비공개 서비스를 테스트하는 가장 쉬운 방법은 Google Cloud CLI에서 Cloud Run 프록시를 사용하는 것입니다.
그러면 비공개 서비스가 http://localhost:8080(또는 --port로 지정된 포트)으로 프록시되어 활성 계정의 토큰 또는 지정한 다른 토큰이 제공됩니다.
이렇게 하면 웹브라우저 또는 curl 등의 도구를 사용할 수 있습니다.
이는 브라우저에서 웹사이트 또는 API를 비공개로 테스트하는 데 권장되는 방법입니다.
Linux, macOS, WSL(권장) 또는 cygwin 환경에서 다음 명령줄을 사용하여 서비스를 로컬로 프록시할 수 있습니다.
gcloudrunservicesproxySERVICE--projectPROJECT-ID
curl 사용
curl과 같은 도구를 사용하고 Authorization 헤더에 인증 토큰을 전달하여 프록시 없이 비공개 서비스를 테스트할 수 있습니다.
curl 명령어가 작동하려면 Cloud Run 관리자 또는 Cloud Run 호출자와 같이 run.routes.invoke 권한이 있는 사용자에게 유효한 ID 토큰을 전달해야 합니다. 역할과 관련 권한의 전체 목록은 Cloud Run IAM 역할을 참조하세요.
gcloud CLI에 로그인된 ID의 유효한 ID 토큰을 가져오려면 gcloud auth print-identity-token 명령어를 사용합니다. 계정에 서비스에 대한 run.routes.invoke 권한이 있는 한 gcloud CLI로 생성된 토큰을 사용하여 모든 프로젝트에서 HTTP 요청을 호출할 수 있습니다.
개발 목적으로는 gcloud CLI로 생성된 ID 토큰을 사용합니다. 그러나 이러한 토큰에는 대상 클레임이 없으므로 재전송 공격에 취약합니다. 프로덕션 환경에서는 적절하게 지정된 대상과 함께 서비스 계정에 발급된 ID 토큰을 사용합니다. 이 방식은 토큰 사용을 의도한 서비스로만 제한하여 보안을 강화합니다. Google 계정이 아닌 경우 서비스 계정 키가 다운로드되지 않도록 직원 ID 제휴를 사용하여 Cloud Run 서비스를 호출합니다.
서비스를 개발하고 사용하는 데 필요한 최소 권한 집합을 할당하는 것이 좋습니다. 서비스에 대한 IAM 정책이 최소 사용자 수와 서비스 계정 수로 제한되어 있는지 확인합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[],[],null,["# Authenticate developers\n\nIn addition to administrative actions such as creating, updating, and deleting\nservices, developers often want to test services privately before releasing\nthem. This option is for Cloud Run services and not Cloud Run\njobs.\n\nBefore you start\n----------------\n\nMake sure you grant permissions to access the services you are authenticating to.\nYou must grant the Cloud Run Invoker role to the developer or group of\ndevelopers: \n\n### Console UI\n\n1. Go to the Google Cloud console:\n\n [Go to Google Cloud console](https://console.cloud.google.com/run/)\n\n \u003cbr /\u003e\n\n2. Select the service, but don't click it.\n\n3. Click the **Permissions** tab in the right side panel. (You might need\n to first click **Show Info Panel** in the top right corner.)\n\n4. Click **Add Principal**.\n\n5. In the **New principals** field, enter the developer account email.\n\n6. Select the `Cloud Run Invoker` role from the **Select a role**\n drop-down menu.\n\n7. Click **Save**.\n\n### gcloud\n\nUse the `gcloud run services add-iam-policy-binding` command: \n\n```bash\ngcloud run services add-iam-policy-binding SERVICE \\\n --member='\u003cvar translate=\"no\"\u003eUSER\u003c/var\u003e:\u003cvar translate=\"no\"\u003eEMAIL\u003c/var\u003e' \\\n --role='roles/run.invoker'\n```\n\nwhere\n\n- \u003cvar translate=\"no\"\u003eSERVICE\u003c/var\u003e is the name of the service.\n- \u003cvar translate=\"no\"\u003eUSER\u003c/var\u003e is the value `user` or `group` depending on whether you are authorizing a single developer or a group.\n- \u003cvar translate=\"no\"\u003eEMAIL\u003c/var\u003e is the email account.\n\n For example: \n\n ```bash\n gcloud run services add-iam-policy-binding myservice \\\n --member='user:test-user@gmail.com' \\\n --role='roles/run.invoker'\n ```\n\n### Terraform\n\n\u003cbr /\u003e\n\nTo learn how to apply or remove a Terraform configuration, see\n[Basic Terraform commands](/docs/terraform/basic-commands).\nAdd the following to a [`google_cloud_run_v2_service`](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/cloud_run_v2_service) resource in your Terraform configuration: \n\n\u003cbr /\u003e\n\n resource \"google_cloud_run_v2_service_iam_binding\" \"binding\" {\n project = \"\u003cvar translate=\"no\"\u003ePROJECT\u003c/var\u003e\"\n location = \"\u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e\"\n name = \"\u003cvar translate=\"no\"\u003eSERVICE\u003c/var\u003e\"\n role = \"roles/run.invoker\"\n members = [\n \"user:\u003cvar translate=\"no\"\u003eEMAIL\u003c/var\u003e\",\n ]\n }\n\nReplace:\n\n- \u003cvar translate=\"no\"\u003ePROJECT\u003c/var\u003e with the project ID the service belongs to.\n- \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e with the location of the Cloud Run service.\n- \u003cvar translate=\"no\"\u003eSERVICE\u003c/var\u003e with the name of the Cloud Run service to bind the IAM policy to.\n- \u003cvar translate=\"no\"\u003eEMAIL\u003c/var\u003e with the user's email account you are granting permissions for.\n\nTest your private service\n-------------------------\n\nYou can use the Cloud Run proxy or `curl` to test your private service.\n\n### Use the Cloud Run proxy in Google Cloud CLI\n\nThe easiest way for you to test private services is to use the\n[Cloud Run proxy in Google Cloud CLI](/sdk/gcloud/reference/run/services/proxy).\nThis proxies the private service to `http://localhost:8080`\n(or to the port specified with `--port`),\nproviding the token of the active account or another token you specify.\nThis lets you use a web browser or a tool like `curl`.\nThis is the recommended way to test privately a website or API in your browser.\n\nYou can proxy a service locally using the following command line in a Linux,\nmacOS, [WSL (preferred)](https://docs.microsoft.com/en-us/windows/wsl/install-win10),\nor [cygwin](https://cygwin.com/install.html) environment: \n\n```bash\ngcloud run services proxy SERVICE --project PROJECT-ID\n```\n\n### Use `curl`\n\nAlternatively, you can test private services without the proxy by using a tool\nlike `curl` and by passing an auth token in the `Authorization` header: \n\n```bash\ncurl -H \"Authorization: Bearer $(gcloud auth print-identity-token)\" SERVICE_URL\n```\n\nFor the `curl` command to work, you must pass a valid ID token\nfor a user with the `run.routes.invoke` permission, such as the\n*Cloud Run Admin* or *Cloud Run Invoker* . See\n[Cloud Run IAM Roles](/run/docs/reference/iam/roles) for the full\nlist of roles and their associated permissions.\n| **Note:** To use the `curl` command on Microsoft Windows, you might need the [WSL (preferred)](https://docs.microsoft.com/en-us/windows/wsl/install-win10) or [cygwin](https://cygwin.com/install.html) command line.\n\nTo get a valid ID token for the identity logged into the gcloud CLI,\nuse the [`gcloud auth print-identity-token`](/sdk/gcloud/reference/auth/print-identity-token)\ncommand. You can use tokens created by the gcloud CLI to invoke HTTP\nrequests in any project, as long as your account has the `run.routes.invoke`\npermission on the service.\n\nFor development purposes, use gcloud CLI-generated ID tokens. However,\nnote that such tokens lack an audience claim, which makes them susceptible to\nreplay attacks. In production environments, use ID tokens issued for a service\naccount with the appropriate audience specified. This approach enhances security\nby restricting token usage to the intended service only. For non-Google Accounts,\nuse [Workforce Identity Federation](/iam/docs/workload-identity-federation)\nto invoke your Cloud Run service so you don't have to download a\nservice account key.\n\nWe recommend that you allocate the [minimum set of\npermissions](/iam/docs/best-practices-service-accounts#limit-service-account-privileges)\nrequired to develop and use your services. Make sure that IAM\npolicies on your services are limited to the minimum number of users and\nservice accounts."]]
