由 pubsub 日志调用的 Cloudfunction v2“要么允许未经身份验证的调用，要么设置正确的授权 header。”

Question

我创建了一个由 pubsub 主题/订阅 messagePublished 事件调用的 cloudfunction v2。 但是，每当它被触发时，我都会收到此错误：

{
httpRequest: {
latency: "0s"
protocol: "HTTP/1.1"
remoteIp: "xx.xxx.xx.xx"
requestMethod: "POST"
requestSize: "3912"
requestUrl: "https://handler-function-cloud-custodian-xxxxxx-uc.a.run.app/?__GCP_CloudEventsMode=CUSTOM_PUBSUB_projects%2Fchase-test-custodian%2Ftopics%2Fevent-topic-cloud-custodian"
serverIp: "xxx.xxx.xx.xx"
status: 403
userAgent: "APIs-Google; (+https://developers.google.com/webmasters/APIs-Google.html)"
}
insertId: "xxxxx"
labels: {
goog-managed-by: "cloudfunctions"
}
logName: "projects/chase-test-custodian/logs/run.googleapis.com%2Frequests"
receiveTimestamp: "2023-01-30T17:45:14.427320714Z"
resource: {
labels: {5}
type: "cloud_run_revision"
}
severity: "WARNING"
spanId: "xxxxxx"
textPayload: "The request was not authenticated. Either allow unauthenticated invocations or set the proper Authorization header. Read more at https://cloud.google.com/run/docs/securing/authenticating Additional troubleshooting documentation can be found at: https://cloud.google.com/run/docs/troubleshooting#unauthorized-client"
timestamp: "2023-01-30T17:45:14.422306Z"
trace: "projects/chase-test-custodian/traces/xxxxxx"
}

我尝试将具有“Cloud Functions Invoker”角色的“allUsers”主体添加到云 function，但无论如何我都会遇到同样的错误。

订阅是由 terraform 创建的，当时我使用以下要点中的 tf 将其指定为 cloudfunctions iam 成员： https://gist.github.com/chase-replicated/0aa241db7da7e31fa63601fcd3308e91

Answer 1

我相信你需要授予与function关联的服务帐户的权限，以便谷歌授权function，你也可以尝试为function创建一个新的服务帐户。

但我建议为此向 Google Cloud 创建一个案例，因为他们可能会挖掘您的日志和监控。 （可能还有您可用的服务帐户）进行调查。