CODEWITHSUNDEEP
google-cloud-run
Rollie
Rollie

Reputation: 4752

Newly deployed cloud run app inaccessible, despite having requisite permissions (403)

Following this quickstart guide (Python version), I was able to quickly create and deploy a Python Flask app to a project owned by my organization. However, toward the end the guide instructs "Visit your deployed container by opening the service URL in a web browser", and but this is the step I can't get to work.

Curiously, in the logs (https://console.cloud.google.com/logs/) the 'textPayload' data element for the request is "The request was not authenticated. Either...", which seems unusual, as I'd expect an unauthenticated request to return 401, not 403. In any case, it does not list my org email address in the request, suggesting my identity for some reason isn't being supplied. Any way to fix this so I can access the URL using a user with appropriate permissions?

Note: I can access the URL by manually running "curl -H 'Authorization: Bearer <my token>'"

Upvotes: 0

Views: 867

Answers (2)

Ezekias BOKOVE
Ezekias BOKOVE

Reputation: 168

To complement what Mr. Donnald Cucharo said, you can also use Identity Aware Proxy (IAP) to expose your application in a secure way.

Upvotes: 2

Donnald Cucharo
Donnald Cucharo

Reputation: 4126

Cloud Run URLs aren't directly accessible if the service only allows authenticated invocations because passing the URL on your browser will not generate the credential for you. You will have to pass auth credentials on your request and the easiest way to invoke the service is to use a tool like curl which is exactly what you noted.

You have two options to authenticate your end users which are the following:

  1. Integrate Google Sign-In.
  2. Implement Identity Platform or Firebase Authentication.

In either of the above choices, you need a public web or mobile app that handles the sign-in flow and then makes authenticated API calls to a Cloud Run (fully managed) service.

For more information on authenticating end users, check out the official documentation.

Upvotes: 4

Related Questions