Using IAM to Authorize Access

You use Identity and Access Management (IAM) to authorize identities to perform administrative actions on your functions, like creating, updating, and deleting them. You add principals (the identities you wish to enable, usually a user or service account email) to the function and then grant those principals the appropriate IAM roles. These roles include permissions that define the actions they are allowed to do.

Note: By default, entities that need to invoke an HTTP function must explicitly present authentication credentials (proof of identity) as well as having the required permissions. The authentication requirement, however, can be turned off. For more information on how to acquire and present the appropriate authentication credential, see Authenticating for invocation.

Enabling access to a function

You can control actions on a function by granting or restricting roles to individual identities through IAM.

Adding principals and granting roles

Console

1. Go to the Google Cloud console:

   Go to Google Cloud console

2. Click the checkbox next to the function in which you are interested.

3. Click Permissions at the top of the screen. The Permissions panel opens.

4. Click Add principal.

5. In the New principals field, enter one or more identities that need access to your function. This is usually a user or service account email.

6. Select a role (or roles) from the Select a role drop-down menu. The roles you select appear in the pane with a short description of the permissions they grant.

   Note: for a list of the available roles and the permissions they grant, see Cloud Functions IAM Roles reference page

7. Click Save.

GCloud

Use the gcloud functions add-iam-policy-binding command:

gcloud functions add-iam-policy-binding FUNCTION_NAME \
  --member=PRINCIPAL_ID \
  --role=ROLE

where FUNCTION_NAME is the function name, PRINCIPAL_ID is the principal's identifier, usually an email, and ROLE is the role.

For a list of sources that can provide a PRINCIPAL_ID, see the IAM concepts page. For a list of acceptable values for ROLE, see the Cloud Functions IAM Roles reference page.

Removing roles from principals

Console

1. Go to the Google Cloud console:

   Go to Google Cloud console

2. Click the checkbox next to the function in which you are interested.

3. Click Permissions at the top of the screen. The Permissions panel opens.

4. Search for the principal you want to remove. Look in every role the principal has been granted.

5. When you find the principal in the role you wish to delete, click the trash can icon next to it. If you wish to completely remove the principal's access, do this for every role the principal has been granted.

Note: You can also change a principal's role here.

GCloud

Use the gcloud functions remove-iam-policy-binding command:

  gcloud functions remove-iam-policy-binding FUNCTION_NAME \
    --member=PRINCIPAL_ID \
    --role=ROLE

where FUNCTION_NAME is the function name, PRINCIPAL_ID is the email address that identifies the service account, prefaced with serviceAccount:, and ROLE is the role.

For a list of acceptable sources for PRINCIPAL_ID, see the IAM concepts page. For a list of possible values for ROLE, see the Cloud Functions IAM Roles reference page.

If the principal has been granted multiple roles, make sure you specify the one you wish to remove.

Bulk addition or removal of principals

Console

1. Go to the Google Cloud console:

   Go to Google Cloud console

2. Click the checkboxes next to the functions on which you want to grant or restrict access.

3. Click Permissions at the top of the screen. The Permissions panel opens.

If you want to add principals:

1. Click Add principal.

2. In the New principals , enter multiple identities that need access to your function.

3. Select a role (or roles) from the Select a role drop-down menu. The roles you select appear in the pane with a short description of the permissions they grant.

4. Click Save.

If you want to remove principals:

1. Search for the principal you want to remove, or expand a role the principal has.

2. When you find the principal you wish to delete, click the trash can icon next to it. If you wish to completely remove the principal's access, do this for every role the principal has been granted.

GCloud

Create an IAM policy named, for example, policy.json:

{
  "bindings": [
    {
      "role": ROLE,
      "members": [
        PRINCIPAL_ID
      ]
    }
  ]
}

Use the gcloud functions set-iam-policy command:

gcloud functions set-iam-policy FUNCTION_NAME policy.json

For a list of acceptable sources for PRINCIPAL_ID, see the IAM concepts page. For a list of acceptable values for ROLE, see the Cloud Functions IAM Roles reference page.

Viewing principals

Console

1. Go to the Google Cloud console:

   Go to Google Cloud console

2. Click the name of the function you are interested in.

3. Select the Permissions tab. The Permissions panel opens.

4. Make sure the Principals tab is selected.

GCloud

Use the gcloud functions get-iam-policy command:

gcloud functions get-iam-policy FUNCTION_NAME

Allowing unauthenticated HTTP function invocation

As of January 15, 2020, HTTP functions without Allow unauthenticated invocations enabled restrict access to end users and service accounts that don't have appropriate permissions.

To allow unauthenticated invocations you must specify this at or after deployment.

You use a special variant of the approach described above to grant unauthenticated invokers the ability to invoke an HTTP function.

Note: event-driven functions can only be invoked by the event source to which they are subscribed.

At deployment

Console

Select Allow unauthenticated invocations in the Authentication section on the Configuration panel.

GCloud

The gcloud functions deploy command includes a prompt to help you configure invocation permissions during function creation. It can also include the --allow-unauthenticated flag:

gcloud functions deploy FUNCTION_NAME \
  --trigger-http \
--allow-unauthenticated \
...

Subsequent deployments of the same function do not change its status, even if you do not use this flag.

Note: Use of the --allow-unauthenticated flag modifies IAM permissions. To ensure that unauthorized developers cannot modify function permissions, the user or service that is deploying the function must have the cloudfunctions.functions.setIamPolicy permission. This permission is included in both the Owner and Cloud Functions Admin roles. See Cloud Functions IAM Roles for the full list of roles and their associated permissions.

After deployment

Cloud Functions (1st gen):

To allow unauthenticated invocation of a function, grant the Cloud Functions Invoker role to the special allUsers principal on the function:

Console

1. Go to the Google Cloud console:

   Go to Google Cloud console

2. Click the checkbox next to the receiving function. (Don't click on the function itself.)

3. Click Permissions at the top of the screen. The Permissions panel opens.

4. Click Add principal.

5. In the New principals field, type allUsers.

6. Select the role Cloud Functions > Cloud Functions Invoker from the Select a role drop-down menu.

7. In response to the dialog, click Allow public access.

GCloud

Use the gcloud functions add-iam-policy-binding command to grant the roles/cloudfunctions.invoker role to the special allUsers principal on the function:

gcloud functions add-iam-policy-binding FUNCTION_NAME \
 --member="allUsers" \
 --role="roles/cloudfunctions.invoker"

Cloud Functions (2nd gen):

Console

1. Go to the Google Cloud console:

   Go to Google Cloud console

2. Click the linked name of the function to which you want to grant access.

3. Click the Powered By Cloud Run link in the top right corner of the Function details overview page.

4. Open the Security tab, and under Authentication, select Allow unauthenticated invocations.

5. Click Save.

GCloud

Use the gcloud run services add-iam-policy-binding command to grant the roles/run.invoker role to the specific function.

gcloud run services add-iam-policy-binding FUNCTION_NAME \
--member="user:USER_EMAIL"\
--role="roles/run.invoker"

Domain Restricted Sharing

If you are developing functions in a project that is subject to the Domain Restricted Sharing organization policy you will be unable to allow unauthenticated invocation of a function. This policy restricts public data sharing to reduce the risk of data exfiltration.

If you wish to deploy functions that permit unauthenticated invocation, we recommend that you remove the Domain Restricted Sharing organization policy on the project. Organization policies can be set at the organization, folder or project level.

Once you have created your function(s) that allow unauthenticated invocation, the organization policy can be re-enabled:

• Functions deployed before the organization policy has been re-enabled will continue to allow unauthenticated invocation.
• New versions of these existing functions can be deployed without requiring authenticated invocation.
• New functions that permit unauthenticated invocations cannot be deployed.

Controlling access on all functions in a project

If you want to grant roles on all functions in a project, you can grant these roles on the project.

Note: You can't grant roles to allUsers and allAuthenticatedUsers at the project level.