Cloud Functions returns 403 error also with Cloud Functions Invoker permissions

Question

Within GCP:

1. I created a function in Google Cloud Functions.
2. I want to invoke that function from Google Workflows.
3. I added a service account with "Cloud Functions Invoker" permissions.
4. I created a workflow in Google Workflows, it uses the service account with "Cloud Functions Invoker" permissions that I added before.
5. I run the workflow... it fails with "HTTP server responded with error code 403".

Why does it give 403 error if I'm using a service account with "Cloud Functions Invoker" permissions? If I disable authentication for the function it works, but I need authentication because it's not a public API.

Answer 1

This must be added in the workflow code:

auth:
    type: OIDC

See https://cloud.google.com/workflows/docs/calling-run-functions?authuser=1#add_auth_info

Answer 2

It works fine.

It allows you to remove IAM default rights for "All Users" applied to any Cloud Function.

With this mechanism, you allow only Workflow Service Account executor to invoke the Cloud Function.

Securing Cloud Functions