Service Account on an Eventarc Trigger with Cloud Functions destination requires Cloud Run Invoker

[zaphod72]

Hi,
I have a Cloud Function as the destination for an Eventarc Trigger. The Cloud Function requires authentication.

I created a service account for the trigger but it fails if I give it Cloud Functions Invoker permission on the Cloud Function.

The error logged in the CF:

> The request was not authenticated. Either allow unauthenticated invocations or set the proper Authorization header ...

If I remove the Cloud Functions Invoker permission and add Cloud Run Invoker permission on the CF's Cloud Run service then it succeeds.

Expect that the Cloud Functions Invoker permission would be the correct permission to apply.

My Eventarc Trigger details:

Name: my-trigger

Region: us-central1

Service account: my-trigger@<project_id>.iam.gserviceaccount.com

Event provider: Cloud Pub/Sub

Event type: google.cloud.pubsub.topic.v1.messagePublished

Event data content type: No value

Topic: projects/<project_id>/topics/my-topic

Infrastructure: Cloud Pub/Sub

Destination platform: Cloud Functions

Destination: my-cloud-function (us-central1)  [And this destination links to the Cloud Function]

Error conditions: None

Encryption: Events encrypted using Google-managed encryption keys

[robertcarlos · Accepted solution]

Hi @zaphod72,

Welcome to Google Cloud Community!

If you're using Cloud Functions 2nd gen, it is built on Cloud Run and Eventarc to provide an enhanced feature set. This enables users to leverage key benefits of Cloud Run including concurrency, traffic splitting, and longer processing times. 

This is the reason why Cloud Run Invoker permission works on your Cloud Functions (2nd gen) Eventarc trigger.

You could also see this feature on the upper right portion on your Cloud console.

You could check the following documentations that you may find helpful:

• Cloud Functions version comparison 
• Receive Pub/Sub events using an authenticated Cloud Run service 
• Custom audiences (services) 
• Allowing public (unauthenticated) access 

Hope this helps.

[zaphod72]

Thanks for the information @robertcarlos.

Are there any situations where a caller would need `roles/cloudfunctions.invoker` for a 2nd gen Cloud Function?

[robertcarlos]

Hi @zaphod72,

Cloud Functions Invoker role would only work on Cloud Functions 1st gen as mention in this documentation.