CODEWITHSUNDEEP
google-cloud-platformgoogle-cloud-functionsgoogle-cloud-endpointsgoogle-cloud-rungoogle-cloud-iam
pairwiseseq
pairwiseseq

Reputation: 333

Endpoint for Cloud Function returns 403 Forbidden

I am following Google's tutorial for setting up an Endpoint for my cloud function.

When I try to access the endpoint from my browser using URL service_name.a.run.app/function1 I get

Error: Forbidden
Your client does not have permission to get URL /function1GET from this server

As part of the mentioned tutorial and answer from a Google product manager , I'm securing my function by granting ESP permission to invoke my function.

gcloud beta functions add-iam-policy-binding function1 --member "serviceAccount:[email protected]" --role "roles/cloudfunctions.invoker" --project "project_id"

My openapi-functions.yaml

swagger: '2.0'
info:
  title: Cloud Endpoints + GCF
  description: Sample API on Cloud Endpoints with a Google Cloud Functions backend
  version: 1.0.0
host: HOST
x-google-endpoints:
- name: "HOST"
  allowCors: "true
schemes:
  - https
produces:
  - application/json
paths:
  /function1:
    get:
      operationId: function1
      x-google-backend:
        address: https://REGION-FUNCTIONS_PROJECT_ID.cloudfunctions.net/function1GET
      responses:
        '200':
          description: A successful response
          schema:
            type: string

Note that I added 

- name: "HOST"
  allowCors: "true'

to my .yaml file because I need to access the endpoint from a static site hosted on Firebase.

Upvotes: 2

Views: 3623

Answers (1)

Waelmas
Waelmas

Reputation: 1962

I have followed the tutorial you have mentioned, and indeed I came across the exact same error.

Nothing regarding permissions and roles seemed wrong.

After digging a bit what solved the issue was removing the “GET” at the end of the address.

So the openapi-functions.yaml would be like this:

swagger: '2.0'
info:
  title: Cloud Endpoints + GCF
  description: Sample API on Cloud Endpoints with a Google Cloud Functions backend
  version: 1.0.0
host: [HOST]
schemes:
  - https
produces:
  - application/json
paths:
  /function-1:
    get:
      summary: Greet a user
      operationId: function-1
      x-google-backend:
        address: https://[REGION]-[PROJECT_ID].cloudfunctions.net/function-1
      responses:
        '200':
          description: A successful response
          schema:
            type: string

Then make sure you are following all the steps mentioned in the tutorial correctly (except the above part).

In case you get a Permissions Denied error when running any of the steps, try running it again as sudo.

I have also tried adding the same as you:

host: [HOST]
x-google-endpoints:
- name: [HOST]
  allowCors: "true"

And all is working well.

Pay extra attention to the CONFIG_ID that changes with each new deployment Example:

2019-12-03r0

then it goes like:

2019-12-03r1

In case the deployment step fails (it shows some successful messages but it might fail in the end), then make sure you delete the existing endpoint service to avoid issues:

gcloud endpoints services delete [SERVICE_ID]

Also you can use the following to give cloudfunctions.invoker role to all users (Just for testing)

gcloud functions add-iam-policy-binding function-1 \
 --member="allUsers" \
 --role="roles/cloudfunctions.invoker"

Upvotes: 3

Related Questions