为 GCP 认证用户访问 Cloud Run URL

Question

Using IAM, is there any simple way to let a GCP console logged in user to access a Cloud Run URL?

The idea here is to have a lightweight way to protect the access to some URLs for people who are already logged in to the console.

So I don't want the world to have access, only my GCP users.

It seems that the options are either:

• Setup IAP for Cloud Run => costly (load balancer) and not exactly simple
• Setup the container to require authentication, generate a token from the console, use a browser extension and inject the said token on each request.

Note: I tried to setup a container as allowing non authenticated calls but removing the allUsers principal from the Invoker role and stick to a particular email address. The URL ended up still being available to non authenticated browsers.

Seems like a very simple use case but unless I am missing something, the options are all over-the-top.

Thanks,

Answer 1

Maybe this might work for you (don't necessarily know if it's the best architecture)

1. Deploy cloud run and ONLY allow for aunthenticated invocation

2. Create a very simple GAE project. Add login: required to app.yaml so that anyone trying to load the app is forced to login

3. Your GAE code can then invoke the cloud run endpoint. Your code will generate a token and include it as a header when making the call to the cloud run endpoint. See this documentation