[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-03 (世界標準時間)。"],[[["\u003cp\u003eSecuring backend services involves permitting only authenticated access and granting necessary permissions to the gateway's service account.\u003c/p\u003e\n"],["\u003cp\u003eFor Cloud Run, the gateway's service account must have the \u003ccode\u003eroles/run.invoker\u003c/code\u003e role or a role containing the \u003ccode\u003erun.routes.invoke\u003c/code\u003e permission to enable access.\u003c/p\u003e\n"],["\u003cp\u003eCloud Run Functions require the gateway's service account to have the \u003ccode\u003eroles/cloudfunctions.invoker\u003c/code\u003e role, or a role containing the \u003ccode\u003ecloudfunctions.functions.invoke\u003c/code\u003e permission, for successful invocation.\u003c/p\u003e\n"],["\u003cp\u003eTo secure App Engine, you need to enable Identity Aware Proxy (IAP) and grant the gateway's service account the \u003ccode\u003eIAP-secured Web App User\u003c/code\u003e role along with the permissions \u003ccode\u003eappengine.applications.update\u003c/code\u003e, \u003ccode\u003eclientauthconfig.clients.create\u003c/code\u003e, and \u003ccode\u003eclientauthconfig.clients.getWithSecret\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eAPI Gateway does not support proxying to other Google Cloud APIs and will return a \u003ccode\u003e401\u003c/code\u003e response if backend services are set with \u003ccode\u003e*.googleapis.com\u003c/code\u003e.\u003c/p\u003e\n"]]],[],null,["# Securing backend services\n=========================\n\nIn addition to authenticating end user requests to your deployed gateway, it is important to secure access between API Gateway and your backend services. You can prevent public access to your backend managed services (Cloud Run, Cloud Run functions, App Engine, etc.) by:\n\n- Permitting only authenticated access to your backend service.\n- Granting the necessary permissions to the service account associated with your gateway's API config so that your gateway is authorized to invoke the backend.\n\nThis page describes the steps required to secure your backend service and describes the roles and permissions you gateway's service account requires to access those services.\n\n### Cloud Run\n\nAll Cloud Run fully managed services are deployed privately by default, which means that they can't be accessed without providing authentication credentials in the request.\n\nCloud Run services are secured by IAM. By default, Cloud Run services can be called by any role containing the `run.routes.invoke` permission.\n\nYou can [configure IAM on Cloud Run (fully managed) services](https://cloud.google.com/run/docs/securing/managing-access) to grant access to additional users.\n\nFor API Gateway, access to Cloud Run services is enabled by granting the gateway's service account the appropriate roles and permissions: the `roles/run.invoker` role or a role containing the `run.routes.invoke` permission.\n\nYou can control a gateway's access to an [individual service](https://cloud.google.com/run/docs/securing/managing-access#controlling_access_on_an_individual_service) with service-level IAM or to [all services within a project](https://cloud.google.com/run/docs/securing/managing-access#controlling_access_on_all_services_in_a_project) with project-level IAM.\n\nIf a gateway's request to your Cloud Run service is rejected, ensure that the gateway's [service account is granted](https://cloud.google.com/run/docs/securing/managing-access) the `roles/run.invoker` role, and that the gateway's service account has the `run.routes.invoke` permission. Learn more about the invoker roles and permissions in the [Cloud Run IAM reference](https://cloud.google.com/run/docs/reference/iam).\n\n### Cloud Run functions\n\nFor Cloud Run functions backend services, [Identity and Access Management (IAM)](https://cloud.google.com/iam/docs) is used to control the ability to view, create, update and delete functions. IAM enforces authentication of callers to Cloud Run functions services, such as API Gateway, by granting **roles**.\n\nGranting roles and permissions with IAM allows for control over two sets of actions:\n\n- **Developer operations:** creating, updating, and deleting functions, as well as managing access to functions.\n- **Function invocation:** causing a function to be executed.\n\nGranting the ability to invoke a function differs for [HTTP functions](https://cloud.google.com/functions/docs/writing/http) and [background functions](https://cloud.google.com/functions/docs/writing/background).\n\n- [HTTP functions](https://cloud.google.com/functions/docs/writing/http) require authentication by default. You can [configure IAM on HTTP functions](https://cloud.google.com/functions/docs/securing/managing-access) to specify whether a function allows unauthenticated invocation.\n- [Background functions](https://cloud.google.com/functions/docs/writing/background) can only be invoked by the event source to which they are subscribed.\n\nTo enable API Gateway to call your Cloud Functions backend service, grant the gateway's service account the [`roles/cloudfunctions.invoker`](https://cloud.google.com/functions/docs/reference/iam/roles)) role, or any role containing the `cloudfunctions.functions.invoke` permission.\n\nYou can control a gateway's access to [an individual function](https://cloud.google.com/functions/docs/securing/managing-access-iam#controlling_access_on_a_function) with service-level IAM or to [all functions in a project](https://cloud.google.com/functions/docs/securing/managing-access-iam#controlling_access_on_all_functions_in_a_project) with project-level IAM.\n\nIf a gateway's requests to your Cloud Run functions service is rejected, ensure that that the gateway's [service account is granted](https://cloud.google.com/functions/docs/securing/managing-access) the `roles/cloudfunctions.invoker` role, and that the gateway's service account has the `cloudfunctions.functions.invoke` permission. Learn more about invoker roles and permissions in the [Cloud Functions IAM reference](https://cloud.google.com/functions/docs/reference/iam).\n\n### App Engine\n\nIn order to secure your App Engine app, you must use the [Identity Aware Proxy (IAP)](https://cloud.google.com/iap/docs) to ensure that requests are authenticated.\n\nFollow the steps to [Enable IAP](/iap/docs/authenticate-users-google-accounts#enabling_iap) for the project in which your App Engine backend service is deployed. Enabling IAP will ensure that access to your App Engine backend application is secured.\n\nTo enable API Gateway to call your App Engine backend service, follow the steps in\n[Setting up IAP access](/iap/docs/authenticate-users-google-accounts#iap-access) to grant the\nservice account associated with your gateway the `IAP-secured Web App User` role. In addition, grant the service account a role containing the following permissions:\n\n- `appengine.applications.update`\n- `clientauthconfig.clients.create`\n- `clientauthconfig.clients.getWithSecret`\n\n### Other Google Cloud APIs\n\nAPI Gateway does not support proxying to other Google Cloud APIs. This means API configs that reference one or more backends with `*.googleapis.com` (such as `bigquery.googleapis.com`) will result in calls failing with a `401` response code.\n\nAPI Gateway authenticates to backends with an [ID Token](/authentication/token-types#id) while other Google Cloud APIs require an [Access Token](/docs/authentication/token-types#access). There are no built-in workarounds at this time."]]
