Allowing public (unauthenticated) access

Console

1. In the Google Cloud console, go to the Cloud Run page:

   Go to Cloud Run

2. Click Create Serviceif you are configuring a new service, then fill out the initial service settings page as needed.

   If you are configuring an existing service, click the service, then click the Securitytab.

3. Select Allow public access.

4. Click Createor Save.

gcloud

• For a new service, use the gcloud run deploy command with the --no-invoker-iam-check flag:

  gcloud  
  run  
  deploy  
   SERVICE_NAME 
    
  --no-invoker-iam-check

  Replace SERVICE_NAME with the service name.

• For an existing service, use the gcloud run services update command with the --no-invoker-iam-check flag:

  gcloud  
  run  
  services  
  update  
   SERVICE_NAME 
    
  --no-invoker-iam-check

Replace SERVICE_NAME with the service name.

YAML

1. To view and download the configuration:

   gcloud  
   run  
   services  
   describe  
    SERVICE 
     
   --format  
    export 
     
   >  
   service.yaml

2. Update the run.googleapis.com/invoker-iam-disabled: annotation:

    apiVersion 
    : 
     
    serving.knative.dev/v1 
    kind 
    : 
     
    Service 
    metadata 
    : 
     
    annotations 
    : 
     
    run.googleapis.com/invoker-iam-disabled 
    : 
     
    true 
     
    name 
    : 
     
     SERVICE_NAME 
    
   

   Replace SERVICE_NAME with the name of your Cloud Run service.

3. Replace the service with its new configuration using the following command:

   gcloud  
   run  
   services  
   replace  
   service.yaml

Console

1. In the Google Cloud console, go to the Cloud Run page:

   Go to Cloud Run

2. Click the service, then click Security.

3. Select Require authenticationand select Identity and Access Management (IAM).

4. Click Save.

gcloud

• Update the service by passing the --invoker-iam-check flag:

  gcloud  
  run  
  services  
  update  
   SERVICE_NAME 
    
  --invoker-iam-check

  Replace SERVICE_NAME with the service name.

YAML

1. To view and download the configuration:

   gcloud  
   run  
   services  
   describe  
    SERVICE 
     
   --format  
    export 
     
   >  
   service.yaml

2. Update the run.googleapis.com/invoker-iam-disabled: annotation:

    apiVersion 
    : 
     
    serving.knative.dev/v1 
     
    kind 
    : 
     
    Service 
     
    metadata 
    : 
     
    annotations 
    : 
     
    run.googleapis.com/invoker-iam-disabled 
    : 
     
    false 
     
    name 
    : 
     
     SERVICE_NAME 
    
   

   Replace SERVICE_NAME with the name of your Cloud Run service.

Console

For an existing Cloud Run service:

1. In the Google Cloud console, go to the Cloud Run page:

   Go to Google Cloud console

2. To the left of the service that you want to make public, click the checkbox. Don't click the service itself.

3. In the information pane in the top-right corner, click the Permissionstab. If the information pane isn't visible, you might need to click Show Info Panel, then click Permissions.

4. Click Add principal.

In the New principalsfield, enter the value allUsers .

1. From the Select a rolemenu, select the Cloud Run Invokerrole.

2. Click Save.

3. You will be prompted to verify that you would like to make this resource public. Click Allow public accessto apply the change to the service IAM settings.

For a new service you are creating, create the service and select Allow public accessin the Authenticationsection to make the service publicly available. To make a service private, select Require authentication.

gcloud

To make a service publicly accessible, use the gcloud run services command to add the special allUsers member type to a service and grant it the roles/run.invoker role:

  
gcloud  
run  
services  
add-iam-policy-binding  
  [ 
SERVICE_NAME ] 
 
  
 \ 
  
--member = 
  "allUsers" 
 
  
 \ 
  
--role = 
  "roles/run.invoker" 
 

Run the gcloud run deploy command to make your service publicly accessible when you deploy your service:

gcloud  
run  
deploy  
  [ 
SERVICE_NAME ] 
 
  
...  
 --allow-unauthenticated 

YAML

Create a file named policy.yaml with the following content:

 bindings:
- members:
  - allUsers
  role: roles/run.invoker 

Allow public access for the existing SERVICE using:

gcloud  
run  
services  
set-iam-policy  
 SERVICE 
  
policy.yaml

Terraform

To learn how to apply or remove a Terraform configuration, see Basic Terraform commands .

  resource 
  
 "google_cloud_run_v2_service" 
  
 "default" 
  
 { 
  
 name 
  
 = 
  
 "public-service" 
  
 location 
  
 = 
  
 "us-central1" 
  
 deletion_protection 
  
 = 
  
 false 
 # set to "true" in production 
  
 template 
  
 { 
  
 containers 
  
 { 
  
 image 
  
 = 
  
 "us-docker.pkg.dev/cloudrun/container/hello" 
  
 } 
  
 } 
 } 
 

To update the service IAM binding for roles/run.invoker , add the following resource referencing your Cloud Run service:

  resource 
  
 "google_cloud_run_service_iam_binding" 
  
 "default" 
  
 { 
  
 location 
  
 = 
  
 google_cloud_run_v2_service.default.location 
  
 service 
  
 = 
  
 google_cloud_run_v2_service.default.name 
  
 role 
  
 = 
  
 "roles/run.invoker" 
  
 members 
  
 = 
  
 [ 
  
 "allUsers" 
  
 ] 
 } 
 

This binding is only authoritative for the given role. Other IAM bindings within the service IAM policy are preserved.