Service Account on an Eventarc Trigger with Cloud Functions destination requires Cloud Run Invoker

Google Cloud Integration Services
1

Hi,
I have a Cloud Function as the destination for an Eventarc Trigger. The Cloud Function requires authentication.

I created a service account for the trigger but it fails if I give it Cloud Functions Invoker permission on the Cloud Function.

The error logged in the CF:

The request was not authenticated. Either allow unauthenticated invocations or set the proper Authorization header …

If I remove the Cloud Functions Invoker permission and add Cloud Run Invoker permission on the CF’s Cloud Run service then it succeeds.

Expect that the Cloud Functions Invoker permission would be the correct permission to apply.

My Eventarc Trigger details:

Name: my-trigger
Region: us-central1
Service account: my-trigger@<project_id>.iam.gserviceaccount.com
Event provider: Cloud Pub/Sub
Event type: google.cloud.pubsub.topic.v1.messagePublished
Event data content type: No value
Topic: projects/<project_id>/topics/my-topic
Infrastructure: Cloud Pub/Sub
Destination platform: Cloud Functions
Destination: my-cloud-function (us-central1) [And this destination links to the Cloud Function]
Error conditions: None
Encryption: Events encrypted using Google-managed encryption keys

2

Hi @zaphod72 ,

Welcome to Google Cloud Community!

If you’re using Cloud Functions 2nd gen, it is built on Cloud Run and Eventarc to provide an enhanced feature set. This enables users to leverage key benefits of Cloud Run including concurrency, traffic splitting, and longer processing times.

This is the reason why Cloud Run Invoker permission works on your Cloud Functions (2nd gen) Eventarc trigger.

You could also see this feature on the upper right portion on your Cloud console.

BmpbmpC59vJizpE.png

You could check the following documentations that you may find helpful:

Hope this helps.

1 Like
3

Thanks for the information @robertcarlos .

Are there any situations where a caller would need roles/cloudfunctions.invoker for a 2nd gen Cloud Function?

4

Hi @zaphod72 ,

Cloud Functions Invoker role would only work on Cloud Functions 1st gen as mention in this documentation.

1 Like