This is an experience with using Apigee Extensions with Google Cloud Functions.
Google Cloud Functions is Google’s serverless compute solution for creating event-driven applications supporting JavaScript (Node.js), Python, and Go.
Apigee now has an extension for invoking Cloud Functions, which helps us store our Cloud Function configuration details and gives us Apigee Platform benefits such as traffic management, authentication and analytics.
Looking at the process of putting together my first cloud function and exposing it through Apigee step by step we have
- Creating and configuring your Cloud Function
From the Google Cloud Console, we create a new Cloud Function. This should be configured with a HTTP trigger and this example is using the default hello world node.js code on the selected node.js runtime.
- Securing your Cloud Function
When I created this Cloud Function, by default any public internet user is able to invoke this function over http as it’s open to public. Since we only want it to be consumed via an Apigee proxy, this needs to be disabled.
To do this, there are some Google Cloud console commands that are in alpha available.
We can see the current configuration via get-iam-policy, this shows that allUsers is currently a member.
We can then remove allUsers via remove-iam-policy-binding
gcloud alpha functions remove-iam-policy-binding hello-world --member=allUsers --role=roles/cloudfunctions.invoker
Finally, we can then add the service account for our Apigee extension. This involves first having a service account that the Apigee Extension will use, then adding it as a member with the cloud functions invoker role via add-iam-policy-binding.
gcloud alpha functions add-iam-policy-binding hello-world --member=serviceAccount:helloworld-func@apigee-demo-project.iam.gserviceaccount.com --role=roles/cloudfunctions.invoker
Now the cloud function can be accessed from the service account but not other public users.
Attempting to hit the trigger directly over the internet now gives us a 403 response.
- Configuring your Apigee Extension
We are now ready to create our Apigee Extension. The extensions option is available under admin, where we can create our Cloud Functions Extension. Once this is done, we can then provide our service account credentials in the extension’s environment configuration. If we create a JSON key for our service account, we can dump the contents of the key file/response into our Extension’s credentials
We can then deploy our extension, and shortly it will be available in the selected environment
- Configuring your Apigee API Proxy
We’re now ready to add our Extension Callout policy to our API Proxy. I will be using it in the response flow so I can configure it to directly return the extension’s output as the proxy’s response by setting the output parameter. This is where we configure the details of our extension
We can now send a test request to our API Proxy, and we can see we get back the Cloud Function’s response in our API Proxy’s response body.
We’re now ready to apply any other API policies required in your API Proxy such as authentication or traffic management. An example API proxy with this policy is available here