Access Cloud Run URL for GCP authenticated users

user_5751264 0
Viewed 65

Using IAM, is there any simple way to let a GCP console logged in user to access a Cloud Run URL?

The idea here is to have a lightweight way to protect the access to some URLs for people who are already logged in to the console.

So I don't want the world to have access, only my GCP users.

It seems that the options are either:

  • Setup IAP for Cloud Run => costly (load balancer) and not exactly simple
  • Setup the container to require authentication, generate a token from the console, use a browser extension and inject the said token on each request.

Note: I tried to setup a container as allowing non authenticated calls but removing the allUsers principal from the Invoker role and stick to a particular email address. The URL ended up still being available to non authenticated browsers.

Seems like a very simple use case but unless I am missing something, the options are all over-the-top.

Thanks,

google-cloud-iam google-cloud-run google-cloud-platform
1 Answers

Maybe this might work for you (don't necessarily know if it's the best architecture)

  1. Deploy cloud run and ONLY allow for aunthenticated invocation

  2. Create a very simple GAE project. Add login: required to app.yaml so that anyone trying to load the app is forced to login

  3. Your GAE code can then invoke the cloud run endpoint. Your code will generate a token and include it as a header when making the call to the cloud run endpoint. See this documentation

user_152112030
Related