Google cloud deploy function with "allow unauthenticated" in python

Question

I am deploying a Google Cloud Function from another Cloud Function with Python. See my code below:

import requests
import json


def make_func(request):


    # Get the access token from the metadata server
    metadata_server_token_url = 'http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token?scopes=https://www.googleapis.com/auth/cloud-platform'
    token_request_headers = {'Metadata-Flavor': 'Google'}
    token_response = requests.get(metadata_server_token_url, headers=token_request_headers)
    token_response_decoded = token_response.content.decode("utf-8")
    jwt = json.loads(token_response_decoded)['access_token']

    # Use the api to create the function
    response = requests.post('https://cloudfunctions.googleapis.com/v1/projects/myproject/locations/us-central1/functions',
                               json={"name":"projects/my-project/locations/us-central1/functions/funct","runtime":"python37","sourceArchiveUrl":"gs://bucket/main.zip","entryPoint":"hello_world","httpsTrigger": {} },
                               headers={'Accept': 'application/json', 
                                        'Content-Type': 'application/json',
                                        'Authorization': 'Bearer {}'.format(jwt)} )   
    if response:
         return 'Success! Function Created'
    else:
         return str(response.json())

However this function does not have "allow unauthenticated" on automatically. Thus, no requests from outside are allowed. How can I change my Python code to add this functionality when deploying the new function?

Thanks

Dustin Ingram · Accepted Answer · 2020-04-18 18:57:44Z

3

You'll need to additionally give the allUsers member the Cloud Functions Invoker role:

from googleapiclient.discovery import build
service = build('cloudfunctions', 'v1')

project_id = ...
location_id = ...
function_id = ...
resource = f'projects/{project_id}/locations/{location_id}/functions/{function_id}'

set_iam_policy_request_body = {
    'policy': {
        "bindings": [
            {
              "role": "roles/cloudfunctions.invoker",
              "members": ["allUsers"],
            },
        ],
    },
}

request = service.projects().locations().functions().setIamPolicy(
    resource=resource,
    body=set_iam_policy_request_body,
)
response = request.execute()

print(response)

This uses the google-api-python-client package.

edited Apr 18, 2020 at 18:57

answered Apr 17, 2020 at 17:34

Dustin Ingram

21.8k7 gold badges69 silver badges86 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

Siem Peters Over a year ago

Do you know how I can do this in Python?

Dustin Ingram Over a year ago

There's an example in Python here: cloud.google.com/iam/docs/reference/rest/v1/projects.roles/…

Siem Peters Over a year ago

Thanks. But this is to create a role in the project right? How do I bind it to the function I created?

Dustin Ingram Over a year ago

Updated my answer with a complete example. You can also use this API service to deploy the function instead of manually getting the tokens and creating an HTTP request: cloud.google.com/functions/docs/reference/rest/v1/…

guillaume blaquiere Over a year ago

@SiemPeters, no, it binds on the function. Look at the resource name projects/{project_id}/locations/{location_id}/functions/{function_id}. It's not all the functions of the project, only this one with the function_id in the defined location

Dustin Ingram · Accepted Answer · 2020-04-18 19:01:02Z

2

In addition of Dustin answer, you have to know that the --allow-unauthenticated is for developer convenience. Under the hood it perform 2 things

Deploy your function in private mode
Add allUsers as member with Cloudfunction.invoker role

gcloud functions add-iam-policy-binding --member=allUsers --role=roles/cloudfunctions.invoker function-1

So, indeed, use the google-cloud-iam library for doing this.

In addition, your current code don't work because you use an access token to reach Cloud Function.

Indeed, you have an authorized error (401) -> You present an authorization header, but it's not authorize.
Without the header, you get a 403 error -> unauthenticated.

Anyway, you need to have a signed identity token. You have description and python code snippet here

edited Apr 18, 2020 at 19:01

Dustin Ingram

21.8k7 gold badges69 silver badges86 bronze badges

answered Apr 17, 2020 at 20:16

guillaume blaquiere

76.6k3 gold badges65 silver badges102 bronze badges

3 Comments

Siem Peters Over a year ago

Thank you. Do you know how to do do the policy binding in Python?

guillaume blaquiere Over a year ago

Thanks @Dustin-Ingram

MrR Over a year ago

how can I use iam_v2beta to achieve the same?

Collectives™ on Stack Overflow

Google cloud deploy function with "allow unauthenticated" in python

2 Answers 2

5 Comments

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

5 Comments

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related