배포된 게이트웨이에 대한 최종 사용자 요청 인증뿐만 아니라 API 게이트웨이와 백엔드 서비스 사이의 액세스 보안도 중요합니다. Cloud Run, Cloud Run 함수, App Engine과 같은 백엔드 관리형 서비스에 대해 공개 액세스를 방지하기 위한 방법은 다음과 같습니다.
백엔드 서비스에 대해 인증된 액세스만 허용합니다.
게이트웨이의 백엔드 호출이 승인되도록 게이트웨이 API 구성과 연결된 서비스 계정에 필요한 권한을 부여합니다.
이 페이지에서는 백엔드 서비스 보안을 위해 필요한 단계에 대해 설명하고 게이트웨이 서비스 계정이 이러한 서비스에 액세스하기 위해 필요한 역할 및 권한에 대해 설명합니다.
Cloud Run
모든 Cloud Run 완전 관리형 서비스는 기본적으로 비공개로 배포됩니다. 즉, 요청에 인증 사용자 인증 정보를 제공하지 않으면 서비스에 액세스할 수 없습니다.
Cloud Run 서비스는 IAM으로 보호됩니다. 기본적으로 run.routes.invoke 권한이 포함된 모든 역할이 Cloud Run 서비스를 호출할 수 있습니다.
API 게이트웨이의 경우 Cloud Run 서비스 액세스는 게이트웨이의 서비스 계정에 roles/run.invoker 역할 또는 run.routes.invoke 권한이 포함된 역할과 같이 적절한 역할 및 권한을 부여함으로써 사용 설정됩니다.
개별 서비스에 대한 게이트웨이 액세스는 서비스 수준 IAM을 사용하여 제어하고 프로젝트 내에 있는 모든 서비스에 대한 게이트웨이 액세스는 프로젝트 수준 IAM을 사용하여 제어할 수 있습니다.
Cloud Run 서비스에 대한 게이트웨이 요청이 거부되면 roles/run.invoker 역할이 게이트웨이의 서비스 계정에 부여되었고 게이트웨이의 서비스 계정에 run.routes.invoke 권한이 있는지 확인합니다. 호출자 역할 및 권한에 대한 자세한 내용은 Cloud Run IAM 참조를 확인하세요.
Cloud Functions
Cloud Run 함수 백엔드 서비스의 경우 함수 보기, 만들기, 업데이트, 삭제 기능을 제어하기 위해 Identity and Access Management(IAM)이 사용됩니다. IAM은 역할 부여를 통해 API 게이트웨이와 같은 Cloud Run 함수 서비스에 대한 호출자 인증을 적용합니다.
API 게이트웨이가 Cloud Functions 백엔드 서비스를 호출할 수 있으려면 게이트웨이의 서비스 계정에 roles/cloudfunctions.invoker 역할 또는 cloudfunctions.functions.invoke 권한이 포함된 역할을 부여합니다.
개별 함수에 대한 게이트웨이 액세스는 서비스 수준 IAM을 사용하여 제어하고 프로젝트의 모든 함수에 대한 게이트웨이 액세스는 프로젝트 수준 IAM을 사용하여 제어할 수 있습니다.
Cloud Run 함수 서비스에 대한 게이트웨이 요청이 거부되면 roles/cloudfunctions.invoker 역할이 게이트웨이의 서비스 계정에 부여되었고 게이트웨이의 서비스 계정에 cloudfunctions.functions.invoke 권한이 있는지 확인합니다. 호출자 역할 및 권한에 대한 자세한 내용은 Cloud Functions IAM 참조를 확인하세요.
App Engine 백엔드 서비스가 배포된 프로젝트에 대해 IAP 사용 설정 단계를 수행합니다. IAP를 사용 설정하면 App Engine 백엔드 애플리케이션에 대한 액세스가 보호됩니다.
API 게이트웨이가 App Engine 백엔드 서비스를 호출할 수 있도록 하려면 IAP 액세스 설정의 단계에 따라 게이트웨이와 연결된 서비스 계정에 IAP-secured Web App User 역할을 부여합니다. 또한 서비스 계정에 다음 권한이 포함된 역할을 부여합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-03-06(UTC)"],[[["\u003cp\u003eSecuring backend services involves permitting only authenticated access and granting necessary permissions to the gateway's service account.\u003c/p\u003e\n"],["\u003cp\u003eFor Cloud Run, the gateway's service account must have the \u003ccode\u003eroles/run.invoker\u003c/code\u003e role or a role containing the \u003ccode\u003erun.routes.invoke\u003c/code\u003e permission to enable access.\u003c/p\u003e\n"],["\u003cp\u003eCloud Run Functions require the gateway's service account to have the \u003ccode\u003eroles/cloudfunctions.invoker\u003c/code\u003e role, or a role containing the \u003ccode\u003ecloudfunctions.functions.invoke\u003c/code\u003e permission, for successful invocation.\u003c/p\u003e\n"],["\u003cp\u003eTo secure App Engine, you need to enable Identity Aware Proxy (IAP) and grant the gateway's service account the \u003ccode\u003eIAP-secured Web App User\u003c/code\u003e role along with the permissions \u003ccode\u003eappengine.applications.update\u003c/code\u003e, \u003ccode\u003eclientauthconfig.clients.create\u003c/code\u003e, and \u003ccode\u003eclientauthconfig.clients.getWithSecret\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eAPI Gateway does not support proxying to other Google Cloud APIs and will return a \u003ccode\u003e401\u003c/code\u003e response if backend services are set with \u003ccode\u003e*.googleapis.com\u003c/code\u003e.\u003c/p\u003e\n"]]],[],null,["# Securing backend services\n=========================\n\nIn addition to authenticating end user requests to your deployed gateway, it is important to secure access between API Gateway and your backend services. You can prevent public access to your backend managed services (Cloud Run, Cloud Run functions, App Engine, etc.) by:\n\n- Permitting only authenticated access to your backend service.\n- Granting the necessary permissions to the service account associated with your gateway's API config so that your gateway is authorized to invoke the backend.\n\nThis page describes the steps required to secure your backend service and describes the roles and permissions you gateway's service account requires to access those services.\n\n### Cloud Run\n\nAll Cloud Run fully managed services are deployed privately by default, which means that they can't be accessed without providing authentication credentials in the request.\n\nCloud Run services are secured by IAM. By default, Cloud Run services can be called by any role containing the `run.routes.invoke` permission.\n\nYou can [configure IAM on Cloud Run (fully managed) services](https://cloud.google.com/run/docs/securing/managing-access) to grant access to additional users.\n\nFor API Gateway, access to Cloud Run services is enabled by granting the gateway's service account the appropriate roles and permissions: the `roles/run.invoker` role or a role containing the `run.routes.invoke` permission.\n\nYou can control a gateway's access to an [individual service](https://cloud.google.com/run/docs/securing/managing-access#controlling_access_on_an_individual_service) with service-level IAM or to [all services within a project](https://cloud.google.com/run/docs/securing/managing-access#controlling_access_on_all_services_in_a_project) with project-level IAM.\n\nIf a gateway's request to your Cloud Run service is rejected, ensure that the gateway's [service account is granted](https://cloud.google.com/run/docs/securing/managing-access) the `roles/run.invoker` role, and that the gateway's service account has the `run.routes.invoke` permission. Learn more about the invoker roles and permissions in the [Cloud Run IAM reference](https://cloud.google.com/run/docs/reference/iam).\n\n### Cloud Run functions\n\nFor Cloud Run functions backend services, [Identity and Access Management (IAM)](https://cloud.google.com/iam/docs) is used to control the ability to view, create, update and delete functions. IAM enforces authentication of callers to Cloud Run functions services, such as API Gateway, by granting **roles**.\n\nGranting roles and permissions with IAM allows for control over two sets of actions:\n\n- **Developer operations:** creating, updating, and deleting functions, as well as managing access to functions.\n- **Function invocation:** causing a function to be executed.\n\nGranting the ability to invoke a function differs for [HTTP functions](https://cloud.google.com/functions/docs/writing/http) and [background functions](https://cloud.google.com/functions/docs/writing/background).\n\n- [HTTP functions](https://cloud.google.com/functions/docs/writing/http) require authentication by default. You can [configure IAM on HTTP functions](https://cloud.google.com/functions/docs/securing/managing-access) to specify whether a function allows unauthenticated invocation.\n- [Background functions](https://cloud.google.com/functions/docs/writing/background) can only be invoked by the event source to which they are subscribed.\n\nTo enable API Gateway to call your Cloud Functions backend service, grant the gateway's service account the [`roles/cloudfunctions.invoker`](https://cloud.google.com/functions/docs/reference/iam/roles)) role, or any role containing the `cloudfunctions.functions.invoke` permission.\n\nYou can control a gateway's access to [an individual function](https://cloud.google.com/functions/docs/securing/managing-access-iam#controlling_access_on_a_function) with service-level IAM or to [all functions in a project](https://cloud.google.com/functions/docs/securing/managing-access-iam#controlling_access_on_all_functions_in_a_project) with project-level IAM.\n\nIf a gateway's requests to your Cloud Run functions service is rejected, ensure that that the gateway's [service account is granted](https://cloud.google.com/functions/docs/securing/managing-access) the `roles/cloudfunctions.invoker` role, and that the gateway's service account has the `cloudfunctions.functions.invoke` permission. Learn more about invoker roles and permissions in the [Cloud Functions IAM reference](https://cloud.google.com/functions/docs/reference/iam).\n\n### App Engine\n\nIn order to secure your App Engine app, you must use the [Identity Aware Proxy (IAP)](https://cloud.google.com/iap/docs) to ensure that requests are authenticated.\n\nFollow the steps to [Enable IAP](/iap/docs/authenticate-users-google-accounts#enabling_iap) for the project in which your App Engine backend service is deployed. Enabling IAP will ensure that access to your App Engine backend application is secured.\n\nTo enable API Gateway to call your App Engine backend service, follow the steps in\n[Setting up IAP access](/iap/docs/authenticate-users-google-accounts#iap-access) to grant the\nservice account associated with your gateway the `IAP-secured Web App User` role. In addition, grant the service account a role containing the following permissions:\n\n- `appengine.applications.update`\n- `clientauthconfig.clients.create`\n- `clientauthconfig.clients.getWithSecret`\n\n### Other Google Cloud APIs\n\nAPI Gateway does not support proxying to other Google Cloud APIs. This means API configs that reference one or more backends with `*.googleapis.com` (such as `bigquery.googleapis.com`) will result in calls failing with a `401` response code.\n\nAPI Gateway authenticates to backends with an [ID Token](/authentication/token-types#id) while other Google Cloud APIs require an [Access Token](/docs/authentication/token-types#access). There are no built-in workarounds at this time."]]
