I want to secure my cloud functions and by doing so, I removed the allUsers role for invoking the cloud functions. Instead, I assigned the cloud invoker role to a service account and I then use that service account to call my cloud functions. However, I am still getting a 403 forbidden error. I am not exactly sure whats the best way to ask this question, but I do not know if I am missing a step or if I am doing something completely wrong.
0
votes
Decent question, but please add some information about the steps that got you where you are. Scripts are best, screenshots are okay...but not as good as text.
- Clay
You are assigning the role to the wrong resource. In summary, you assign the invoker role to the function specifying the service account email address as the member. Then you call the function with an Identity Token with the audience set to the function URL (HTTP Authorization header). Edit your question with 1) details on how you setup function authorization 2) your code that is calling the function.
- John Hanley
Tip: Cloud Functions and Cloud Run use the same authorization methods. There are many tutorials with example code on the Internet.
- John Hanley
Can you share the code where you perform the call? You never mention that you add a Authorization header with a token, it should be the issue.
- guillaume blaquiere
