Unable to grant run.invoker permission to the allUsers identity - Cloud Run DRS enabled

[MarioMont]

I followed the tutorial (how create public cloud run services when domain restricted sharing enforced ) that Damien S suggested in another post (Starting a docker container in Cloud Run ) and  was able to do everything as suggested with a slight modification. But when trying to grant the run.invoker permission to the allUsers identity for the tagged Cloud Run service it failed with the same error that the tutorial was first explaining how to conditionally work around.

I had to modify the the tag script that was supplied because it does not work and kept displaying an error message "ERROR: (gcloud.resource-manager.tags.bindings.create) PERMISSION_DENIED: The caller does not have permission. This command is authenticated as b@test.com which is the active account specified by the [core/account] property
- '@type': type.googleapis.com/google.rpc.ResourceInfo
description: permission [resourcemanager.tagValueBindings.create] required (or the
resource may not exist in this location)
resourceName: ORGANIZATION_ID/allUsersIngress/True" because apparently the tag syntax  from the time the article was put together was now obsolete.

Original:

gcloud resource-manager tags bindings create \
  --tag-value=ORGANIZATION_ID/allUsersIngress/True \
  --parent=//run.googleapis.com/projects/PROJECT_ID/locations/REGION/services/SERVICE \
  --location=REGION

Modified:

gcloud resource-manager tags bindings create \
  --tag-value=tagValues\ID  \
  --parent=//run.googleapis.com/projects/PROJECT_ID/locations/REGION/services/SERVICE \
  --location=REGION

At this point I have my Org and CloudRun tagged as expected and the conditional DRS Policy set using policy a file named drs-policy.yaml but still unable to grant the run.invoker permission to the allUsers identity for the tagged Cloud Run service.

Please advise.

Thanks in advance, Mario

[mcbsalceda · Accepted solution]

Hi @MarioMont,

Welcome to Google Cloud Community!

Right now, the Invoker feature doesn’t play nice with the Domain Restricted Sharing (DRS) settings in GCP, making it tough to create public-facing Cloud Run Functions. DRS blocks any IAM policies that include members like allUsers, which is a real headache for those looking to make their services publicly accessible.

The current workaround requires customers to exempt their projects from the org policy by resetting it to default at the project level. Unfortunately, this doesn’t let you manage public access on a service-by-service basis, which isn’t ideal.

You can file this in the public issue tracker, but just a heads-up—there’s no specific timeline for when it will be resolved. If you’re looking for a specific workaround or need something more immediate, you may reach out to Google Cloud Support. 

I hope the above information is helpful.