or roles. The roles you select appear in the pane with a short description of the permissions they grant. 7. Click **Save**. ### gcloud Use the following command: ```bash gcloud run services add-iam-policy-binding SERVICE_NAME \ --member=PRINCIPAL \ --role=ROLE ``` Replace the following: - `SERVICE_NAME`: the service name. - `PRINCIPAL`: the principal type (e.g. `user:email@domain.com`). For a list of acceptable values for `PRINCIPAL`, see [Principal identifiers](https://docs.cloud.google.com/iam/docs/principal-identifiers). - `ROLE`: the role. For a list of acceptable values for `ROLE`, see [Cloud Run IAM roles](https://docs.cloud.google.com/run/docs/reference/iam/roles). To add principals to a job: ### Console 1. In the Google Cloud console, go to the **Cloud Run** page: [Go to Cloud Run](https://console.cloud.google.com/run/jobs/) 2. Click the checkbox at the left of the job you want to add principals to. Don't click the job itself. 3. In the information pane in the top right corner click the **Permissions** tab. If the information pane isn't visible, you may need to click **Show Info Panel** , then click **Permissions**. 4. Click **Add principal**. 5. In the **New principals** field, enter one or more identities that need access to your job. 6. From the **Assign roles** menu, select a role or roles. The roles you select appear in the pane with a short description of the permissions they grant. 7. Click **Save**. ### gcloud Use the following command: ```bash gcloud run jobs add-iam-policy-binding JOB_NAME \ --member=PRINCIPAL \ --role=ROLE ``` Replace the following: - `JOB_NAME`: the job name. - `PRINCIPAL`: the principal type (e.g. `user:email@domain.com`). For a list of acceptable values for `PRINCIPAL`, see the [Principal identifiers](https://docs.cloud.google.com/iam/docs/principal-identifiers). - `ROLE`: the role. For a list of acceptable values for `ROLE`, see [Cloud Run IAM roles](https://docs.cloud.google.com/run/docs/reference/iam/roles). To add principals to a worker pool: ### Console 1. In the Google Cloud console, go to the **Cloud Run** page: [Go to Cloud Run](https://console.cloud.google.com/run/worker-pools) 2. Click the checkbox next to the worker pool you want to add principals to. Don't click the worker pool itself. 3. In the information pane in the top right corner click the **Permissions** tab. If the information pane isn't visible, you may need to click **Show Info Panel** , then click **Permissions**. 4. Click **Add principal**. 5. In the **New principals** field, enter one or more identities that need access to your worker pool. 6. From the **Assign roles** menu, select a role or roles. The roles you select appear in the pane with a short description of the permissions they grant. 7. Click **Save**. ### gcloud Use the following command: ```bash gcloud run worker-pools add-iam-policy-binding WORKER_POOL \ --member=PRINCIPAL \ --role=ROLE ``` Replace the following: - `WORKER_POOL`: the worker pool name. - `PRINCIPAL`: the principal type (e.g. `user:email@domain.com`). For a list of acceptable values for `PRINCIPAL`, see the [Principal identifiers](https://docs.cloud.google.com/iam/docs/principal-identifiers). - `ROLE`: the role. For a list of acceptable values for `ROLE`, see [Cloud Run IAM roles](https://docs.cloud.google.com/run/docs/reference/iam/roles). To add principals to an instance: ### gcloud Use the following command: ```bash gcloud beta run instances add-iam-policy-binding INSTANCE_NAME \ --member=PRINCIPAL \ --role=ROLE ``` Replace the following: - `INSTANCE_NAME`: the instance name. - `PRINCIPAL`: the principal type (e.g. `user:email@domain.com`). For a list of acceptable values for `PRINCIPAL`, see the [Principal identifiers](https://docs.cloud.google.com/iam/docs/principal-identifiers). - `ROLE`: the role. For a list of acceptable values for `ROLE`, see [Cloud Run IAM roles](https://docs.cloud.google.com/run/docs/reference/iam/roles). ### Remove principals from a role To remove principals from a role for a service: ### Console 1. In the Google Cloud console, go to the **Cloud Run** page: [Go to Cloud Run](https://console.cloud.google.com/run/) 2. Click the checkbox next to the service you want to remove principals from. Don't click the service itself. 3. In the information pane in the top right corner click the **Permissions** tab. If the information pane isn't visible, you may need to click **Show Info Panel** , then click **Permissions**. 4. Enter the principal you want to remove in the roles list filter, which displays all roles granted to that principal. 5. Click the **delete** trash can next to the principal within the desired role to remove that role from the principal. 6. In the confirmation dialog, you have the option to remove that principal from all roles in the service. Click **Remove** to remove the principal from the role. ### gcloud Use the following command: ```bash gcloud run services remove-iam-policy-binding SERVICE_NAME \ --member=PRINCIPAL \ --role=ROLE ``` Replace the following: - `SERVICE_NAME`: the service name. - `PRINCIPAL`: the principal type (e.g. `user:email@domain.com`). For a list of acceptable values for `PRINCIPAL`, see the [Principal identifiers](https://docs.cloud.google.com/iam/docs/principal-identifiers). - `ROLE`: the role. For a list of acceptable values for `ROLE`, see [Cloud Run IAM roles](https://docs.cloud.google.com/run/docs/reference/iam/roles). To remove principals from a role for a job: ### Console 1. In the Google Cloud console, go to the **Cloud Run** page: [Go to Cloud Run](https://console.cloud.google.com/run/jobs/) 2. Click the checkbox at the left of the job you want to add principals to. Don't click the job itself. 3. In the information pane in the top right corner click the **Permissions** tab. If the information pane isn't visible, you may need to click **Show Info Panel** , then click **Permissions**. 4. Enter the principal you want to remove in the roles list filter, which displays all roles granted to that principal. 5. Click the **delete** trash can next to the principal within the desired role to remove that role from the principal. 6. In the confirmation dialog, you have the option to remove that principal from all roles in the job. Click **Remove** to remove the principal from the role. ### gcloud Use the following command: ```bash gcloud run jobs remove-iam-policy-binding JOB_NAME \ --member=PRINCIPAL \ --role=ROLE ``` Replace the following: - `JOB_NAME`: the job name. - `PRINCIPAL`: the principal type (e.g. `user:email@domain.com`). For a list of acceptable values for `PRINCIPAL`, see the [Principal identifiers](https://docs.cloud.google.com/iam/docs/principal-identifiers). - `ROLE`: the role. For a list of acceptable values for `ROLE`, see [Cloud Run IAM roles](https://docs.cloud.google.com/run/docs/reference/iam/roles). To remove principals from a role for a worker pool: ### Console 1. In the Google Cloud console, go to the **Cloud Run** page: [Go to Cloud Run](https://console.cloud.google.com/run/worker-pools) 2. Click the checkbox next to the worker pool you want to remove principals from. Don't click the worker pool itself. 3. In the information pane in the top right corner click the **Permissions** tab. If the information pane isn't visible, you may need to click **Show Info Panel** , then click **Permissions**. 4. Enter the principal you want to remove in the roles list filter, which displays all roles granted to that principal. 5. Click the **delete** trash can next to the principal within the desired role to remove that role from the principal. 6. In the confirmation dialog, you have the option to remove that principal from all roles in the worker pool. Click **Remove** to remove the principal from the role. ### gcloud Use the following command: ```bash gcloud run worker-pools remove-iam-policy-binding WORKER_POOL \ --member=PRINCIPAL \ --role=ROLE ``` Replace the following: - `WORKER_POOL`: the worker pool name. - `PRINCIPAL`: the principal type (e.g. `user:email@domain.com`). For a list of acceptable values for `PRINCIPAL`, see the [Principal identifiers](https://docs.cloud.google.com/iam/docs/principal-identifiers). - `ROLE`: the role. For a list of acceptable values for `ROLE`, see [Cloud Run IAM roles](https://docs.cloud.google.com/run/docs/reference/iam/roles). To remove principals from a role for an instance: ### gcloud Use the following command: ```bash gcloud beta run instances remove-iam-policy-binding INSTANCE_NAME \ --member=PRINCIPAL \ --role=ROLE ``` Replace the following: - `INSTANCE_NAME`: the instance name. - `PRINCIPAL`: the principal type (e.g. `user:email@domain.com`). For a list of acceptable values for `PRINCIPAL`, see the [Principal identifiers](https://docs.cloud.google.com/iam/docs/principal-identifiers). - `ROLE`: the role. For a list of acceptable values for `ROLE`, see [Cloud Run IAM roles](https://docs.cloud.google.com/run/docs/reference/iam/roles). ### Bulk addition or removal of principals To do a bulk add or remove for a service: ### Console 1. In the Google Cloud console, go to the **Cloud Run** page: [Go to Cloud Run](https://console.cloud.google.com/run/) 2. Click the checkbox at the left of the service you want to add principals to or remove principals from. Don't click the service itself. 3. Select the service you want to add principals to or remove principals from. 4. In the information pane in the top right corner click the **Permissions** tab. If the information pane isn't visible, you may need to click **Show Info Panel** , then click **Permissions**. If you want to add principals: 1. Click **Add principal**. 2. In the **New principals** field, enter one or more identities that need access to your service. 3. From the **Assign roles** menu, select a role (or roles). The roles you select appear in the pane with a short description of the permissions they grant. 4. Click **Save**. If you want to remove principals: 1. Enter the principal you want to remove in the roles list filter, which displays all roles granted to that principal. 2. Click the **delete** trash can on the row of the principal. 3. In the confirmation dialog, you have the option to remove that principal from all roles in the service. Click **Remove** to remove the principal from the role. ### gcloud Create an IAM policy: ```bash cat < policy.json { "bindings": [ { "role": ROLE, "members": [ PRINCIPAL ] } ] } EOF ``` Use the `gcloud run services set-iam-policy` command: ```bash gcloud run services set-iam-policy SERVICE_NAME policy.json ``` For a list of acceptable values for `PRINCIPAL`, see the [Principal identifiers](https://docs.cloud.google.com/iam/docs/principal-identifiers). For a list of acceptable values for `ROLE`, see [Cloud Run IAM roles](https://docs.cloud.google.com/run/docs/reference/iam/roles). To do a bulk add or remove for a job: ### Console 1. In the Google Cloud console, go to the **Cloud Run** page: [Go to Cloud Run](https://console.cloud.google.com/run/jobs/) 2. Click the checkbox at the left of the job you want to add principals to. Don't click the job itself. 3. Select the job you want to add principals to or remove principals from. 4. In the information pane in the top right corner click the **Permissions** tab. If the information pane isn't visible, you may need to click **Show Info Panel** , then click **Permissions**. If you want to add principals: 1. Click **Add principal**. 2. In the **New principals** field, enter one or more identities that need access to your service. 3. From the **Assign roles** menu, select a role (or roles). The roles you select appear in the pane with a short description of the permissions they grant. 4. Click **Save**. If you want to remove principals: 1. Enter the principal you want to remove in the roles list filter, which displays all roles granted to that principal. 2. Click the **delete** trash can on the row of the principal. 3. In the confirmation dialog, you have the option to remove that principal from all roles in the job. Click **Remove** to remove the principal from the role. ### gcloud Create an IAM policy: ```bash cat < policy.json { "bindings": [ { "role": ROLE, "members": [ PRINCIPAL ] } ] } EOF ``` Use the `gcloud run jobs set-iam-policy` command: ```bash gcloud run jobs set-iam-policy JOB_NAME policy.json ``` For a list of acceptable values for `PRINCIPAL`, see the [Principal identifiers](https://docs.cloud.google.com/iam/docs/principal-identifiers). For a list of acceptable values for `ROLE`, see [Cloud Run IAM roles](https://docs.cloud.google.com/run/docs/reference/iam/roles). To do a bulk add or remove for a worker pool: ### Console 1. In the Google Cloud console, go to the **Cloud Run** page: [Go to Cloud Run](https://console.cloud.google.com/run/worker-pools) 2. Click the checkbox next to the worker pool you want to add principals to or remove principals from. Don't click the worker pool itself. 3. Select the worker pool you want to add principals to or remove principals from. 4. In the information pane in the top right corner click the **Permissions** tab. If the information pane isn't visible, you may need to click **Show Info Panel** , then click **Permissions**. If you want to add principals: 1. Click **Add principal**. 2. In the **New principals** field, enter one or more identities that need access to your worker pool. 3. From the **Assign roles** menu, select a role (or roles). The roles you select appear in the pane with a short description of the permissions they grant. 4. Click **Save**. If you want to remove principals: 1. Enter the principal you want to remove in the roles list filter, which displays all roles granted to that principal. 2. Click the **delete** trash can on the row of the principal. 3. In the confirmation dialog, you have the option to remove that principal from all roles in the worker pool. Click **Remove** to remove the principal from the role. ### gcloud Create an IAM policy: ```bash cat < policy.json { "bindings": [ { "role": ROLE, "members": [ PRINCIPAL ] } ] } EOF ``` Use the `gcloud run worker-pools set-iam-policy` command: ```bash gcloud run worker-pools set-iam-policy WORKER_POOL policy.json ``` For a list of acceptable values for `PRINCIPAL`, see the [Principal identifiers](https://docs.cloud.google.com/iam/docs/principal-identifiers). For a list of acceptable values for `ROLE`, see [Cloud Run IAM roles](https://docs.cloud.google.com/run/docs/reference/iam/roles). To do a bulk add or remove for an instance: ### gcloud Create an IAM policy: ```bash cat < policy.json { "bindings": [ { "role": ROLE, "members": [ PRINCIPAL ] } ] } EOF ``` Use the `gcloud beta run instances set-iam-policy` command: ```bash gcloud beta run instances set-iam-policy INSTANCE_NAME policy.json ``` For a list of acceptable values for `PRINCIPAL`, see the [Principal identifiers](https://docs.cloud.google.com/iam/docs/principal-identifiers). For a list of acceptable values for `ROLE`, see [Cloud Run IAM roles](https://docs.cloud.google.com/run/docs/reference/iam/roles). ### View principals To view principals for a service: ### Console 1. In the Google Cloud console, go to the **Cloud Run** page: [Go to Cloud Run](https://console.cloud.google.com/run/) 2. Click the checkbox at the left of the service you want to view for principals and roles. Don't click the service itself. 3. Select the service you want to view for principals and roles. 4. In the information pane in the top right corner click the **Permissions** tab. If the information pane isn't visible, you may need to click **Show Info Panel** , then click **Permissions**. 5. The list of roles and principals will be shown, grouped by role granted. ### gcloud Use the following command: ```bash gcloud run services get-iam-policy SERVICE_NAME ``` To view principals for a job: ### Console 1. In the Google Cloud console, go to the **Cloud Run** page: [Go to Cloud Run](https://console.cloud.google.com/run/jobs/) 2. Click the checkbox at the left of the job you want to add principals to. Don't click the job itself. 3. Select the job you want to view for principals and roles. 4. In the information pane in the top right corner click the **Permissions** tab. If the information pane isn't visible, you may need to click **Show Info Panel** , then click **Permissions**. 5. The list of roles and principals will be shown, grouped by role granted. ### gcloud Use the following command: ```bash gcloud run jobs get-iam-policy JOB_NAME ``` To view principals for a worker pool: ### Console 1. In the Google Cloud console, go to the **Cloud Run** page: [Go to Cloud Run](https://console.cloud.google.com/run/worker-pools) 2. Click the checkbox next to the worker pool you want to view for principals and roles. Don't click the worker pool itself. 3. Select the worker pool you want to view for principals and roles. 4. In the information pane in the top right corner click the **Permissions** tab. If the information pane isn't visible, you may need to click **Show Info Panel** , then click **Permissions**. 5. The list of roles and principals will be shown, grouped by role granted. ### gcloud Use the following command: ```bash gcloud run worker-pools get-iam-policy WORKER_POOL ``` To view principals for an instance: ### gcloud Use the following command: ```bash gcloud beta run instances get-iam-policy INSTANCE_NAME ``` ## Control access on all Cloud Run resources in a project If you want to grant roles to principals on **all** resources in a project, you can use [project-level IAM](https://docs.cloud.google.com/iam/docs/granting-changing-revoking-access). ### Console 1. In the Google Cloud console, go to the **IAM** page: [Go to IAM](https://console.cloud.google.com/iam-admin/iam) 2. Find the principal you want to grant a project-wide role. 3. Click the edit **Pencil** on the right side of the principal's row. 4. Click **Add another role** and pick the needed role. 5. Click **Save**. ### gcloud Use the `gcloud projects add-iam-policy-binding` command: ```bash gcloud projects add-iam-policy-binding PROJECT_ID \ --member=PRINCIPAL \ --role=ROLE ``` Replace the following: - `PROJECT_ID`: the ID of your Google Cloud project. - `PRINCIPAL`: the principal (for example, `user:email@domain.com`). - `ROLE`: the role (for example, `roles/run.admin`). The `allUsers` and `allAuthenticatedUsers` principal types can't be applied at the project level, and instead must be added to each service individually. ## Make a service public There are two ways to create a public Cloud Run service: - [Disable](https://docs.cloud.google.com/run/docs/securing/managing-access#invoker_check) the Cloud Run Invoker IAM check (recommended). - [Assign](https://docs.cloud.google.com/run/docs/securing/managing-access#assign-allusers-iam-invoker) the Cloud Run Invoker IAM role to the `allUsers` member type. ### Required roles To disable or re-enable the Invoker IAM check on a service, you must have the following permissions: - `run.services.create` - `run.services.update` - `run.services.setIamPolicy` These permissions are included in the [Cloud Run Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/run#run.admin) (`roles/run.admin`) role. See [Cloud Run IAM roles](https://docs.cloud.google.com/run/docs/reference/iam/roles) for the full list of roles and their associated permissions. #### Disable the Cloud Run Invoker IAM check The recommended way to make a public service is to disable the Cloud Run Invoker IAM check. Cloud Run enforces this check by default. Use this solution when the project is subject to the [domain restricted sharing constraint in an organization policy](https://docs.cloud.google.com/resource-manager/docs/organization-policy/restricting-domains). To disable the check: ### Console 1. In the Google Cloud console, go to the Cloud Run page: [Go to Cloud Run](https://console.cloud.google.com/run) 2. Click **Deploy container** if you are configuring a new service, then fill out the initial service settings page as needed. If you are configuring an existing service, click the service, then click the **Security** tab. 3. Select **Allow public access**. > [!NOTE] > **Note:** Enabling the Cloud Run Invoker IAM check in the Google Cloud console removes any existing `roles/run.invoker` role bindings for the `allUsers` principal type. If you later re-enable the check, you must manually re-grant the role to restore public access. 4. Click **Create** for a new service. Click **View diff \& redeploy** , then **Deploy changes** for an existing service. ### gcloud - For a new service, use the `gcloud run deploy` command with the `--no-invoker-iam-check` flag: ```bash gcloud run deploy SERVICE_NAME --no-invoker-iam-check ``` Replace `SERVICE_NAME` with the service name. - For an existing service, use the `gcloud run services update` command with the `--no-invoker-iam-check` flag: ```bash gcloud run services update SERVICE_NAME --no-invoker-iam-check ``` Replace `SERVICE_NAME` with the service name. ### YAML 1. To view and download the configuration: ```bash gcloud run services describe SERVICE --format export > service.yaml ``` 2. Update the `run.googleapis.com/invoker-iam-disabled:` annotation: ```yaml apiVersion: serving.knative.dev/v1 kind: Service metadata: annotations: run.googleapis.com/invoker-iam-disabled: 'true' name: SERVICE_NAME ``` Replace SERVICE_NAME with the name of your Cloud Run service. 3. Replace the service with its new configuration using the following command: ```bash gcloud run services replace service.yaml ``` ### Terraform To learn how to apply or remove a Terraform configuration, see [Basic Terraform commands](https://docs.cloud.google.com/docs/terraform/basic-commands). Add the following to a [`google_cloud_run_v2_service`](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/cloud_run_v2_service) resource in your Terraform configuration: resource "google_cloud_run_v2_service" "default" { name = "SERVICE" location = "REGION" invoker_iam_disabled = true template { containers { image = "IMAGE_URL" } } } Replace the following: - SERVICE: the name of your Cloud Run service. - REGION: the Google Cloud region---for example, `europe-west1`. - `IMAGE_URL`: a reference to the container image, for example, `us-docker.pkg.dev/cloudrun/container/hello:latest`. If you use Artifact Registry, the [repository](https://docs.cloud.google.com/artifact-registry/docs/repositories/create-repos#docker) REPO_NAME must already be created. The URL follows the format of `LOCATION-docker.pkg.dev/PROJECT_ID/REPO_NAME/PATH:TAG` Verify that the check is disabled after deployment by navigating to the service's HTTPS endpoint. #### Re-enable the Cloud Run Invoker IAM check To re-enable the check: ### Console 1. In the Google Cloud console, go to the Cloud Run **Services** page: [Go to Cloud Run](https://console.cloud.google.com/run/services) 2. Click the service, then click the **Security** tab. 3. Select **Require authentication** and select **Identity and Access Management (IAM)**. 4. Click **View diff \& redeploy** , then click **Deploy changes**. ### gcloud - Update the service by passing the `--invoker-iam-check` flag: ```bash gcloud run services update SERVICE_NAME --invoker-iam-check ``` Replace `SERVICE_NAME` with the service name. ### YAML 1. To view and download the configuration: ```bash gcloud run services describe SERVICE --format export > service.yaml ``` 2. Update the `run.googleapis.com/invoker-iam-disabled:` annotation:
```yaml apiVersion: serving.knative.dev/v1 kind: Service metadata: annotations: run.googleapis.com/invoker-iam-disabled: 'false' name: SERVICE_NAME ```
Replace `SERVICE_NAME` with the name of your Cloud Run service. ### Terraform To learn how to apply or remove a Terraform configuration, see [Basic Terraform commands](https://docs.cloud.google.com/docs/terraform/basic-commands). Add the following to a [`google_cloud_run_v2_service`](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/cloud_run_v2_service) resource in your Terraform configuration: resource "google_cloud_run_v2_service" "default" { name = "SERVICE" location = "REGION" invoker_iam_disabled = false template { containers { image = "IMAGE_URL" } } } Replace the following: - SERVICE: the name of your Cloud Run service. - REGION: the Google Cloud region---for example, `europe-west1`. - `IMAGE_URL`: a reference to the container image, for example, `us-docker.pkg.dev/cloudrun/container/hello:latest`. If you use Artifact Registry, the [repository](https://docs.cloud.google.com/artifact-registry/docs/repositories/create-repos#docker) REPO_NAME must already be created. The URL follows the format of `LOCATION-docker.pkg.dev/PROJECT_ID/REPO_NAME/PATH:TAG` Verify that the check is re-enabled after deployment by navigating to the service's HTTPS endpoint. ### Configure organization policy for the Cloud Run invoker IAM check > [!NOTE] > **Note:** If you participated in the invitation-only access to this feature, you might have an additional constraint (`constraints/run.requireInvokerIam`) that also controls access to the check. If you're an administrator, you can restrict the ability to [disable the Invoker IAM check](https://docs.cloud.google.com/run/docs/securing/managing-access#invoker_check) by using the `constraints/run.managed.requireInvokerIam` managed constraint. This constraint is not enforced by default. ### Assign the Cloud Run IAM Invoker role to the `allUsers` member type > [!IMPORTANT] > **Important:** These instructions won't succeed if your project is under a [domain restricted sharing organization policy](https://docs.cloud.google.com/resource-manager/docs/organization-policy/restricting-domains) that restricts granting IAM roles to the `allUsers` member type as described in this page. If that is the case, you should [disable the Cloud RunIAM Invoker IAM check](https://docs.cloud.google.com/run/docs/securing/managing-access#disable_invoker) instead. You can allow public access to a service by assigning the Cloud Run Invoker IAM role to the `allUsers` member type. You must have the `run.services.setIamPolicy` permission to configure authentication on a Cloud Run service. This permission is included in the Cloud Run Admin role. See [Cloud Run IAM roles](https://docs.cloud.google.com/run/docs/reference/iam/roles) for the full list of roles and their associated permissions. ### Console For an existing Cloud Run service: 1. In the Google Cloud console, go to the Cloud Run **Services** page: [Go to Google Cloud console](https://console.cloud.google.com/run/services) 2. To the left of the service that you want to make public, click the checkbox. Don't click the service itself. 3. In the information pane in the top-right corner, click the **Permissions** tab. If the information pane isn't visible, you might need to click **Show Info Panel** , then click **Permissions**. 4. Click **Add principal**. In the **New principals** field, enter the value `allUsers`. 1. From the **Select a role** menu, select the **Cloud Run Invoker** role. 2. Click **Save**. 3. You will be prompted to verify that you would like to make this resource public. Click **Allow public access** to apply the change to the service IAM settings. For a new service you are creating, [create the service](https://docs.cloud.google.com/run/docs/deploying#service) and select **Allow public access** in the **Authentication** section to make the service publicly available. To make a service private, select **Require authentication**. ### gcloud To make a service publicly accessible, use the `gcloud run services` command to add the special `allUsers` member type to a service and grant it the `roles/run.invoker` role: ```bash gcloud run services add-iam-policy-binding [SERVICE_NAME] \ --member="allUsers" \ --role="roles/run.invoker" ``` Run the `gcloud run deploy` command to make your service publicly accessible when you deploy your service: ```bash gcloud run deploy [SERVICE_NAME] ... --allow-unauthenticated ``` ### YAML Create a file named `policy.yaml` with the following content: bindings: - members: - allUsers role: roles/run.invoker Allow public access for the existing SERVICE using: ```bash gcloud run services set-iam-policy SERVICE policy.yaml ``` ### Terraform To learn how to apply or remove a Terraform configuration, see [Basic Terraform commands](https://docs.cloud.google.com/docs/terraform/basic-commands). Add the following to a [`google_cloud_run_v2_service`](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/cloud_run_v2_service) resource in your Terraform configuration: resource "google_cloud_run_v2_service" "default" { name = "public-service" location = "us-central1" deletion_protection = false # set to "true" in production template { containers { image = "us-docker.pkg.dev/cloudrun/container/hello" } } } To update the service IAM binding for `roles/run.invoker`, add the following resource referencing your Cloud Run service: resource "google_cloud_run_service_iam_binding" "default" { location = google_cloud_run_v2_service.default.location service = google_cloud_run_v2_service.default.name role = "roles/run.invoker" members = [ "allUsers" ] } This binding is only authoritative for the given role. Other IAM bindings within the service IAM policy are preserved. ## Use IAM Conditions You can use [IAM Conditions](https://docs.cloud.google.com/iam/docs/conditions-overview) to define and enforce conditional, attribute-based access control for certain Cloud Run resources. Cloud Run supports the ([`request.host`](https://docs.cloud.google.com/iam/docs/conditions-attribute-reference#request-host)) and ([`request.path`](https://docs.cloud.google.com/iam/docs/conditions-attribute-reference#request-path)) condition attributes to grant conditional access when invoking Cloud Run services and worker pools. For example, to grant conditional access with the `request.host` and `request.path` attributes when invoking Cloud Run services, add the `condition` field when running the following command: ``` gcloud run services add-iam-policy-binding SERVICE_NAME \ --member=PRINCIPAL \ --role=ROLE \ --region=REGION \ --condition=[KEY=VALUE,...] ``` Replace the following: - `SERVICE_NAME`: the service name (for example, `my-service`). - `PRINCIPAL`: the principal (for example, `user:email@domain.com`). - `ROLE`: the role (for example, `roles/run.invoker`). - `REGION`: the region (for example, `europe-west1`). - `KEY=VALUE`: a [condition](https://docs.cloud.google.com/sdk/gcloud/reference/run/services/add-iam-policy-binding) to include in the binding. The `--condition` flag must include the key-value pairs `expression` and `title`. ## Next steps Learn how to securely [authenticate developers, services, and users](https://docs.cloud.google.com/run/docs/securing/authenticating) to the services you just secured.