API Gateway の場合、Cloud Run サービスにアクセスするには、ゲートウェイのサービス アカウントに適切なロールと権限（roles/run.invoker ロールまたは run.routes.invoke 権限を含むロール）を付与します。
サービスレベルの IAM を使用して個々のサービスに対して、またはプロジェクト レベルの IAM を使用してプロジェクト内のすべてのサービスに対して、ゲートウェイのアクセスを制御できます。
Cloud Run サービスに対するゲートウェイのリクエストが拒否された場合は、ゲートウェイのサービス アカウントに roles/run.invoker のロールが付与され、ゲートウェイのサービス アカウントに run.routes.invoke 権限が付与されていることを確認します。Cloud Run IAM リファレンスで、呼び出し元のロールと権限の詳細を確認してください。
Cloud Functions
Cloud Run functions のバックエンド サービスの場合は、Identity and Access Management（IAM）を使用して、関数の表示、作成、更新、削除の機能を制御します。IAM は、ロールを付与することで、API Gateway などの Cloud Run functions サービスへの呼び出し元の認証を適用します。
API Gateway で App Engine バックエンド サービスを呼び出すことができるようにするには、IAP アクセスの設定の手順に沿って、ゲートウェイに関連付けられたサービス アカウントに IAP-secured Web App User ロールを付与します。また、サービス アカウントに次の権限を含むロールを付与します。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-03-06 UTC。"],[[["\u003cp\u003eSecuring backend services involves permitting only authenticated access and granting necessary permissions to the gateway's service account.\u003c/p\u003e\n"],["\u003cp\u003eFor Cloud Run, the gateway's service account must have the \u003ccode\u003eroles/run.invoker\u003c/code\u003e role or a role containing the \u003ccode\u003erun.routes.invoke\u003c/code\u003e permission to enable access.\u003c/p\u003e\n"],["\u003cp\u003eCloud Run Functions require the gateway's service account to have the \u003ccode\u003eroles/cloudfunctions.invoker\u003c/code\u003e role, or a role containing the \u003ccode\u003ecloudfunctions.functions.invoke\u003c/code\u003e permission, for successful invocation.\u003c/p\u003e\n"],["\u003cp\u003eTo secure App Engine, you need to enable Identity Aware Proxy (IAP) and grant the gateway's service account the \u003ccode\u003eIAP-secured Web App User\u003c/code\u003e role along with the permissions \u003ccode\u003eappengine.applications.update\u003c/code\u003e, \u003ccode\u003eclientauthconfig.clients.create\u003c/code\u003e, and \u003ccode\u003eclientauthconfig.clients.getWithSecret\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eAPI Gateway does not support proxying to other Google Cloud APIs and will return a \u003ccode\u003e401\u003c/code\u003e response if backend services are set with \u003ccode\u003e*.googleapis.com\u003c/code\u003e.\u003c/p\u003e\n"]]],[],null,["# Securing backend services\n=========================\n\nIn addition to authenticating end user requests to your deployed gateway, it is important to secure access between API Gateway and your backend services. You can prevent public access to your backend managed services (Cloud Run, Cloud Run functions, App Engine, etc.) by:\n\n- Permitting only authenticated access to your backend service.\n- Granting the necessary permissions to the service account associated with your gateway's API config so that your gateway is authorized to invoke the backend.\n\nThis page describes the steps required to secure your backend service and describes the roles and permissions you gateway's service account requires to access those services.\n\n### Cloud Run\n\nAll Cloud Run fully managed services are deployed privately by default, which means that they can't be accessed without providing authentication credentials in the request.\n\nCloud Run services are secured by IAM. By default, Cloud Run services can be called by any role containing the `run.routes.invoke` permission.\n\nYou can [configure IAM on Cloud Run (fully managed) services](https://cloud.google.com/run/docs/securing/managing-access) to grant access to additional users.\n\nFor API Gateway, access to Cloud Run services is enabled by granting the gateway's service account the appropriate roles and permissions: the `roles/run.invoker` role or a role containing the `run.routes.invoke` permission.\n\nYou can control a gateway's access to an [individual service](https://cloud.google.com/run/docs/securing/managing-access#controlling_access_on_an_individual_service) with service-level IAM or to [all services within a project](https://cloud.google.com/run/docs/securing/managing-access#controlling_access_on_all_services_in_a_project) with project-level IAM.\n\nIf a gateway's request to your Cloud Run service is rejected, ensure that the gateway's [service account is granted](https://cloud.google.com/run/docs/securing/managing-access) the `roles/run.invoker` role, and that the gateway's service account has the `run.routes.invoke` permission. Learn more about the invoker roles and permissions in the [Cloud Run IAM reference](https://cloud.google.com/run/docs/reference/iam).\n\n### Cloud Run functions\n\nFor Cloud Run functions backend services, [Identity and Access Management (IAM)](https://cloud.google.com/iam/docs) is used to control the ability to view, create, update and delete functions. IAM enforces authentication of callers to Cloud Run functions services, such as API Gateway, by granting **roles**.\n\nGranting roles and permissions with IAM allows for control over two sets of actions:\n\n- **Developer operations:** creating, updating, and deleting functions, as well as managing access to functions.\n- **Function invocation:** causing a function to be executed.\n\nGranting the ability to invoke a function differs for [HTTP functions](https://cloud.google.com/functions/docs/writing/http) and [background functions](https://cloud.google.com/functions/docs/writing/background).\n\n- [HTTP functions](https://cloud.google.com/functions/docs/writing/http) require authentication by default. You can [configure IAM on HTTP functions](https://cloud.google.com/functions/docs/securing/managing-access) to specify whether a function allows unauthenticated invocation.\n- [Background functions](https://cloud.google.com/functions/docs/writing/background) can only be invoked by the event source to which they are subscribed.\n\nTo enable API Gateway to call your Cloud Functions backend service, grant the gateway's service account the [`roles/cloudfunctions.invoker`](https://cloud.google.com/functions/docs/reference/iam/roles)) role, or any role containing the `cloudfunctions.functions.invoke` permission.\n\nYou can control a gateway's access to [an individual function](https://cloud.google.com/functions/docs/securing/managing-access-iam#controlling_access_on_a_function) with service-level IAM or to [all functions in a project](https://cloud.google.com/functions/docs/securing/managing-access-iam#controlling_access_on_all_functions_in_a_project) with project-level IAM.\n\nIf a gateway's requests to your Cloud Run functions service is rejected, ensure that that the gateway's [service account is granted](https://cloud.google.com/functions/docs/securing/managing-access) the `roles/cloudfunctions.invoker` role, and that the gateway's service account has the `cloudfunctions.functions.invoke` permission. Learn more about invoker roles and permissions in the [Cloud Functions IAM reference](https://cloud.google.com/functions/docs/reference/iam).\n\n### App Engine\n\nIn order to secure your App Engine app, you must use the [Identity Aware Proxy (IAP)](https://cloud.google.com/iap/docs) to ensure that requests are authenticated.\n\nFollow the steps to [Enable IAP](/iap/docs/authenticate-users-google-accounts#enabling_iap) for the project in which your App Engine backend service is deployed. Enabling IAP will ensure that access to your App Engine backend application is secured.\n\nTo enable API Gateway to call your App Engine backend service, follow the steps in\n[Setting up IAP access](/iap/docs/authenticate-users-google-accounts#iap-access) to grant the\nservice account associated with your gateway the `IAP-secured Web App User` role. In addition, grant the service account a role containing the following permissions:\n\n- `appengine.applications.update`\n- `clientauthconfig.clients.create`\n- `clientauthconfig.clients.getWithSecret`\n\n### Other Google Cloud APIs\n\nAPI Gateway does not support proxying to other Google Cloud APIs. This means API configs that reference one or more backends with `*.googleapis.com` (such as `bigquery.googleapis.com`) will result in calls failing with a `401` response code.\n\nAPI Gateway authenticates to backends with an [ID Token](/authentication/token-types#id) while other Google Cloud APIs require an [Access Token](/docs/authentication/token-types#access). There are no built-in workarounds at this time."]]
