resource"google_cloud_run_v2_service""default"{name="public-service"location="us-central1"deletion_protection=false # set to "true" in productiontemplate{containers{image="us-docker.pkg.dev/cloudrun/container/hello"}}}
如要更新 roles/run.invoker 的服務 IAM 繫結，請新增下列資源，參照您的 Cloud Run 服務：
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[],[],null,["# Allowing public (unauthenticated) access\n\nThere are two ways to create a public Cloud Run service:\n\n- [Disable](#invoker_check) the Cloud Run Invoker IAM check (recommended).\n- [Assign](#assign-allusers-iam-invoker) the Cloud Run Invoker IAM role to the `allUsers` member type.\n\n### Required roles\n\nTo disable or re-enable the Invoker IAM check on a service, you\nmust have the following permissions:\n\n- `run.services.create`\n- `run.services.update`\n- `run.services.setIamPolicy`\n\nThese permissions are included in the\n[Cloud Run Admin](/iam/docs/roles-permissions/run#run.admin)\n(`roles/run.admin`) role. See\n[Cloud Run IAM roles](/run/docs/reference/iam/roles)\nfor the full list of roles and their associated permissions.\n\n#### Disable the Cloud Run Invoker IAM check\n\nThe recommended way to make a public service is to disable the\nCloud Run Invoker IAM check.\nCloud Run enforces this check by default. Use this solution when\nthe project is subject to the\n[domain restricted sharing constraint in an organization policy](/resource-manager/docs/organization-policy/restricting-domains).\n\nTo disable the check: \n\n### Console\n\n1. In the Google Cloud console, go to the Cloud Run page:\n\n [Go to Cloud Run](https://console.cloud.google.com/run)\n2. Click **Create Service** if you are configuring a new service, then\n fill out the initial service settings page as needed.\n\n If you are configuring an existing service, click the service, then click\n the **Security** tab.\n3. Select **Allow public access**.\n\n4. Click **Create** or **Save**.\n\n### gcloud\n\n- For a new service, use the `gcloud run deploy` command with the\n `--no-invoker-iam-check` flag:\n\n ```bash\n gcloud run deploy SERVICE_NAME --no-invoker-iam-check\n ```\n\n Replace \u003cvar translate=\"no\"\u003eSERVICE_NAME\u003c/var\u003e with the service name.\n- For an existing service, use the `gcloud run services update` command with\n the `--no-invoker-iam-check` flag:\n\n ```bash\n gcloud run services update SERVICE_NAME --no-invoker-iam-check\n ```\n\nReplace \u003cvar translate=\"no\"\u003eSERVICE_NAME\u003c/var\u003e with the service name.\n\n### YAML\n\n1. To view and download the configuration:\n\n ```bash\n gcloud run services describe SERVICE --format export \u003e service.yaml\n ```\n2. Update the `run.googleapis.com/invoker-iam-disabled:` annotation:\n\n ```yaml\n apiVersion: serving.knative.dev/v1\n kind: Service\n metadata:\n annotations:\n run.googleapis.com/invoker-iam-disabled: true\n name: SERVICE_NAME\n ```\n\n Replace \u003cvar translate=\"no\"\u003eSERVICE_NAME\u003c/var\u003e with the name of your Cloud Run\n service.\n3. Replace the service with its new configuration using the following command:\n\n ```bash\n gcloud run services replace service.yaml\n ```\n\nVerify that the check is disabled after deployment by navigating to the\nservice's HTTPS endpoint.\n\n#### Re-enable the Cloud Run Invoker IAM check\n\nTo re-enable the check: \n\n### Console\n\n1. In the Google Cloud console, go to the Cloud Run page:\n\n [Go to Cloud Run](https://console.cloud.google.com/run)\n2. Click the service, then click **Security**.\n\n3. Select **Require authentication** and select **Identity and Access Management (IAM)**.\n\n4. Click **Save**.\n\n### gcloud\n\n- Update the service by passing the `--invoker-iam-check` flag:\n\n ```bash\n gcloud run services update SERVICE_NAME --invoker-iam-check\n ```\n\n Replace \u003cvar translate=\"no\"\u003eSERVICE_NAME\u003c/var\u003e with the service name.\n\n### YAML\n\n1. To view and download the configuration:\n\n ```bash\n gcloud run services describe SERVICE --format export \u003e service.yaml\n ```\n2. Update the `run.googleapis.com/invoker-iam-disabled:` annotation:\n\n \u003cbr /\u003e\n\n ```yaml\n apiVersion: serving.knative.dev/v1\n kind: Service\n metadata:\n annotations:\n run.googleapis.com/invoker-iam-disabled: false\n name: SERVICE_NAME\n ```\n\n \u003cbr /\u003e\n\n Replace \u003cvar translate=\"no\"\u003eSERVICE_NAME\u003c/var\u003e with the name of your\n Cloud Run service.\n\nVerify that the check is re-enabled after deployment by navigating to the\nservice's HTTPS endpoint.\n\n### Configure organization policy for the Cloud Run invoker IAM check\n\n| **Note:** If you participated in the invitation-only access to this feature, you might have an additional constraint (`constraints/run.requireInvokerIam`) that also controls access to the check.\n\nIf you're an administrator, you can restrict the ability to\n[disable the Invoker IAM check](#invoker_check)\nby using the `constraints/run.managed.requireInvokerIam` managed constraint.\nThis constraint is not enforced by default.\n\n### Assign the Cloud Run IAM Invoker role to the `allUsers` member type\n\n| **Important:** These instructions won't succeed if your project is under a [domain restricted sharing organization policy](/resource-manager/docs/organization-policy/restricting-domains) that restricts granting IAM roles to the `allUsers` member type as described in this page. If that is the case, you should [disable the Cloud RunIAM Invoker IAM check](#disable_invoker) instead.\n\nYou can allow public access to a service by assigning the\nCloud Run Invoker IAM role to the `allUsers` member type.\n\nYou must have the `run.services.setIamPolicy` permission to configure authentication\non a Cloud Run service. This permission is included in the\nCloud Run Admin role. See\n[Cloud Run IAM roles](/run/docs/reference/iam/roles)\nfor the full list of roles and their associated permissions. \n\n### Console\n\nFor an existing Cloud Run service:\n\n1. In the Google Cloud console, go to the Cloud Run page:\n\n [Go to Google Cloud console](https://console.cloud.google.com/run/)\n2. To the left of the service that you want to make public, click the\n checkbox. Don't click the service itself.\n\n3. In the information pane in the top-right corner, click the\n **Permissions** tab. If the information pane isn't visible, you might\n need to click **Show Info Panel** , then click **Permissions**.\n\n4. Click **Add principal**.\n\nIn the **New principals** field, enter the value `allUsers`.\n\n1. From the **Select a role** menu, select the\n **Cloud Run Invoker** role.\n\n2. Click **Save**.\n\n3. You will be prompted to verify that you would like to make this resource\n public. Click **Allow public access** to apply the change to the service\n IAM settings.\n\nFor a new service you are creating, [create the service](/run/docs/deploying#service)\nand select **Allow public access** in the **Authentication** section\nto make the service publicly available. To make a service private, select\n**Require authentication**.\n\n### gcloud\n\nTo make a service publicly accessible, use the `gcloud run services` command\nto add the special `allUsers` member type to a service and grant it the\n`roles/run.invoker` role: \n\n```bash\n gcloud run services add-iam-policy-binding [SERVICE_NAME] \\\n --member=\"allUsers\" \\\n --role=\"roles/run.invoker\"\n```\n\nRun the `gcloud run deploy` command to make your service\npublicly accessible when you deploy your service: \n\n```bash\ngcloud run deploy [SERVICE_NAME] ... --allow-unauthenticated\n```\n\n### YAML\n\nCreate a file named `policy.yaml` with the following content: \n\n bindings:\n - members:\n - allUsers\n role: roles/run.invoker\n\nAllow public access for the existing \u003cvar translate=\"no\"\u003eSERVICE\u003c/var\u003e using: \n\n```bash\ngcloud run services set-iam-policy SERVICE policy.yaml\n```\n\n### Terraform\n\nTo learn how to apply or remove a Terraform configuration, see\n[Basic Terraform commands](/docs/terraform/basic-commands).\nAdd the following to a [`google_cloud_run_v2_service`](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/cloud_run_v2_service) resource in your Terraform configuration: \n\n resource \"google_cloud_run_v2_service\" \"default\" {\n name = \"public-service\"\n location = \"us-central1\"\n\n deletion_protection = false # set to \"true\" in production\n\n template {\n containers {\n image = \"us-docker.pkg.dev/cloudrun/container/hello\"\n }\n }\n }\n\nTo update the service IAM binding for `roles/run.invoker`, add\nthe following resource referencing your Cloud Run service: \n\n resource \"google_cloud_run_service_iam_binding\" \"default\" {\n location = google_cloud_run_v2_service.default.location\n service = google_cloud_run_v2_service.default.name\n role = \"roles/run.invoker\"\n members = [\n \"allUsers\"\n ]\n }\n\nThis binding is only authoritative for the given role. Other IAM\nbindings within the service IAM policy are preserved."]]
