Cut Cloud Run service from running - safety reasons

There are several solution to remove from traffic Cloud Run service, in addition of authentication solution proposed by Dondi

• Delete the Cloud Run service. It might seem overkill, but, because the service is stateless, you will lost nothing (except the revision history)
• If you have your Cloud Run service behind a Load Balancer
  • You can remove the serverless NEG that route the traffic to it
  • You can add a Cloud Armor policy that filter the originator IP to exclude it from the traffic
• You can set the ingress to internal, or internal and cloud load balancing.
• You can deploy a dummy revision (a hello world container for example), and route 100% of the traffic to it (traffic splitting feature)

You can't really "turn off" a Cloud Run service as it's fully managed by Google. A Cloud Run instance automatically scales down to zero if there are no requests, but it will continue on serving traffic.

To emulate what you want to do, make sure that your service requires authentication then revoke access on the offending user (or all users). As mentioned in the docs:

Cloud Run (fully managed) does not offer a direct way to make a service stop serving traffic, but you can achieve a similar result by revoking the permission to invoke the service to identities that are invoking the service. Notably, if your service is "public", remove allUsers from the Cloud Run Invoker role (roles/run.invoker).

Update: Access to a resource is managed through an IAM policy. In order to control access programmatically, you have to get the IAM policy first, then revoke the role to a user or a service account. Here's the documentation that gives an overview.